Yuav ua li cas kom paub tseeb tias lub sij hawm ib se tsis dag yog tias koj muaj ib lab loj thiab me li sib txuas lus ntawm TCP / IP? Tom qab tag nrho, txhua tus ntawm lawv muaj lub moos, thiab lub sijhawm yuav tsum raug rau txhua tus ntawm lawv. Qhov teeb meem no tsis tuaj yeem hla tsis tau ntp.
Cia peb xav txog ib feeb twg hauv ib ntu ntawm kev lag luam IT infrastructure muaj teeb meem nrog synchronizing cov kev pabcuam dhau sijhawm. Tam sim ntawd pawg pawg ntawm Enterprise software pib ua tsis tiav, domains disintegrate, masters thiab Standby nodes unsuccessfully siv zog los kho cov xwm txheej quo.
Nws tseem muaj peev xwm hais tias tus neeg tawm tsam txhob txwm sim cuam tshuam lub sijhawm los ntawm MiTM lossis DDOS nres. Hauv qhov xwm txheej zoo li no, txhua yam tuaj yeem tshwm sim:
- Tus neeg siv tus lej password yuav tas sijhawm;
- X.509 daim ntawv pov thawj yuav tas sij hawm;
- TOTP ob-factor authentication yuav tsum tsis ua haujlwm;
- thaub qab yuav dhau los ua dhau lawm thiab lub kaw lus yuav rho tawm lawv;
- DNSSec yuav tawg.
Nws yog qhov tseeb tias txhua lub tuam tsev IT txaus siab rau kev ua haujlwm txhim khu kev qha ntawm lub sijhawm synchronization cov kev pabcuam, thiab nws yuav zoo yog tias lawv ntseeg tau thiab muaj kev nyab xeeb hauv kev lag luam.
Tuav NTP hauv 25 feeb
Network raws tu qauv - millennials muaj ib tug peculiarity, lawv tau thiab tsis zoo rau ib yam dab tsi ntxiv lawm, tab sis hloov lawv tsis yooj yim txawm tias qhov tseem ceeb ntawm cov neeg nyiam thiab cov nyiaj tau los.
Qhov kev tsis txaus siab tseem ceeb ntawm NTP classic yog qhov tsis muaj peev xwm txhim khu kev qha rau kev tiv thaiv kev tawm tsam los ntawm cov neeg intruders. Ntau qhov kev sim tau ua los daws qhov teeb meem no. Txhawm rau ua tiav qhov no, peb thawj zaug siv tus yuam sij ua ntej sib koom (PSK) rau kev sib pauv cov yuam sij symmetric.
Hmoov tsis zoo, txoj kev no tsis tau them rau qhov yooj yim vim li cas - nws tsis ntsuas qhov zoo. Manual configuration yuav tsum tau nyob rau ntawm tus neeg siv khoom nyob ntawm tus neeg rau zaub mov. Qhov no txhais tau tias koj tsuas tsis tuaj yeem ntxiv lwm tus neeg siv khoom zoo li ntawd. Yog tias muaj qee yam hloov pauv ntawm NTP server, txhua tus neeg siv khoom yuav tsum raug kho dua tshiab.
Tom qab ntawd lawv tuaj nrog AutoKey, tab sis tam sim ntawd lawv pom ntau qhov tsis zoo hauv kev tsim cov algorithm nws tus kheej thiab lawv yuav tsum tso tseg. Qhov tshaj plaws yog tias cov noob muaj 32-ntsis nkaus xwb, nws yog qhov me me thiab tsis muaj kev suav txaus txaus rau kev tawm tsam frontal.
- Key ID - symmetric 32-ntsis tus yuam sij;
- MAC (lus authentication code) - NTP pob ntawv checksum;
Autokey yog xam raws li hauv qab no.
Autokey=H(Sender-IP||Receiver-IP||KeyID||Cookie)Qhov twg H() yog cryptographic hash muaj nuj nqi.
Tib txoj haujlwm yog siv los xam cov checksum ntawm pob ntawv.
MAC=H(Autokey||NTP packet)Nws hloov tawm tias tag nrho cov kev ncaj ncees ntawm pob checks nyob ntawm qhov tseeb ntawm lub ncuav qab zib. Thaum koj muaj lawv, koj tuaj yeem rov kho qhov autokey thiab tom qab ntawd spoof MAC. Txawm li cas los xij, NTP server siv cov noob thaum tsim lawv. Qhov no yog qhov catch lies.
Cookie=MSB_32(H(Client IP||Server IP||0||Server Seed))MSB_32 muaj nuj nqi txiav tawm 5 qhov tseem ceeb tshaj plaws los ntawm md32 hash xam cov txiaj ntsig. Cov kua nplaum uas cov neeg siv khoom tsis hloov ntev npaum li cov servers tsis hloov pauv. Tom qab ntawd tus neeg tawm tsam tsuas tuaj yeem rov qab tus lej thawj zaug thiab tuaj yeem tsim cov ncuav qab zib ntawm nws tus kheej.
Ua ntej, koj yuav tsum txuas mus rau NTP server ua tus neeg siv khoom thiab tau txais cov ncuav qab zib. Tom qab ntawd, siv txoj kev quab yuam brute, tus neeg tawm tsam rov qab pib tus lej tom qab ib qho yooj yim algorithm.
Algorithm rau kev tawm tsam kev suav ntawm thawj tus lej siv txoj kev brute-force.
for i=0:2^32 − 1 do
Ci=H(Server-IP||Client-IP||0||i)
if Ci=Cookie then
return i
end if
end forCov chaw nyob IP paub, yog li txhua yam uas tseem tshuav yog tsim 2^32 hashs kom txog rau thaum cov khoom qab zib tsim tau zoo ib yam tau txais los ntawm NTP server. Ntawm qhov chaw nres tsheb hauv tsev tsis tu ncua nrog Intel Core i5, qhov no yuav siv sijhawm 25 feeb.
NTS - new Autokey
Nws tsis tuaj yeem tso nrog qhov kev ruaj ntseg zoo li no hauv Autokey, thiab hauv 2012 nws tau tshwm sim raws tu qauv. Txhawm rau cuam tshuam lub npe, lawv tau txiav txim siab rov ua dua tshiab, yog li Autokey v.2 tau hu ua Network Time Security.
NTS raws tu qauv yog qhov txuas ntxiv ntawm NTP kev ruaj ntseg thiab tam sim no tsuas yog txhawb unicast hom. Nws muab kev tiv thaiv cryptographic muaj zog tiv thaiv pob ntawv kev tswj hwm, tiv thaiv snooping, nplai zoo, muaj zog tiv thaiv cov pob ntawv poob, thiab ua rau qhov tsawg kawg ntawm kev poob qis tshwm sim thaum muaj kev ruaj ntseg.
Kev sib txuas NTS muaj ob theem uas siv cov txheej txheem qis dua. Ntawm thawj Nyob rau theem no, tus neeg siv khoom thiab cov neeg rau zaub mov pom zoo rau ntau yam kev sib txuas tsis sib xws thiab pauv cov ncuav qab zib uas muaj cov yuam sij nrog tag nrho cov ntaub ntawv nrog. Ntawm thib ob Nyob rau theem no, qhov kev tiv thaiv NTS tiag tiag tshwm sim ntawm tus neeg siv khoom thiab NTP server.
NTS muaj ob txheej txheej txheej txheej: Network Time Security Key Exchange (NTS-KE), uas pib muaj kev sib txuas ruaj ntseg dua TLS, thiab NTPv4, qhov kawg incarnation ntawm NTP raws tu qauv. Ib me ntsis ntxiv txog qhov no hauv qab no.
First stage - NTS KE
Nyob rau theem no, tus neeg siv khoom NTP pib TLS 1.2 / 1.3 kev sib tham dhau ntawm kev sib txuas TCP cais nrog NTS KE server. Thaum qhov kev sib kho no muaj cov hauv qab no tshwm sim.
- Cov tog neeg txiav txim qhov tsis muaj algorithm rau theem ob.
- Cov tog neeg txhais cov txheej txheem qis thib ob, tab sis tam sim no tsuas yog NTPv4 tau txais kev txhawb nqa.
- Cov tog neeg txiav txim siab qhov chaw nyob IP thiab chaw nres nkoj ntawm NTP server.
- NTS KE server issue cookies under NTPv4.
- Ob tog rho tawm ib khub ntawm cov yuam sij sib npaug (C2S thiab S2C) los ntawm cov khoom qab zib.
Txoj hauv kev no muaj txiaj ntsig zoo uas tag nrho lub nra ntawm kev xa cov ntaub ntawv tsis pub lwm tus paub txog kev sib txuas tsis tau poob rau ntawm qhov pov thawj thiab txhim khu kev qha TLS raws tu qauv. Qhov no tshem tawm qhov yuav tsum tau rov tsim kho koj tus kheej lub log kom ruaj ntseg NTP tuav tes.
Qhov thib ob theem - NTP nyob rau hauv NTS tiv thaiv
Hauv kauj ruam thib ob, tus neeg siv khoom ruaj ntseg synchronizes lub sijhawm nrog NTP server. Rau lub hom phiaj no, nws xa plaub qhov tshwj xeeb txuas ntxiv (qhov txuas ntxiv) hauv NTPv4 pob ntawv qauv.
- Lub Cim Cim Cim Ntxiv Ntxiv muaj qhov tsis sib xws los tiv thaiv kev tawm tsam rov qab.
- NTS Cookie Extension muaj ib qho ntawm NTP ncuav qab zib muaj rau tus neeg siv khoom. Txij li tsuas yog tus neeg siv khoom muaj qhov sib luag AAED C2S thiab S2C cov yuam sij, NTP server yuav tsum rho tawm lawv los ntawm cov khoom qab zib.
- NTS Cookie Placeholder Extension yog ib txoj hauv kev rau tus neeg siv khoom thov cov ncuav qab zib ntxiv los ntawm lub server. Qhov kev txuas ntxiv no yog qhov tsim nyog los xyuas kom meej tias NTP server teb tsis ntev npaum li qhov kev thov. Qhov no pab tiv thaiv kev tawm tsam amplification.
- NTS Authenticator thiab Encrypted Extension Fields Extension muaj AAED cipher nrog C2S key, NTP header, timestamps, thiab EF saum toj no raws li cov ntaub ntawv nrog. Yog tsis muaj qhov txuas ntxiv no nws muaj peev xwm ua rau cov ntawv teev sijhawm cuav.
Thaum tau txais kev thov los ntawm tus neeg siv khoom, tus neeg rau zaub mov txheeb xyuas qhov tseeb ntawm NTP pob ntawv. Ua li no, nws yuav tsum decrypt cov ncuav qab zib, rho tawm AAED algorithm thiab cov yuam sij. Tom qab ua tiav kev kuaj xyuas NTP pob ntawv rau kev siv tau, tus neeg rau zaub mov teb rau tus neeg siv khoom raws li hauv qab no.
- Unique Identifier Extension yog daim iav daim duab ntawm tus neeg thov kev thov, ib qho kev ntsuas tiv thaiv kev tawm tsam rov qab.
- NTS Cookie Extension ntxiv cov ncuav qab zib kom txuas ntxiv qhov kev sib tham.
- NTS Authenticator thiab Encrypted Extension Fields Extension muaj AEAD cipher nrog tus yuam sij S2C.
Kev sib tuav tes thib ob tuaj yeem rov ua dua ntau zaus, hla thawj kauj ruam, txij li txhua qhov kev thov thiab cov lus teb muab rau tus neeg siv khoom ntxiv ncuav qab zib. Qhov no muaj qhov zoo tshaj plaws uas cov peev txheej siv TLS ua haujlwm ntawm kev suav thiab xa cov ntaub ntawv PKI tau muab faib los ntawm tus lej ntawm kev thov rov qab. Qhov no yog tshwj xeeb tshaj yog yooj yim rau tshwj xeeb FPGA timekeepers, thaum tag nrho cov functionality yuav tsum tau ntim rau hauv ob peb lub luag hauj lwm los ntawm lub teb ntawm symmetric cryptography, hloov tag nrho cov TLS pawg mus rau lwm yam ntaus ntawv.
NTPSec
Dab tsi yog qhov tshwj xeeb ntawm NTP? Txawm tias muaj tseeb hais tias tus sau ntawm qhov project, Dave Mills, sim sau nws cov cai raws li qhov zoo tshaj plaws, nws yog ib tug tsis tshua muaj programmer uas yuav muaj peev xwm nkag siab txog intricacies ntawm lub sij hawm synchronization algorithms uas muaj hnub nyoog 35 xyoo. Qee qhov code tau sau ua ntej POSIX era, thiab Unix API tom qab ntawd txawv heev ntawm qhov siv niaj hnub no. Tsis tas li ntawd, kev paub txog kev txheeb cais yog xav tau kom tshem tawm cov teeb liab los ntawm kev cuam tshuam ntawm cov kab nrov nrov.
NTS tsis yog thawj qhov kev sim kho NTP. Thaum cov neeg tawm tsam tau kawm los siv NTP qhov tsis muaj peev xwm los nthuav tawm DDoS tawm tsam, nws tau pom tseeb tias yuav tsum muaj kev hloov pauv radical. Thiab thaum NTS cov ntawv sau tau raug npaj thiab ua tiav, US National Science Foundation thaum kawg ntawm 2014 tau ceev cov nyiaj pab rau kev kho tshiab ntawm NTP.
Pawg neeg ua haujlwm tau coj tsis yog los ntawm leej twg, tab sis - ib tug ntawm cov founders thiab ncej ntawm Open Source zej zog thiab sau phau ntawv . Thawj qhov uas Eric thiab nws cov phooj ywg tau sim ua yog txav NTP code los ntawm BitKeeper platform mus rau git, tab sis nws tsis ua haujlwm li ntawd. Tus thawj coj ntawm qhov project Harlan Stenn tau tawm tsam qhov kev txiav txim siab no thiab kev sib tham tau raug kaw. Tom qab ntawd nws tau txiav txim siab fork qhov project code, thiab NTPSec yug.
Cov kev paub dhau los, suav nrog kev ua haujlwm ntawm GPSD, lej keeb kwm yav dhau los thiab kev txawj ntse ntawm kev nyeem cov lej thaum ub - Eric Raymond yog tus neeg nyiag nkas uas tuaj yeem rub tawm qhov project. Pab neeg no pom tus kws tshaj lij kev tsiv teb tsaws chaws thiab tsuas yog 10 lub lis piam NTP ntawm GitLab. Ua hauj lwm nyob rau hauv tag nrho viav vias.
Eric Raymond pab neeg tau ua haujlwm zoo ib yam li Auguste Rodin tau ua nrog pob zeb thaiv. Los ntawm kev tshem tawm 175 KLOC ntawm cov cai qub, lawv muaj peev xwm txo qhov kev tawm tsam los ntawm kev kaw ntau qhov kev ruaj ntseg.
Nov yog cov npe tsis tiav ntawm cov uas suav nrog hauv kev faib khoom:
- Undocumented, outdated, outdated los yog tawg refclock.
- Lub tsev qiv ntawv ICS tsis siv.
- libopts/autogen.
- Qub code rau Windows.
- ntpdc ua.
- Autokey.
- ntpq C code tau raug sau dua tshiab hauv Python.
- sntp/ntpdig C code tau rov sau dua hauv Python.
Ntxiv rau kev ntxuav cov cai, qhov project muaj lwm yam dej num. Nov yog qee cov npe ntawm kev ua tiav:
- Code kev tiv thaiv tiv thaiv tsis dhau overflow tau zoo heev. Txhawm rau tiv thaiv tsis dhau, txhua txoj hlua tsis ruaj ntseg (strcpy/strcat/strtok/sprintf/vsprintf/gets) tau raug hloov nrog cov qauv kev nyab xeeb uas siv qhov txwv tsis pub loj.
- Added NTS support.
- Txhim kho lub sij hawm kauj ruam raug kaum npaug los ntawm kev txuas lub cev kho vajtse. Qhov no yog vim qhov tseeb tias niaj hnub computer moos tau dhau los ua qhov tseeb ntau dua li thaum NTP tau yug los. Cov neeg tau txais txiaj ntsig loj tshaj plaws ntawm qhov no yog GPSDO thiab lub sijhawm siv xov tooj cua.
- Tus naj npawb ntawm cov lus programming tau raug txo mus rau ob. Hloov chaw Perl, awk thiab txawm tias S scripts, nws yog tam sim no tag nrho Python. Vim qhov no, muaj ntau txoj hauv kev rau kev rov siv dua code.
- Hloov cov noodles ntawm autotools scripts, qhov project pib siv software tsim system .
- Hloov kho thiab hloov kho cov ntaub ntawv qhov project. Los ntawm qhov tsis sib xws thiab qee zaum archaic sau cov ntaub ntawv, lawv tsim cov ntaub ntawv zoo heev. Txhua qhov kev hloov kab hais kom ua thiab txhua qhov chaw teeb tsa tam sim no muaj ib qho tseeb version. Tsis tas li ntawd, cov nplooj ntawv txiv neej thiab cov ntaub ntawv web tam sim no tau tsim los ntawm tib cov ntaub ntawv tseem ceeb.
NTPSec muaj rau ntau qhov kev faib tawm Linux. Tam sim no, qhov tseeb ruaj khov version yog 1.1.8, rau Gentoo Linux nws yog qhov kawg.
(1:696)$ sudo emerge -av ntpsec
These are the packages that would be merged, in order:
Calculating dependencies... done!
[ebuild R ] net-misc/ntpsec-1.1.7-r1::gentoo USE="samba seccomp -debug -doc -early -gdb -heat -libbsd -nist -ntpviz -rclock_arbiter -rclock_generic -rclock_gpsd -rclock_hpgps -rclock_jjy -rclock_local -rclock_modem -rclock_neoclock -rclock_nmea -rclock_oncore -rclock_pps -rclock_shm -rclock_spectracom -rclock_trimble -rclock_truetime -rclock_zyfer -smear -tests" PYTHON_TARGETS="python3_6" 0 KiB
Total: 1 package (1 reinstall), Size of downloads: 0 KiB
Would you like to merge these packages? [Yes/No]
Chrony
Muaj lwm qhov kev sim hloov NTP qub nrog lwm txoj kev nyab xeeb dua. Chrony, tsis zoo li NTPSec, yog sau los ntawm hauv av thiab yog tsim los ua kom ntseeg tau nyob rau hauv ntau yam kev mob, nrog rau kev sib txuas tsis ruaj khov, ib feem ntawm lub network muaj los yog congestion, thiab kub hloov. Tsis tas li ntawd, chrony muaj lwm yam zoo:
- chrony tuaj yeem synchronize lub kaw lus moos nrawm dua nrog qhov tseeb dua;
- chrony me me, siv lub cim xeeb tsawg, thiab nkag mus rau CPU tsuas yog thaum xav tau. Qhov no yog qhov loj ntxiv rau kev txuag cov peev txheej thiab lub zog;
- chrony txhawb nqa hardware timestamps ntawm Linux, tso cai rau synchronization muaj tseeb ntawm cov tes hauj lwm hauv zos.
Txawm li cas los xij, chrony tsis muaj qee yam ntawm cov yam ntxwv ntawm NTP qub, xws li tshaj tawm thiab ntau tus neeg siv khoom / server. Tsis tas li ntawd, classic NTP txhawb nqa ntau lub tshuab ua haujlwm thiab cov platforms.
Txhawm rau lov tes taw kev ua haujlwm ntawm lub server thiab NTP thov rau cov txheej txheem chronyd, tsuas yog sau qhov chaw nres nkoj 0 hauv cov ntaub ntawv chrony.conf. Qhov no yog ua tiav nyob rau hauv rooj plaub uas tsis tas yuav tsum tau tswj lub sijhawm rau NTP cov neeg siv khoom lossis cov phooj ywg. Txij li thaum version 2.0, NTP server chaw nres nkoj tsuas yog qhib thaum nkag tau los ntawm kev tso cai cov lus qhia lossis cov lus txib tsim nyog, lossis NTP cov phooj ywg raug teeb tsa, lossis siv cov lus qhia tshaj tawm.
Qhov kev zov me nyuam muaj ob lub modules.
- chronyd yog ib qho kev pabcuam uas khiav hauv keeb kwm yav dhau. Nws tau txais cov ntaub ntawv hais txog qhov sib txawv ntawm lub moos system thiab lub sijhawm sab nraud server thiab kho lub sijhawm hauv zos. Nws kuj tseem siv NTP raws tu qauv thiab tuaj yeem ua raws li tus neeg siv khoom lossis server.
- chronyc yog ib qho kev siv kab hais kom ua rau kev saib xyuas thiab tswj. Siv los kho ntau yam kev pabcuam, piv txwv li tso cai rau koj ntxiv lossis tshem tawm NTP servers thaum chronyd tseem khiav.
Txij li version 7 ntawm RedHat Linux chrony raws li lub sijhawm synchronization kev pabcuam. Lub pob kuj muaj rau lwm qhov kev faib tawm Linux. Qhov tseeb ruaj khov version yog 3.5, npaj rau kev tso tawm ntawm v4.0.
(1:712)$ sudo emerge -av chrony
These are the packages that would be merged, in order:
Calculating dependencies... done!
[binary N ] net-misc/chrony-3.5-r2::gentoo USE="adns caps cmdmon ipv6 ntp phc readline refclock rtc seccomp (-html) -libedit -pps (-selinux)" 246 KiB
Total: 1 package (1 new, 1 binary), Size of downloads: 246 KiB
Would you like to merge these packages? [Yes/No]
Yuav ua li cas teeb tsa koj tus kheej tej thaj chaw deb chrony server hauv Is Taws Nem kom synchronize lub sijhawm ntawm chaw ua haujlwm network. Hauv qab no yog ib qho piv txwv ntawm kev teeb tsa VPS.
Piv txwv ntawm kev teeb tsa Chrony ntawm RHEL / CentOS ntawm VPS
Tam sim no cia peb xyaum me ntsis thiab teeb tsa peb tus kheej NTP server ntawm VPS. Nws yooj yim heev, tsuas yog xaiv tus nqi tsim nyog ntawm RuVDS lub vev xaib, tau txais cov neeg ua haujlwm npaj txhij thiab ntaus cov lus txib yooj yim. Rau peb lub hom phiaj, qhov kev xaiv no zoo heev.
Cia peb mus rau kev teeb tsa cov kev pabcuam thiab ua ntej nruab lub pob chrony.
[root@server ~]$ yum install chronyRHEL 8 / CentOS 8 siv tus thawj tswj pob txawv.
[root@server ~]$ dnf install chronyTom qab txhim kho chrony, koj yuav tsum pib thiab qhib qhov kev pabcuam.
[root@server ~]$ systemctl enable chrony --nowYog xav tau, koj tuaj yeem hloov pauv rau /etc/chrony.conf, hloov NPT servers nrog cov neeg nyob ze tshaj plaws kom txo lub sijhawm teb.
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
server 0.ru.pool.ntp.org iburst
server 1.ru.pool.ntp.org iburst
server 2.ru.pool.ntp.org iburst
server 3.ru.pool.ntp.org iburst
Tom ntej no, peb teeb tsa synchronization ntawm NTP server nrog cov nodes los ntawm lub pas dej teev.
[root@server ~]$ timedatectl set-ntp true
[root@server ~]$ systemctl restart chronyd.service
Nws tseem yuav tsum tau qhib NTP chaw nres nkoj rau sab nraud, txwv tsis pub lub firewall yuav thaiv cov kev sib txuas ntawm cov neeg siv khoom.
[root@server ~]$ firewall-cmd --add-service=ntp --permanent
[root@server ~]$ firewall-cmd --reload
Ntawm cov neeg siv khoom, nws txaus los teeb tsa lub sijhawm kom raug.
[root@client ~]$ timedatectl set-timezone Europe/MoscowCov ntaub ntawv /etc/chrony.conf qhia tus IP lossis tus tswv lub npe ntawm peb VPS server khiav NTP server chrony.
server my.vps.serverThiab thaum kawg, pib lub sijhawm synchronization ntawm tus neeg siv khoom.
[root@client ~]$ systemctl enable --now chronyd
[root@client ~]$ timedatectl set-ntp true
Lub sijhawm tom ntej kuv yuav qhia koj tias cov kev xaiv twg muaj rau synchronizing lub sijhawm tsis muaj Internet.
Tau qhov twg los: www.hab.com
