[ntp:questions] Windows Time with NTPv4
Martin Burnicki
martin.burnicki at meinberg.de
Mon Mar 10 10:01:37 UTC 2008
Dave,
David L. Mills wrote:
> Folks,
>
> I just poked around and discovered something interesting that affects
> Windows clients, both XP and Vista.
>
> Microsoft has broken the NTP specification in that the client sends a
> request in symmetric active mode instead of client mode. According to
> the NTP spec, both ancient and modern, this causes the server to launch
> a symmetric passive association, which would be a serious security
> vulnerability.
>
> The NTPv4 servers, including those at USNO and NIST, have specific means
> to protect against this vulnerability, so as you might have noticed,
> synchronizing XP or Vista clients to those servers fails.
>
> However, I jimmied the code so that, while it will not launch an
> association if denied, it will reply in symmetric passive mode. In other
> words, the server behaves in the same way as with an ordinary
> client/server mode. With this change, now in the development branch,
> Windows XP and Vista now work correctly.
>
> I'm not happy about this. I thought Microsoft had fixed this long ago in
> a service pack. Now at least folks with 400 PCs don't all have to light
> up Windows NTP.
Huh? This has already been discussed back in 2002, and you had already
introduced a workaround which should (and obviously did) work similar to
what you write now.
See your own posts from August 4, 2002:
http://groups.google.de/group/comp.protocols.time.ntp/msg/51963f1da8a17cbe
http://groups.google.de/group/comp.protocols.time.ntp/msg/199932ca96c5a9a7
Had this workaround been removed intentionally or unintentionally in the
mean time, or why should the current -dev version refuse to respond to the
requests of those broken clients?
BTW, there's a Meinberg FAQ which tells how to fix those brokeen Windows
clients and let them send normal peer requests instead of symmetric active
requests:
"Why does my Windows Time Service (w32time) not synchronize with my NTP
Server?"
http://www.meinberg.de/english/faq/faq_28.htm
Martin
--
Martin Burnicki
Meinberg Funkuhren
Bad Pyrmont
Germany
More information about the questions
mailing list