Network Time Protocol (NTP) Release Notes

Transcription

1 Network Time Protocol (NTP) Release Notes Version for HP-UX 11i v3 Abstract This document describes about new features and defect fixes for Network Time Protocol (NTP) version Part Number: Published: January 2018 Edition: 3

2 Contents Hewlett Packard Enterprise secure development life cycle... 3 About this document...4 Revision history of the document (current release)...4 Product overview...5 Installation requirements and procedure for Network Time Protocol (NTP)... 6 New features and commands in HP-UX NTP version Behavioral changes compared to HP-UX NTP version Defect fixes and enhancements Defects fixed in C release...10 Defects fixed in C release...10 Defects fixed in C release...11 Defects fixed in C release...12 Hewlett Packard Enterprise Specific changes...13 Additional information about HP-UX NTP Product documentation...15 Software and documentation availability in native languages Reporting defects...15 Documentation feedback...15 More on documentation of Network Time Protocol (NTP) Support policies for HP-UX Contents

3 Hewlett Packard Enterprise secure development life cycle Starting with HP-UX 11i v3 March 2013 update release, Hewlett Packard Enterprise secure development life cycle authenticates the HP-UX software. Software delivered through this release is digitally signed using Hewlett Packard Enterprise private key. You can now verify the authenticity of the software, before installing the products, delivered through this release. To verify the software signatures in signed depot, the following products must be installed on the system: B or later of SD (Software Distributor) A or later of HP-UX Whitelisting (WhiteListInf) To verify the signatures, run: /usr/sbin/swsign -v -s <depot_path> For more information, see Software Distributor documentation at NOTE: Ignite-UX software delivered with HP-UX 11i v3 March 2014 release or later supports verification of the software signatures in signed depot or media, during cold installation. For more information, see Ignite-UX documentation at Hewlett Packard Enterprise secure development life cycle 3

4 About this document This document provides details of the currently supported features, enhancement, installation, patches, bugs fixed across releases (if any), known problems, issues, their workarounds, policy details, and documentation details for Network Time Protocol (NTP) Release Notes. Revision history of the document (current release) Table 1: Revision history of the document: Network Time Protocol (NTP) Release Notes (current release) Document manufacturing part number Edition number Publication date Supported operating systems January 2018 HP-UX 11i v a 2 March 2017 HP-UX 11i v February 2017 HP-UX 11i v (Original edition) June 2016 HP-UX 11i v3 4 About this document

5 Product overview Network Time Protocol (NTP) is a tool designed to synchronize your computer to the Internet time servers or other sources such as a radio, a satellite receiver, or a telephone modem service. It is also used as a server for dependent clients for synchronizing time. Network Time Protocol (NTP) provides accuracy up to less than a millisecond on LANs and up to a few milliseconds on WANs. Typical Network Time Protocol (NTP) configurations utilize multiple redundant servers and diverse network paths in order to achieve high accuracy and reliability. Network Time Protocol (NTP) version 4 (NTPv4) is the latest version of Network Time Protocol (NTP) available on HP-UX 11i v3 operating system. You can download Network Time Protocol (NTP) version 4 (NTPv4) at: NOTE: If Network Time Protocol (NTP) version 4 (NTPv4) is installed on your system, do not install XNTP 3.5. To install the XNTP 3.5, uninstall Network Time Protocol (NTP) version 4 (NTPv4) first and then install the XNTP 3.5. Do not use allow_downdate=true option for installing XNTP 3.5 if Network Time Protocol (NTP) version 4 (NTPv4) is already installed. XNTP 3.5 patches does not get installed when Network Time Protocol (NTP) version 4 (NTPv4) is installed. The /etc/ntp.conf is uninstalled from the system when Network Time Protocol (NTP) version 4 (NTPv4) is uninstalled. So, before uninstalling Network Time Protocol (NTP) version 4 (NTPv4), back up the existing /etc/ntp.conf and then uninstall Network Time Protocol (NTP) version 4 (NTPv4). If Network Time Protocol (NTP) version 4 (NTPv4) is uninstalled, the XNTP 3.5 will not be restored on the system. For installing the XNTP 3.5, select HPUX-NTP > B HPUX NTP Server. Network Time Protocol (NTP) version 4 (NTPv4): Retains backward compatibility with Network Time Protocol (NTP) version 3 (NTPv3), that is with XNTP 3.5. It is delivered as a part of core in HP-UX 11i v3. Provides new features and significant performance improvements compared to Network Time Protocol (NTP) version 3 (NTPv3). An implementation of RFC 5905 (Network Time Protocol [NTP] version 4 [NTPv4]: Protocol and Algorithms Specification). Also implements RFC 5906 (Network Time Protocol [NTP] version 4 [NTPv4]: Autokey Specification) for authentication purpose. Product overview 5

6 Installation requirements and procedure for Network Time Protocol (NTP) For a detailed information on all the installation requirements and procedure for Network Time Protocol (NTP) version 4.2.8, see HPUX-NTP. 6 Installation requirements and procedure for Network Time Protocol (NTP)

7 New features and commands in HP-UX NTP version HP-UX NTP for HP-Ux 11i v3 operating system includes these new features: mrulist for ntpq(1m) (new command) The new ntpq mrulist command fetches arbitrarily large MRU lists over any reasonably reliable connection. For example, it is tested using an IPv6 tunnel over UDP. Instead of using a single multipacket response as with ntpdc monlist, mrulist fetches a variable number of rows in each request starting with the oldest. This gives a slightly oversized list that may include some of the oldest entries which have fallen off the MRU list from the server. By the time the newest entries are fetched, it basically provides a snapshot of the MRU list. The number of rows fetched per request is a tradeoff, because ntpq mode 6 protocol depends on reassembly of a response from multiple packets, with all packets retransmitted (if any are lost). In the face of packet loss, the rows per request are dropped as low as 2, which would almost surely fit in a single response packet (approximately 470 bytes). Without packet loss, the number of rows per request climbs as high as 96, chosen to fit in the limit of 32 packets in one response. For more information about mrulist, see the ntpq(1m) manpage. Leap smear Approach To insert a leap second, an NTP server adds a certain increasing "smear" offset to the real UTC time sent to its clients, so that after some predefined interval the leap second offset is compensated. The smear interval should be long enough (for example, several hours), so that NTP clients can easily follow the clock drift caused by the smeared time. During the period while the leap smear is being performed, ntpd will include a specially-formatted refid in time packets that contain "smeared" time. This refid is of the form 254.x.y.z, where x.y.z are 24 encoded bits of the smear value. With this approach the time an NTP server sent to its clients still matches UTC before the leap second and is up to the beginning of the smear interval. This corresponds to UTC after the insertion of the leap second has finished, at the end of the smear interval. By examining the first byte of the refid, one can also determine if the server is offering smeared time. HP-UX NTP for HP-Ux 11i v3 operating system includes these new commands: Table 2: New commands available for ntpq(1m) Command iostats ifstats sysstats monstats mrulist Display network and reference clock I/O statistics Display statistics for each local network address. Authentication is required Print statistics counters maintained in the protocol module Display monitor facility statistics Obtain and print traffic counts collected and maintained by the monitor facility Table Continued New features and commands in HP-UX NTP version

8 Command timerstats pstats Display interval timer counters Show the statistics for the peer with the given associd NOTE: rlimit memlock feature available in open source, but not supported by HP-UX NTP due to OS limitation. 8 New features and commands in HP-UX NTP version 4.2.8

9 Behavioral changes compared to HP-UX NTP version These are the changes in HP-UX NTP compared to NTP 4.2.6: The monlist feature is not supported. Alternatively, MRU list feature can be used. A new option enable mode7 need to be configured in the ntp.conf(4) file explicitly, for enabling support for the ntpdc(1m) command. For more details, see the ntp.conf(4) man page. ntpq(1m) does not support the pstatus command. Alternatively, readvar command can be used. Behavioral changes compared to HP-UX NTP version

10 Defect fixes and enhancements This chapter describes in detail about various defects fixed in each release and the enhancements. Defects fixed in C release JAG ID/CR ID QXCR QXCR Title: Error messages like bind(xx) AF_INET x.x.x.x#p flags xxx failed: Address already in use appear in syslog file. Problem: ntpd(1m) cannot bind multiple interfaces on the same subnet when broadcastclient option is enabled in ntp.conf(4). Resolution: ntpd(1m) is modified to bind multiple interfaces on the same subnet. Title: Error message appears in syslog after updating NTP from to Severity: Medium Problem: Unsynchronized, possible remote server failure or defective hardware clock messages appear in syslog upon synchronizing with local clock. Resolution: This issue is fixed in this release. Defects fixed in C release NOTE: This release contains fixes for all security issues in open source NTP 4.2.8p9 and earlier versions. 10 Defect fixes and enhancements

11 JAG ID/CR ID QXCR Title: Multiple issues fixes for HPUX-NTP. Problem: Security issue CVE , CVE , CVE ,CVE ,CVE ,CVE , CVE , and CVE Resolution: ntpd(1m) has been fixed. Title: Client rate limiting and server responses (CVE ) Problem: When ntpd(1m) is configured with rate limiting for all associations ("restrict default limited.." configuration in ntp.conf), the limits are applied to the responses received from its configured sources. These sources allow remote attackers to cause a denial of service by sending responses with a spoofed source address. Resolution: If restrict default limited... is configured, be sure to use restrict source... (without limited) to avoid this attack. QXCR QXCR Title: ntpdate(1m) manpage needs correction for -t option. Severity: Medium Problem: ntpdate(1m) manpage specifies incorrect default interval value for -t option. Resolution: ntpdate(1m) manpage has been updated. Title: "ntpd[xxx]: error waiting on child pid_id: No child processes" error is often logged in syslog.log, when we specify hostname (instead of IP) as the "server" entry. Severity: Medium Problem: ntpd(1m) causes an no child processes error when configure sever as hostname. Resolution: This issue is fixed in this release. Defects fixed in C release JAG ID/CR ID QXCR Title: HP-UX: Network Time Protocol (NTP) version 4 (NTPv4) gets installed partially when OpenSSL is not installed on the system. Problem: NTP is installed partially when OpenSSL is not installed on the system. Resolution: NTP installation fails if OpenSSL is not installed on the machine. Defects fixed in C release 11

12 Defects fixed in C release JAG ID/CR ID QXCR QXCR QXCR QXCR Title: MITM attacker can force ntpd to make a step larger than the panic threshold (small-step or big-step). Problem: Security issue CVE Resolution: ntpd(1m) is modified to implement the threshold limitation appropriately for the -g option. Title: DRDoS / Amplification Attack using ntpdc monlist command Problem: Security issue CVE Resolution: The mrulist command has replaced the monlist command. Title: Multiple issues fixes for NTP Problem: Security issue CVE , CVE , CVE , CVE and CVE Resolution: ntpd(1m) has been fixed Title: ntpd(1m) manpage contains incorrect information about the SLEW mode Severity: Medium Problem: ntpd(1m) manpage does not mention complete information about the SLEW mode. Resolution: This issue is fixed in this release. Table Continued 12 Defects fixed in C release

13 JAG ID/CR ID QXCR QXCR Title: HP-UX: Network Time Protocol (NTP) version 4 (NTPv4) manpages of ntpdate(1m) are incorrect for -t Severity: Medium Problem: Updated ntpdate(1m) manpage to correct usage of -t option. In Network Time Protocol (NTP) version 4 (NTPv4) -t option is to specify the interval (in seconds) between time requests. This problem is identified and rectified. Resolution: This issue is fixed in this release. Title: Network Time Protocol (NTP) version 4 (NTPv4) client fails to synchronize properly when server time is changed Severity: Critical Problem: Network Time Protocol (NTP) version 4 (NTPv4) client fails to synchronize properly when the server s time is changed. This problem is identified and rectified. Resolution: This issue is fixed in this release. Hewlett Packard Enterprise Specific changes The table describes in detail about the defect fixed or changes made as per the Hewlett Packard Enterprise specifications or specific to Hewlett Packard Enterprise and ported to Network Time Protocol (NTP) version 4 (NTPv4) from XNTP 3.5 in the earlier version releases of Network Time Protocol (NTP) version 4 (NTPv4), for HP-UX 11i v3 operating system. JAG/CR ID QXCR QXCR Title: xntpd failed to log an error or message when could not synchronize. Problem: xntpd process is not able to synchronize to a server due to bad hardware clock, it does not log an error or message in syslog.log. This problem is identified and rectified. Resolution This issue is fixed in this release. Title: Network Time Protocol (NTP) version 4 (NTPv4) Log corruption when Network Time Protocol (NTP) version 4 (NTPv4) loses synchronization Problem: Network Time Protocol (NTP) version 4 (NTPv4) Log corruption occurs, when Network Time Protocol (NTP) version 4 (NTPv4) loses synchronization. This problem is identified and rectified. Resolution: This issue is fixed in this release. Table Continued Hewlett Packard Enterprise Specific changes 13

14 JAG/CR ID JAGae70529/ QXCR JAGab75462/ QXCR Title: Changes in inetsvcs products for APA, VLAN, and LAN monitor environment Severity: Medium Problem: This problem is identified and rectified. Resolution: This issue is fixed in this release. Title: XNTP Holdover state enhancement support Severity: Critical Problem: This problem is identified and rectified. Resolution: This issue is fixed in this release. Additional information about HP-UX NTP Man pages Table 3: Manpages distributed with Network Time Protocol (NTP) version depot Manpage ntpd (1m) ntpdc (1m) ntpq (1m) ntpdate (1m) ntp.conf (4) ntp-keygen (1m) Sets and maintains the system time of day in synchronism with internet standard time servers. Queries ntpd daemon about its current state, and requests changes to that state. Monitors ntpd operations and determines performance. Steps time to synchronize with the server. Network Time Protocol (NTP) Configuration File. Generates public and private keys. Binaries 14 Additional information about HP-UX NTP 4.2.8

15 Table 4: Binaries distributed with Network Time Protocol (NTP) version depot Manpage ntp-keygen ntpd ntpdate ntpdc ntpq ntptrace This generates cryptographic data files used by the NTPv4 authentication and identification schemes. This is an ntp daemon that runs in the background, and keeps the date and time synchronized based on response from configured ntp servers. It also functions as an NTP server. This is a client program that sets the date and time on the response from an NTP server. This is used to query the ntp daemon about its current state and to request changes in that state. This is a utility program used to monitor ntpd operations, and to determine performance. This traces a chain of ntp servers back to the primary source. Product documentation The following are the product related documentation information. Software and documentation availability in native languages The product is supported only in English locale (LANG=C). Behavior of the product is unpredictable when LANG value is set to any other language code other than C. Documentation support for this product is also available only in English locale. Reporting defects You can report defects related to Network Time Protocol (NTP) product, by filing a request on QuIX. If you do not have access to QuIX, contact your local Hewlett Packard Enterprise representative to file a defect on your behalf. Documentation feedback Hewlett Packard Enterprise is committed to providing documentation that meets your needs. To help us improve the documentation, send any errors, suggestions, or comments to Documentation Feedback (docsfeedback@hpe.com). When submitting your feedback, include the document title, part number, edition, and publication date located on the front cover of the document. For online help content, include the product name, product version, help edition, and publication date located on the legal notices page. Product documentation 15

16 More on documentation of Network Time Protocol (NTP) For more information on documentation and other manuals of Network Time Protocol (NTP), see HP-UX Networking Documents. Support policies for HP-UX For more information about support policy of HP-UX, see HP-UX support policy. 16 More on documentation of Network Time Protocol (NTP)