[pkg-ntp-maintainers] Bug#806862: receive: Unexpected origin timestamp from 61.219.119.38

積丹尼 Dan Jacobson jidanni at jidanni.org
Wed Dec 2 11:44:47 UTC 2015


Package: ntp
Version: 1:4.2.8p4+dfsg-3+b1

I saw

12月 02 19:39:46 jidanni5 ntpd[2246]: Soliciting pool server 61.219.119.38
12月 02 19:39:47 jidanni5 ntpd[2246]: Soliciting pool server 61.219.119.41
12月 02 19:39:47 jidanni5 ntpd[2246]: Soliciting pool server 117.56.73.145
12月 02 19:39:48 jidanni5 ntpd[2246]: Soliciting pool server 123.204.45.116
12月 02 19:39:48 jidanni5 ntpd[2246]: Soliciting pool server 123.204.45.116
12月 02 19:39:48 jidanni5 systemd[905]: Time has been changed
12月 02 19:39:48 jidanni5 ntpd[2246]: receive: Unexpected origin timestamp from 61.219.119.38

http://www.cs.bu.edu/~goldbe/NTPattack.html says

Attack 1 and Attack 2 (Denial of Service). Upgrade to ntpd v4.2.8p4. To
see what ntpd version you are running, log into to your NTP server and
type ntpq and then rv. Also, monitor the system log for error messages
of the form "receive: Unexpected origin timestamp from %s", which could
indicate that you are subject to a priming-the-pump attack.



More information about the pkg-ntp-maintainers mailing list