[Secure-testing-team] Bug#844520: ntpdate: should not set the date from /etc/network/if-up.d/ntpdate

[Vincent Lefevre]

Package: ntpdate
Version: 1:4.2.8p8+dfsg-1.1
Severity: wishlist
Tags: security

Running ntpdate from /etc/network/if-up.d/ntpdate is useless in most
cases (the user should use another method to synchronize his machine,
which is the case *by default* with systemd) and is insecure as there
is no authentication of the time server: An attacker who controls the
network can provide a server with an old date, for which some old
certificates may become valid again. In particular, the user may not
notice that the date has changed since disconnections/reconnections
can be done automatically.

I suppose that the main uses of ntpdate nowadays are:
  * to query (check) the time with some given server;
  * to set the time by running ntpdate manually in case something
    bad occurred (then the user can easily check that the date is
    not completely wrong).

-- System Information:
Debian Release: stretch/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'stable-updates'), (500, 'unstable'), (500, 'testing'), (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 4.8.0-1-amd64 (SMP w/8 CPU cores)
Locale: LANG=POSIX, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages ntpdate depends on:
ii  dpkg         1.18.15
ii  libc6        2.24-5
ii  libssl1.0.2  1.0.2j-4
ii  netbase      5.3

ntpdate recommends no packages.

ntpdate suggests no packages.

-- no debconf information