Re: [SLUG] NTP time server settings

[Rod Butcher]

The final straw that made me switch to Linux was when I was spending 
more time downloading and applying security patches and then allowing 
and not allowing my firewall to let my computer have strange 
conversations with outside forces, most of whom I suspect were located 
in Redmond, than I was actually working. Then there was the attack of 
the bios-eating worm. My computer became Typhoid Mary and then a dead 
badger (hey, but 2.6.8 supports  CONFIG_BLK_DEV_BADGERSCSI).
In short, I kind of hoped that I could kiss firewalls and viruses 
goodbye.. I only download non-executable code and don't open 
nonauthenticated email attachments. I only compile and / or run code 
from reputable source like sourceforge, Mandrake or Mozilla.
Any other security issues here ? I thought the problem with Windows was 
the basic architecture itself, not being designed to live in a "hostile 
environment" whereas I understand Linux was. ??
cheers
Rod
-----------------------------------------------------------
Brought to you by a thunderbird, penguin, gnu and a camel

[EMAIL PROTECTED] wrote:
John Clarke wrote:
On Thu, Sep 16, 2004 at 11:23:07 +1000, Rod Butcher wrote:

Mandrake 10 provides a user-friendly install for NTP time server 
connection but it doesn't seem to actually adjust my time.. the modem 
light flickers but time doesn't change. I've tried uadelaide.edu.au and 

Check your firewall rules.  You need to allow ntp (port 123 udp) in and
out.

I don't know mandrake but I got the impression that it's standard
practice to have a rule like:
# allow established connections, or related packets
iptables --append block --match state --state ESTABLISHED,RELATED
  --jump ACCEPT
which will allow a replying NTP packet pass through.  That's much
more convenient (and secure, IMHO) than completly opening the NTP port.
(in case you want to check if such a rule exists, the iptables -L output
for it looks like:
ACCEPT     all  --  anywhere anywhere state RELATED,ESTABLISHED
)
Cheers,
--Amos
--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html