ONTAP Discussions

Filers vulnerable to NTP Reflection Attack

spenticoff
7,067 Views

http://www.symantec.com/connect/blogs/hackers-spend-christmas-break-launching-large-scale-ntp-reflection-attacks
https://isc.sans.edu/forums/diary/NTP+reflection+attack/17300

Our filers have been used in a large scale NTP reflection attack. I can not find any documentation on how to restrict or turn off monlist queries.  options.timed doesn't seem to handle that part of the config

Any one have ideas?

1 ACCEPTED SOLUTION

spenticoff
7,067 Views

Paraphrased from my support case,

Due to the way ONTAP works, there is no ntp.conf file and so the fix will have to be an ONTAP patch.
http://support.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=787469

As a workaround either disable NTP until a fix is released, or block port 123/udp with a  firewall.

View solution in original post

5 REPLIES 5

JGPSHNTAP
7,067 Views

I don't have the slightest.  I would encourage you to call support immediately and report back to us. 

aborzenkov
7,067 Views

What Data ONTAP version? In 8.x you should be able to edit ntp configuration in diag shell.

And yes, it should be reported as soon as possible.

DONSIZEMOREUNC
7,067 Views

I asked NetApp support this same question, and they opened a BURT, 787469.  No big deal to me but sorry to hear your filer was misused.

aborzenkov
7,067 Views

BURT is not public ☹

spenticoff
7,068 Views

Paraphrased from my support case,

Due to the way ONTAP works, there is no ntp.conf file and so the fix will have to be an ONTAP patch.
http://support.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=787469

As a workaround either disable NTP until a fix is released, or block port 123/udp with a  firewall.

Public