topic Re: How can you restrict NTP queries and prevent NTP reflection attacks? in ONTAP Discussions

How can you restrict NTP queries and prevent NTP reflection attacks?

spenticoff — Thu, 05 Jun 2025 05:44:07 GMT

http://www.symantec.com/connect/blogs/hackers-spend-christmas-break-launching-large-scale-ntp-reflection-attacks

https://isc.sans.edu/forums/diary/NTP+reflection+attack/17300

Our filers are being used as part of a large scale NTP reflection attack, I can find no documentation on how to turn off monlist queries.
Any one here have any ideas?

Re: How can you restrict NTP queries and prevent NTP reflection attacks?

ostiguy — Tue, 04 Feb 2014 19:59:20 GMT

Are you seeing UDP traffic with a source port of 123 leaving your network to go to the internet? If so, configure an access control list on your network egress to disallow that.

Re: How can you restrict NTP queries and prevent NTP reflection attacks?

spenticoff — Tue, 04 Feb 2014 21:28:34 GMT

We don't operate the firewall, and that is a viable option, I was just looking for a netapp specific solution so I don't have to escalate.

Re: How can you restrict NTP queries and prevent NTP reflection attacks?

WSANDERSATFLEXERA — Thu, 13 Feb 2014 00:27:01 GMT

If you can create an internal NTP server (or two) it's best practice to use a few strategically placed internal NTP servers and point the rest of your infrastructure to there. You can then disable monlist on your external-facing NTP servers, it is easy in the Unix NTP server.

Re: How can you restrict NTP queries and prevent NTP reflection attacks?

spenticoff — Thu, 13 Feb 2014 15:44:53 GMT

Paraphrased from my support case,

Due to the way ONTAP works, there is no ntp.conf file and so the fix will have to be an ONTAP patch.
http://support.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=787469

As a workaround either disable NTP until a fix is released, or block port 123/udp with a firewall.

Re: How can you restrict NTP queries and prevent NTP reflection attacks?

scottgelb — Thu, 13 Feb 2014 21:20:58 GMT

We just received notification of Technical Support Bulletin - KB 7010104. For cDOT the good news is there is a firewall in ONTAP.

Re: How can you restrict NTP queries and prevent NTP reflection attacks?

spenticoff — Fri, 14 Feb 2014 18:17:37 GMT

can you link to this bulletin?

I'm still in 7 mode but this is good news.