NTP users are strongly urged to take immediate action to ensure that their NTP daemons are not susceptible to being used in distributed denial-of-service (DDoS) attacks. Please also take this opportunity to defeat denial-of-service attacks by implementing Ingress and Egress filtering through BCP38.

ntp-4.2.8p15 was released on 23 June 2020. It addresses 1 medium-severity security issue in ntpd, and provides 13 non-security bugfixes over 4.2.8p13.

Please see the NTP Security Notice for vulnerability and mitigation details.

---

Are you using Autokey in production? If so, please contact Harlan - he's got some questions for you.

Future Ideas for NTP

Initial time set

Let's find a way to not need the "the time must be right to within 68 (or whatever) years" for the initial time set.

Name resolution

There is good news/bad news about our current method of only resolving DNS names for NTP servers "initially".

How does the following sound:

• The server may specify a "lifetime" for its name resolution "information"
• The client may specify a "lifetime" for the name resolution data it gets
• If either/both of these are specified, we should re-fetch at the "sooner" interval
• The client may detect a (reachability?) problem in the interim, which should cause a re-fetch