OpenVAPTHighNET-SVC-003Network ExposureNetwork
Network Time Service Amplification Risk
NTP or chrony serves broad clients or permits legacy monitoring commands that can amplify traffic.
- Why It Matters
- Internet-reachable time services with broad client access or legacy mode 6 or 7 controls can be abused for reflection and amplification.
- How It Detects
- When UDP port 123 is network-reachable, reads ntp.conf or chrony.conf and flags broad allow directives or missing noquery restrictions.
- How to Fix
- Bind the time daemon to required interfaces, restrict clients to explicit networks, disable monitoring, and use noquery or equivalent controls.
- How to Verify
Confirm UDP port 123 is filtered from untrusted networks and review the daemon's effective access restrictions.- CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Control Category
- Network Exposure: CIS Controls v8 4, 12, 13; NIST CSF 2.0 PR.IR, PR.PS
- Fix Effort
- Low
- CIS Controls v8 Safeguard
- 4.8
- NIST CSF 2.0 Subcategory
- PR.PS-01, PR.IR-01
- CWE
- CWE-406
- NIST SP 800-53 Rev. 5
- SC-5, SC-7
- References
- CISA Alert TA14-013A, NTP Amplification Attacks Using CVE-2013-5211
chrony Documentation - Access Control
Learn the theory behind this check: P3 Network Exposure and Firewalls, P8 Data Services: Databases, File Shares, DNS and Mail.
Source Code
The complete file that defines this check. Run it with openvapt scan --only NET-SVC-003, or read it offline with openvapt explain NET-SVC-003.
internal/checks/network/network_controls.go · Lines 1-99View on GitHub at This Commit
| 1 | package network |
| 2 | |
| 3 | import ( |
| 4 | "context" |
| 5 | "github.com/openvapt/openvapt/internal/check" |
| 6 | "github.com/openvapt/openvapt/internal/checks/collect" |
| 7 | "github.com/openvapt/openvapt/internal/sys" |
| 8 | "strings" |
| 9 | ) |
| 10 | |
| 11 | func init() { |
| 12 | check.Register(&check.Check{ |
| 13 | ID: "NET-FW-002", |
| 14 | Title: "IPv6 Listeners Without IPv6 Firewall", |
| 15 | Domain: check.DomainNetwork, |
| 16 | Severity: check.High, |
| 17 | Category: check.CatNetwork, |
| 18 | Effort: check.EffortMedium, |
| 19 | CVSS: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", |
| 20 | Summary: "Network-reachable IPv6 listeners exist without a default-deny IPv6 firewall policy.", |
| 21 | Rationale: "An IPv4-only firewall does not protect IPv6 services, creating an alternate path that bypasses intended filtering.", |
| 22 | Detection: "Parses /proc/net/tcp6 and udp6, then inspects nft list ruleset and ip6tables -S for an input drop or reject policy.", |
| 23 | Fix: "Apply equivalent default-deny filtering for IPv6 with nftables or ip6tables and explicitly allow required services. Caution: allow SSH and ICMPv6 neighbour discovery and router messages before applying the default deny, or remote IPv6 sessions and IPv6 connectivity are cut.", |
| 24 | Verify: "Run ip6tables -S and nft list ruleset, then confirm the input chain has a default drop or reject policy.", |
| 25 | Refs: []check.Ref{{Title: "NIST SP 800-119, Guidelines for the Secure Deployment of IPv6", URL: "https://csrc.nist.gov/pubs/sp/800/119/final"}}, |
| 26 | Standards: check.Standards{CWE: []string{"CWE-923"}, NIST: []string{"SC-7"}}, |
| 27 | Run: runIPv6Firewall}) |
| 28 | check.Register(&check.Check{ |
| 29 | ID: "NET-SVC-003", |
| 30 | Title: "Network Time Service Amplification Risk", |
| 31 | Domain: check.DomainNetwork, |
| 32 | Severity: check.High, |
| 33 | Category: check.CatNetwork, |
| 34 | Effort: check.EffortLow, |
| 35 | CVSS: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", |
| 36 | Summary: "NTP or chrony serves broad clients or permits legacy monitoring commands that can amplify traffic.", |
| 37 | Rationale: "Internet-reachable time services with broad client access or legacy mode 6 or 7 controls can be abused for reflection and amplification.", |
| 38 | Detection: "When UDP port 123 is network-reachable, reads ntp.conf or chrony.conf and flags broad allow directives or missing noquery restrictions.", |
| 39 | Fix: "Bind the time daemon to required interfaces, restrict clients to explicit networks, disable monitoring, and use noquery or equivalent controls.", |
| 40 | Verify: "Confirm UDP port 123 is filtered from untrusted networks and review the daemon's effective access restrictions.", |
| 41 | Refs: []check.Ref{{Title: "CISA Alert TA14-013A, NTP Amplification Attacks Using CVE-2013-5211", URL: "https://www.cisa.gov/news-events/alerts/2014/01/13/ntp-amplification-attacks-using-cve-2013-5211"}, {Title: "chrony Documentation - Access Control", URL: "https://chrony-project.org/doc/4.6/chrony.conf.html"}}, |
| 42 | Standards: check.Standards{CWE: []string{"CWE-406"}, NIST: []string{"SC-5", "SC-7"}}, |
| 43 | Run: runNTP}) |
| 44 | } |
| 45 | |
| 46 | func runIPv6Firewall(ctx context.Context, s sys.System) []check.Result { |
| 47 | ls, err := collect.Listeners(s) |
| 48 | if err != nil { |
| 49 | return []check.Result{check.IncompleteR("/proc/net", "Socket tables were unreadable or partial")} |
| 50 | } |
| 51 | has6 := false |
| 52 | for _, l := range ls { |
| 53 | if strings.HasSuffix(l.Proto, "6") && l.Public() { |
| 54 | has6 = true |
| 55 | } |
| 56 | } |
| 57 | if !has6 { |
| 58 | return []check.Result{check.SkipR("IPv6", "No network-reachable IPv6 listener was found")} |
| 59 | } |
| 60 | if out, e := s.Run(ctx, "nft", "list", "ruleset"); e == nil && nftInputDefaultDeny(strings.ToLower(out)) { |
| 61 | return []check.Result{check.PassR("IPv6 firewall", "nftables has a default-deny input policy")} |
| 62 | } |
| 63 | if out, e := s.Run(ctx, "ip6tables", "-S"); e == nil { |
| 64 | if strings.Contains(out, "-P INPUT DROP") || strings.Contains(out, "-P INPUT REJECT") { |
| 65 | return []check.Result{check.PassR("IPv6 firewall", "ip6tables has a default-deny input policy")} |
| 66 | } |
| 67 | return []check.Result{check.FailR("IPv6 firewall", "IPv6 listeners exist but ip6tables input policy is not deny")} |
| 68 | } |
| 69 | return []check.Result{check.IncompleteR("IPv6 firewall", "IPv6 listeners exist but firewall state could not be read")} |
| 70 | } |
| 71 | |
| 72 | func runNTP(ctx context.Context, s sys.System) []check.Result { |
| 73 | ls, err := collect.Listeners(s) |
| 74 | if err != nil { |
| 75 | return []check.Result{check.IncompleteR("/proc/net", "Socket tables were unreadable or partial")} |
| 76 | } |
| 77 | public := false |
| 78 | for _, l := range ls { |
| 79 | if l.Port == 123 && l.Public() { |
| 80 | public = true |
| 81 | } |
| 82 | } |
| 83 | if !public { |
| 84 | return []check.Result{check.SkipR("UDP 123", "No network-reachable time service was found")} |
| 85 | } |
| 86 | p, text, complete, ok := readAny(ctx, s, "/etc/ntp.conf", "/etc/chrony/chrony.conf", "/etc/chrony.conf") |
| 87 | if !ok { |
| 88 | return []check.Result{check.IncompleteR("NTP configuration", "UDP 123 is reachable but daemon configuration was not readable")} |
| 89 | } |
| 90 | lower := strings.ToLower(text) |
| 91 | bad := strings.Contains(lower, "allow all") || strings.Contains(lower, "allow 0.0.0.0/0") || strings.Contains(lower, "restrict default kod nomodify notrap nopeer") || !strings.Contains(lower, "noquery") |
| 92 | if bad { |
| 93 | return []check.Result{check.FailR(p, "Time service access controls allow amplification-prone queries")} |
| 94 | } |
| 95 | if !complete { |
| 96 | return []check.Result{check.IncompleteR(p, "Time service configuration was truncated")} |
| 97 | } |
| 98 | return []check.Result{check.PassR(p, "Time service query access is restricted")} |
| 99 | } |
Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.
Cite This Page
If this page helped your work, please cite it. The version and web address are filled in; the access date is today's date in your browser. Every other style, and when credit is required, is on How to Cite OpenVAPT.
APA 7
OpenVAPT. (2026). NET-SVC-003 Network Time Service Amplification Risk (Version 0.1.0-alpha.6). OpenVAPT Check Catalogue. Retrieved October 16, 2026, from https://openvapt.com/checks/NET-SVC-003.html
In text: (OpenVAPT, 2026). Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
BibTeX
@misc{openvapt_net_svc_003,
author = {{OpenVAPT}},
title = {{NET-SVC-003 Network Time Service Amplification Risk}},
year = {2026},
howpublished = {\url{https://openvapt.com/checks/NET-SVC-003.html}},
note = {OpenVAPT Check Catalogue, version 0.1.0-alpha.6. Accessed 16 October 2026}
}
Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
Citing OpenVAPT does not mean OpenVAPT endorses, approves or has reviewed your work.