[Admins] Blocked ports UDP/123, UDP/623

[IOhannes m zmölnig - mur.at]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 2015-11-24 13:45, Jogi Hofmüller wrote:
>> I oppose! (until someone can properly explain why this step is 
>> absolutely necessary; on a sidenote: how many NTP servers have
>> been attacked from within the mur.at network in the last 5
>> years?).
> 
> So far none.  It's also not about being attacked rather than being
> part of an attack.

yep. my question was about the latter ("attacked *from* mur.at")

> I mentioned emails from CERT that we got in my previous message.

oh ja. but I did not read those emails so i don't know what they say
*exactly*.

> These were about machines running ntp servers that ARE vulnerable
> for amplification attacks.  Since fixing these is (for reasons
> beyond my understanding) not an option we decided to disable the
> port network wide.

this sounds like really strange reasoning. (we could block TCP/22,
TCP/80 and TCP/443 with the very same argument).

anyhow, i see that more and more aconet members block outgoing NTP and
I would like to really understand the reasoning behind that (which I
still do not, since a "CERT mentioning open ports on vulnerable
machines" is not good enough for me.

hence my insisting on explaining/clarifying such a service degradation
(before i request being whitelisted).

gamsdr
IOhannes
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJWVGuDAAoJELZQGcR/ejb4nxQP/1TAYt5OrOAtV2daQzYci1Ie
AAiE9v6vnwe25fOouktCwciC1Ydr2NHxxTW96VL+J8GVdt690eK50/50JQhm8F8C
njO35zSsc2UPJ8jhoBodGmW83pgBASN3d/nqaOJjZ20d8CuJt+BTBguDP7UNqhLk
yIrBouXeYj1ubw4BN3vLmNs+aClzMhhhdJClVGR9M2UCYk4ynSUXpuhRCyD8R61j
Im1XHj65dsYMT8XstS9Hhd+d9rSuKvZGSCmQoBwSnuUG4TSutaScqN8+XebstGGx
VrhI6Nhf9HaPLwMRI8C+yONt+U8MKNHVJUr0/UhHAVDBQcqjhpDJcKHg6xfO6mE2
9S9QWW1jcFbrOTkFLsWXBkmMZaY+BHPiCwbLr/sCdOPUSPYvXrMqI22GUDZrmZrv
ZoFEdKXR7Ab2VhBEkmWWxWmTssnlhKP+Bj67JWlGH4iwnnTxDZva3gobHn1VLnok
glY+a4AqNOf8rUBrWxYL4hZMEbjsJisRYEJFJwdYvcFi/M6z8hqpMndsZTohiDlX
yAqcBXFPZ39f5WvGcNUeS1yoQV+jAHYEW02ERSzJq1tJHkSCX40bMSyWLXzCc2Cl
6YO5GnBD39qbCXMNMZzv/eKAtEihS7vXu1lBj7zMP1NISvVKxS9c3yix7CvDfiCX
Z1CxX49vj31qE8rVFVv3
=jSdz
-----END PGP SIGNATURE-----