How it is dangerous that the ntp service listen to all IPs on Linux?

Question

When I run the following command I get that the following output:

netstat -atpun | grep ntp

udp        0      0 172.16.0.1:123              0.0.0.0:*                               7734/ntpd
udp        0      0 127.0.0.1:123               0.0.0.0:*                               7734/ntpd
udp        0      0 0.0.0.0:123                 0.0.0.0:*                               7734/ntpd
udp        0      0 fe80::250:56ff:fe01:e30:123 :::*                                    7734/ntpd
udp        0      0 ::1:123                     :::*                                    7734/ntpd
udp        0      0 :::123                      :::*                                    7734/ntpd

How it is dangerous that the ntp service listen to all IPs on Linux? Can a potential attacker do any damage for my Linux server?

Answer 1

It's not dangerous per se, it's just usually a bad idea.

From a cloudflare article:

NTP is a simple UDP-based protocol that can be persuaded to return a large reply to a small request.

A misconfigured ntp server listening on the internet can (and will) be used to perform amplification and reflection attacks.

The main victim of such an attack wouldn't be you. The attacker would simply be using your system to perform a DoS attack on a third party. From the victim's point of view you would be the one performing the attack.

Depending on your infrastructre and the method chosen by the attacker, your system and/or your link to the internet might get DoSed as well.

A well secured and patched NTP server with the correct setup can be used to provide time to the open internet. For the general use case of setting the time on your servers or accross your network, it's a good idea to lock it down to trusted networks only and rate-limit access.

As for your actual question (ntp is listening on the "any" address), the netstat output alone doesn't provide enough information to assess whether you have a security problem or not. It just says that NTP is listening on port 123 on every interface. Those interfaces might not be connected to other hosts, they might be connected to trusted hosts only, they might have iptables rules blocking traffic on port UDP/123, etc.