Lock down the time service
An open NTP daemon answers the whole internet and trusts unauthenticated upstreams. Restrict who it serves and require authenticated time.
Scenario
A host runs ntpd with a stock config: it answers time and management queries from anyone, and it
syncs from upstream servers without authenticating them. That makes it usable as a DDoS amplifier
and trusts whatever time an attacker on-path feeds it.
You're handed /etc/ntp.conf. Tighten it.
Your job
- Make the default restriction deny modifications and queries (a default-deny posture), then allow only what you need (localhost, and the trusted management network for read-only queries).
- Load a keys file and declare a trusted key.
- Reference each upstream server with an authentication key, so the daemon only trusts authenticated time.
What "done" looks like
restrict default carries nomodify and noquery, a keys file and trustedkey are configured,
and every server line names a key.
Graded on configuration shape, not a live run: there is no NTP daemon to query here, so this challenge checks that the directives that harden
ntpdare present and correct.Teaches: NTP amplification and time-source trust: default-deny restrictions plus symmetric-key authentication for upstream time.
What gets checked
Your solution is verified against each of these:
- The default restriction denies queries and modifications (nomodify, noquery)
- A keys file is loaded and a trusted key is declared
- Each upstream server is referenced with an authentication key
Solve it in your browser
No setup, no install. Write your solution in the editor and hit Check. The in-house engine renders and grades it instantly, then issues your proof the moment every check passes.
Solve in browser →Prefer your own lab?
- Build the fix locally. New to the tooling? See setting up your lab.
- Push your topology file, device configs, and any playbooks to a public repo (GitHub or GitLab).
- Submit the repo link. We review it by hand, confirm it works, and issue your proof page.