I have been notified by my internet-provider that I need to close an open NTP-service which allows my Mac to be used in potential DDOS attacks. They ask me to close down the NTP-service by editing/inserting two lines in the ntp.conf file. How do I locate the ntp.conf file and how do I edit the file?
iMac (27-inch Mid 2010), OS X Yosemite (10.10.2)
I would be extremely reluctant to do that if I were you. At the very least ask your ISP for their justification for modifying your Mac. They need to be specific. What two lines are they asking you to modify or add?
Open Terminal. It's in your Mac's Utilities folder. Determine the contents of the file /etc/ntp.conf
To do that copy and paste the following line in Terminal, and post its output:
cat /etc/ntp.conf
It does modify anything and it will not ask for your password. Close Terminal when you're finished with it.
The Date & Time System Preference has a checkbox to set date and time automatically from secure, worldwide Apple time servers. There are millions of OS X users with this setting enabled. How many ISP's are notifying these Mac users to change the contents of their NTP configuration files because of a DDOS threat?
You are being scammed, either by a threat source, or unknowledgeable ISP staff. Call up your ISP and independently verify this request. If the ISP is legitimately asking you to change a system configuration file on your Mac — find another ISP ASAP.
Thanks for your reply, John.
My ISP is asking me to insert these two lines in the file:
restrict default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery
And they are referring to this:
https://www.us-cert.gov/ncas/alerts/TA14-013A
http://thehackernews.com/2014/02/NTP-Distributed-Denial-of-Service-DDoS-attack.h tml
They are also asking me close/block port 123 with udp as protocol in my firewall.
Do you have any further comments?
I appreciate your feedback.
Thanks for your feedback!
I have got confirmation that the ISP´s request is legitimate, but I see your point.
For more information see my reply to John Galt.
I appreciate if you have any further comments.
Apple addressed that threat a month ago:
About OS X NTP Security Update - Apple Support
Assuming your system has been updated you need to do nothing else. Do not modify ntp.conf and do not block any ports.
Thanks John! I'll keep my fingers away from the ntp file and the ports! :-)
Ntp.conf file?
