Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've noticed that, after changing the reg settings outlined in Episode 52 of the Stack Overflow podcast to pool.ntp.org, my box keeps requesting time from gordo.foofus.net. The web site hosted on that box is very strange. Is this a valid timeserver?

share|improve this question
1  
OK gordo, enough self-promotion. :) I edited the question to be a bit more general.. –  Jeff Atwood Jun 13 '09 at 3:15

12 Answers 12

The pool.ntp.org is a DNS-level load balancer. Jeff just happened to get directed to that one, the NTP pool maintainers do not care what does the server run on it's port 80 (http), only that it serves time via NTP correctly.

share|improve this answer

I just listened to episode 52 of the podcast and noticed the same thing Joel did. This server lives in the ntp.org pool of time servers. As noted by Alex, it's serving a valid time and doesn't seem to be doing anything out of spec.

share|improve this answer

This looks like a legitimate time server to me:

[hex]~% ntpdate -q gordo.foofus.net server 64.73.32.135, stratum 2, offset 21.538520, delay 0.05049 12 Jun 13:07:19 ntpdate[1098]: step time server 64.73.32.135 offset 21.538520 sec

If you're ever curious, and have ntpdate installed, you can always use the -q option to simply ask for the time without changing your clock.

It's very strange, though.

share|improve this answer

Just pick a "real" time server ... the fine folks at NIST are paid to render this service.

share|improve this answer
8  
-1 for suggesting to use Stratum 1 time servers without qualifying a need. See support.ntp.org/bin/view/Servers/RulesOfEngagement . –  Jesper Mortensen Sep 7 '09 at 2:03
    
+1 for reading the documentation! –  Joseph Kern Sep 18 '09 at 9:51

I certainly wouldn't worry about it as a time server. Everything seems fine wrt the NTP service. The web site is funny, but, as Skolima said, the ntp.org pool doesn't place any restrictions on the web site content in the pool. I have to say, I got a kick out of "Gordo's response."

Have fun

share|improve this answer

This is a legitimate time server. It's a stratum-2 server and is linked to 12 stratum-1 time sources.

share|improve this answer

If you look at the main domain, http://www.foofus.net/, it is a legit security blog.

As for the subdomain gordo.foofus.net, I have no idea.

Anapologetos

share|improve this answer
    
Hmm. Never trust security guys! My guess: someone decided to attack HTTPS by turning back the clocks on expired certs. There may even be a time based attack in revocation lists. –  jldugger Jun 12 '09 at 19:30
1  
Hey, I resemble that remark! :) –  Josh Brower Jun 12 '09 at 20:11

There doesn't appear to be any problem with the server. Clearly, the server administrators are completely insane, but I consider that a bonus! :) I'm now a big fan of gordo.foofus.net-attacks.mp3

share|improve this answer

That's an excellent point Jeff. I think pool.ntp.org is a great resource and generally assists the Internet in ways y'all noted in Episode 52.

That said, it's interesting to me that anyone, anywhere, can inject a server into the NTP pool. From an adversarial perspective, this has some potential impact. From an architectural perspective, I think the way the pool is constructed can minimize the impact.

However, should an adversary employ some type of DNS cache poisoning attack to shift a network's NTP syncs to their malicious server, it could get interesting. There are many other attack scenarios I can think of.

share|improve this answer

You should make sure that you are using the most specific geographic area that matches your location and that is offered at ntp.org.

For example, there is a us.pool.ntp.org that will always return a time server in the United States. There are other geographic pools available around the world.

This ensures that you will not receive a time server half way around the world when a perfectly good and more accurate server might be in your back yard.

This was also discussed in another thread on Server Fault

share|improve this answer

The way that pool.ntp.org works is that DNS lookups for time servers redirect to one (randomly selected) member of the pool. Each server that's in the pool will have its own name, and if you do a reverse DNS lookup on its IP address you'll get its real name, not the pool name you started with.

Perhaps an example will help:

$ nslookup pool.ntp.org
Non-authoritative answer:
Name:    pool.ntp.org
Address: 83.133.127.245
Name:    pool.ntp.org
Address: 217.25.36.102

$ nslookup 83.133.127.245
Non-authoritative answer:
245.127.133.83.in-addr.arpa     name = wikisquare.de.

$ randy@hex:~$ nslookup
Non-authoritative answer:
102.36.25.217.in-addr.arpa      name = orbit.infidyne.com.
share|improve this answer

gordo.foofus.net-attacks.mp3 is my new favorite song. I'm going this machine as my primary time server from now on. Too awesome.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.