I set my default iptables OUTPUT chain to DROP packets. I then created a firewall rule to only allow the ntp user to send ntp packets out:
iptables -A OUTPUT -m owner --uid-owner ntp -p udp --dport 123 -j ACCEPT
However, every 10-20 minutes I would see:
ntpd[27769]: sendto(<snip>) (fd=22): Operation not permitted
I then removed the -m owner --uid-owner ntp
portion of the rule and added a log rule before it:
iptables -A OUTPUT -p udp --dport 123 -j LOG --log-level debug \
--log-prefix "Spotted a NTP packet: " --log-uid
ntpd
started working again, and in the kernel ring buffer, I see:
Spotted a NTP packet: <snip> PROTO=UDP SPT=123 DPT=123 LEN=56 UID=0
I'm using the --log-uid
switch to the LOG
target, and ntpd
is running as the ntp user (uid=38):
# ps auxf | grep ntpd
ntp 27769 0.0 1.0 4512 4508 ? SLs Jan04 0:00 ntpd -u ntp:ntp -p /var/run/ntpd.pid
Yet the log shows UID=0
. I'm positive nothing else on the system is sending out ntp packets, and since I'm no longer getting the Operation not permitted
, I'm certain it is in-fact ntpd
that's sending the packet.
I guess I'm fine with not matching the ntp user for these packets; however, can someone explain why iptables isn't showing UID=38
for these packets?