4

I set my default iptables OUTPUT chain to DROP packets. I then created a firewall rule to only allow the ntp user to send ntp packets out:

iptables -A OUTPUT -m owner --uid-owner ntp -p udp --dport 123 -j ACCEPT

However, every 10-20 minutes I would see:

ntpd[27769]: sendto(<snip>) (fd=22): Operation not permitted

I then removed the -m owner --uid-owner ntp portion of the rule and added a log rule before it:

iptables -A OUTPUT -p udp --dport 123 -j LOG --log-level debug \
    --log-prefix "Spotted a NTP packet: " --log-uid

ntpd started working again, and in the kernel ring buffer, I see:

Spotted a NTP packet: <snip> PROTO=UDP SPT=123 DPT=123 LEN=56 UID=0

I'm using the --log-uid switch to the LOG target, and ntpd is running as the ntp user (uid=38):

# ps auxf | grep ntpd
ntp      27769  0.0  1.0   4512  4508 ?        SLs  Jan04   0:00 ntpd -u ntp:ntp -p /var/run/ntpd.pid

Yet the log shows UID=0. I'm positive nothing else on the system is sending out ntp packets, and since I'm no longer getting the Operation not permitted, I'm certain it is in-fact ntpd that's sending the packet.

I guess I'm fine with not matching the ntp user for these packets; however, can someone explain why iptables isn't showing UID=38 for these packets?

2 Answers 2

6

For a program to use a port less then 1024 it must be root. Many applications like NTP will start, open the port as root, and then drop privileges to some defined account for everything else.

4
  • Apache starts as root and drops its privileges just like ntp does, yet outgoing packets for apache do in-fact match the apache UID. So I'm not convinced that's the reason. Jan 5, 2012 at 22:27
  • They are obviously very different programs. Just because it is possible to make things show up correctly doesn't mean that it does. For example the most common Apache MPM forks and dup()'s lots of processes and uses tcp. NTP is mostly udp-based, and is a single process. I am sure someone who knew the ntp source could tell you for certain, but I am pretty confident that what I suggest is the case for ntp.
    – Zoredache
    Jan 5, 2012 at 22:33
  • Okay, you've convinced me :) I guess my question now is, what code makes this distinction, but that is probably better asked on stackoverflow. Thanks. Jan 5, 2012 at 23:05
  • 1
    Actually depending on how you ask the question you might get a better answer on security or programmers. I suspect someone over on security knows what existing software does, and someone over on programmers could answer the question about how to open a port and drop all privileges. I wonder if you could set ntp to listen to a >1024 and then setup iptables nat rules to redirect ntp traffic to the right place, it might not stay root, if it binds to a high port.
    – Zoredache
    Jan 5, 2012 at 23:16
1

There are mistake in Your iptables rule:

iptables -A OUTPUT -m owner --uid-owner ntp -p udp --dport 123 -j ACCEPT

If You use --uid-owner it is necessary to define uid - numeric value.
For the program name You need another option: --cmd-owner. Correct rule is:

iptables -A OUTPUT -m owner --cmd-owner ntp -p udp --dport 123 -j

Detailed explanation You may read in great book by Oskar Andreasson.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .