Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 3 down vote favorite

I set my default iptables OUTPUT chain to DROP packets. I then created a firewall rule to only allow the ntp user to send ntp packets out:

iptables -A OUTPUT -m owner --uid-owner ntp -p udp --dport 123 -j ACCEPT

However, every 10-20 minutes I would see:

ntpd[27769]: sendto(<snip>) (fd=22): Operation not permitted

I then removed the -m owner --uid-owner ntp portion of the rule and added a log rule before it:

iptables -A OUTPUT -p udp --dport 123 -j LOG --log-level debug \
    --log-prefix "Spotted a NTP packet: " --log-uid

ntpd started working again, and in the kernel ring buffer, I see:

Spotted a NTP packet: <snip> PROTO=UDP SPT=123 DPT=123 LEN=56 UID=0

I'm using the --log-uid switch to the LOG target, and ntpd is running as the ntp user (uid=38):

# ps auxf | grep ntpd
ntp      27769  0.0  1.0   4512  4508 ?        SLs  Jan04   0:00 ntpd -u ntp:ntp -p /var/run/ntpd.pid

Yet the log shows UID=0. I'm positive nothing else on the system is sending out ntp packets, and since I'm no longer getting the Operation not permitted, I'm certain it is in-fact ntpd that's sending the packet.

I guess I'm fine with not matching the ntp user for these packets; however, can someone explain why iptables isn't showing UID=38 for these packets?

share|improve this question

1 Answer

up vote 5 down vote accepted

For a program to use a port less then 1024 it must be root. Many applications like NTP will start, open the port as root, and then drop privileges to some defined account for everything else.

share|improve this answer
Apache starts as root and drops its privileges just like ntp does, yet outgoing packets for apache do in-fact match the apache UID. So I'm not convinced that's the reason. – Corey Henderson Jan 5 '12 at 22:27
They are obviously very different programs. Just because it is possible to make things show up correctly doesn't mean that it does. For example the most common Apache MPM forks and dup()'s lots of processes and uses tcp. NTP is mostly udp-based, and is a single process. I am sure someone who knew the ntp source could tell you for certain, but I am pretty confident that what I suggest is the case for ntp. – Zoredache Jan 5 '12 at 22:33
Okay, you've convinced me :) I guess my question now is, what code makes this distinction, but that is probably better asked on stackoverflow. Thanks. – Corey Henderson Jan 5 '12 at 23:05
1  
Actually depending on how you ask the question you might get a better answer on security or programmers. I suspect someone over on security knows what existing software does, and someone over on programmers could answer the question about how to open a port and drop all privileges. I wonder if you could set ntp to listen to a >1024 and then setup iptables nat rules to redirect ntp traffic to the right place, it might not stay root, if it binds to a high port. – Zoredache Jan 5 '12 at 23:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.