Solved ntpq: write to localhost failed: Permission denied

Z

zg123

Hi all, dns2 is my FreeBSD backup DNS box, and today I discovered that there may be a problem on my LAN with the time sync from the NTP server on the edge router, so I went to check and force sync each machine on the LAN and got this error on this particular one:

Code: 
zq@dns2:~ % sudo ntpq -pn
Password:
ntpq: write to localhost failed: Permission denied
use0@dns2:~ % ntpq 127.0.0.1
ntpq> pe
ntpq: write to 127.0.0.1 failed: Permission denied
ntpq> ^D
use0@dns2:~ % su -
Password:
root@dns2:~ # ntpq -pn
ntpq: write to localhost failed: Permission denied

I've never seen this error and found little to no information about it on Google, so looking for the knowledgeable community's help.
 
zg123
No need for sudo or su for this command

%> ntpq -pn
remote refid st t when poll reach delay offset jitter
==============================================================================
0.freebsd.pool. .POOL. 16 p - 64 0 0.000 +0.000 0.000
2.freebsd.pool. .POOL. 16 p - 64 0 0.000 +0.000 0.000
*79.143.250.33 .GPS. 1 u 6 64 377 14.817 +0.240 0.169
-86.225.239.215 145.238.80.80 2 u 56 64 377 18.628 -1.309 0.696
+51.210.178.126 193.62.22.82 2 u 57 64 377 14.511 +0.116 0.253
+31.58.102.164 17.253.108.125 2 u 20 64 377 10.582 +0.079 0.106
 
Is ntpd running on this machine? Though you should get connection refused error in that case.
Run “which ntpq” to see what you are running. Also report uname -a output. And output of “ls -l $(which ntpq)”.
 
Sorry, got a little confused with the ntpd.

# service ntpd status
ntpd is not running.
# service ntpd start
ntpd already running? (pid=17592).
# service ntpd restart
Stopping ntpd.
Waiting for PIDS: 17592.
Starting ntpd.
# service ntpd status
ntpd is running as pid 10449.
# ntpq -pn
ntpq: write to localhost failed: Permission denied

As far as the firewall is concerned, it seems to be configured correctly:

udp_clients = "{ domain, ntp }"
pass out quick proto udp to 10.0.0.1 port $udp_clients keep state
 
zg123 said:
# service ntpd status
ntpd is running as pid 10449.
# ntpq -pn
ntpq: write to localhost failed: Permission denied

As far as the firewall is concerned, it seems to be configured correctly:

udp_clients = "{ domain, ntp }"
pass out quick proto udp to 10.0.0.1 port $udp_clients keep state
Click to expand...
Does "/usr/bin/ntpq -pn" work? What does the output of "grep -v ^# /etc/ntp.conf | uniq " look like? Which freebsd version (uname -a)? Are you running standard ntpd or from ports?
 
% uname -a
FreeBSD dns2 14.2-RELEASE-p1 FreeBSD 14.2-RELEASE-p1 GENERIC amd64
% /usr/bin/ntpq -pn
/usr/bin/ntpq: write to localhost failed: Permission denied
% grep -v ^# /etc/ntp.conf | uniq

tos minclock 3 maxclock 6

server 10.0.0.1 iburst

restrict default limited kod nomodify notrap noquery nopeer
restrict source limited kod nomodify notrap noquery

restrict 127.0.0.1
restrict ::1

leapfile "/var/db/ntpd.leap-seconds.list"
 
My conf

%> grep -v ^# /etc/ntp.conf | uniq

tos minclock 3 maxclock 6

pool 0.freebsd.pool.ntp.org iburst
pool 2.freebsd.pool.ntp.org iburst
server 1.pool.ntp.org iburst
server 3.pool.ntp.org iburst

restrict default limited kod nomodify notrap noquery nopeer
restrict source limited kod nomodify notrap noquery

restrict 127.0.0.1
restrict ::1

leapfile "/var/db/ntpd.leap-seconds.list"
 
So yours and mine are only different in the servers. We use the edge router, for security. This does not explain the error, does it?
 
If you aren't on a critical system, I don't think so.
Stop the firewall (if it is running):

service ipfw status


service ipfw stop

Back up your config file
Use mine
Test
If it works, the problem lies with the firewall rules.
 
Your config won't do us any good because the edge firewall blocks UDP port 123 to the outside. Other than that, same problem even with the firewall down (we use pf).
 
Understood. If UDP/123 is blocked at the edge firewall, then the local NTP configuration cannot solve it. Disabling pf on the host would not help if the upstream/perimeter firewall is still dropping outbound NTP traffic.

In that case, either outbound UDP/123 needs to be allowed to the selected NTP servers, or the machine should sync against an internal NTP server that is allowed through the edge firewall.
 
Ah!!!, understood. If the edge router is the LAN NTP server, then
server 10.0.0.1 iburst
makes sense.

But the error shown by
ntpq -pn
is still local: by default ntpq -pn queries the local ntpd on localhost/127.0.0.1, not the edge router directly. So write to
localhost failed: Permission denied
looks like something on dns2 is preventing the local ntpq query from even being sent to localhost.

I would first check the local filtering path, especially loopback handling in pf, for example whether
set skip on lo0
or an equivalent
pass quick on lo0
all rule is present. The rule allowing UDP to 10.0.0.1 does not necessarily explain why a query to localhost is denied.
 
We have a winner! Added a pass quick, and ntpq began to work.
I guess, these two lines had to allow NTP to localhost:

udp_services = "{ domain, ntp }"
pass in quick proto udp to any port $udp_services keep state

Are they not correct?
 
Good, that confirms it was local loopback filtering.

Those rules are not necesarily wrong, but they only match inbound UDP pakets to destination ports domain and ntp. A local
ntpq -pn
query goes through lo0, and the packet may first be seen as outbound on lo0 before it comes back inbound to the local ntpd

So if the ruleset blocks by default and there is no general loopback exception, the query can be denied before your pass in rule helps.

For loopback, I would normally use either:


set skip on lo0


or:


pass quick on lo0 all


Then keep the DNS/NTP service rules for real network interfaces.
 
Great, I'll keep your line in there as in my opinion whoever set the box up overdid it with the lockdown. I understand where they came from but clearly they went overboard. It's only a backup DNS on the LAN, which is not exposed to the outside.
Appreciate all the help!!!
 
You must log in or register to reply here.
Back
Top