Chrony and iptables

JakeR · #1 2nd July 2012, 04:27 PM

Hi

This is my iptables configuration (only allow chronyd for NTP):

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p tcp --dport 53 -m owner --uid-owner chrony -j ACCEPT
-A OUTPUT -p udp --dport 53 -m owner --uid-owner chrony -j ACCEPT
-A OUTPUT -p udp --dport 123 -m owner --uid-owner root -j ACCEPT
COMMIT

53 tcp/udp for DNS lookup of pool.ntp.org. 123 udp for NTP.

Can someone explain why I need to open ntp port for root and dns for chrony?

Keldorn · #2 10th July 2012, 05:43 PM

I can suggest that DNS needed to get ip address of ntp server to sync from and ntp port to root because chrony can update system time (which allowed only to root).

stevea · #3 11th July 2012, 08:43 AM

If you look through the lsof

Code:

[stevea@crucibulum Desktop]$ sudo lsof -i :123
COMMAND PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
chronyd 682 chrony    1u  IPv4  13046      0t0  UDP *:ntp 
chronyd 682 chrony    2u  IPv6  13047      0t0  UDP *:ntp

its clear that port 123 socket is opening by user=chrony. So unclear why(if) you need to specify user as root.