ntpd: permission denied writing to /var/log/ntpstats/ (statsdir directory)
I am running a NTP server on an Ubuntu 20.04 LTS. The server work fine and the client poll correctly the server. But i keep getting a permission error when i want to record statistics.
I tried to include the following lines in ntp.conf :
statistics rawstats
statsdir /var/log/ntpstats/
filegen rawstats file raw type day link enable
When looking at systemctl ntp status :
mars 05 09:08:48 RD-NTP ntpd[3534] : can't open /var/log/ntpstats/raw.20210305: Permission denied
mars 05 09:08:50 RD-NTP ntpd[3534] : can't open /var/log/ntpstats/raw.20210305: Permission denied
mars 05 09:08:52 RD-NTP ntpd[3534] : can't open /var/log/ntpstats/raw.20210305: Permission denied
mars 05 09:08:54 RD-NTP ntpd[3534] : can't open /var/log/ntpstats/raw.20210305: Permission denied
But for me, the directory have the correct permissions ls -al :
drwxr-xr-x 2 ntp ntp 4096 april 2 2020 .
Before choosing the default folder, i tried with one i created and adding ntp in the permission using this command : chmod ntp:ntp /home/ubuntu/ntpstats/, it wasnt working so i switched to this one, not working either.
Do you know why ntpd keep getting error even if ntp have the upper hand on the folder ?
Solution 1:
It's very likely that what is causing your permissions issue is not permissions bits, but AppArmor. The default AppArmor profile for ntpd on Ubuntu 20.04 (/etc/apparmor.d/usr.sbin.ntpd) contains:
...
/var/log/ntp w,
/var/log/ntp.log w,
/var/log/ntpd w,
/var/log/ntpstats/clockstats* rwl,
/var/log/ntpstats/loopstats* rwl,
/var/log/ntpstats/peerstats* rwl,
/var/log/ntpstats/protostats* rwl,
/var/log/ntpstats/rawstats* rwl,
/var/log/ntpstats/sysstats* rwl,
...
Note the mismatch in the filename it is expecting compared with the one ntpd is generating. If you change the AppArmor profile line referencing rawstats to be:
/var/log/ntpstats/raw* rwl,
and reload AppArmor with systemctl reload apparmor, your stats logging will likely work.
Note also that loopstats and peerstats are more likely to be helpful in diagnosing NTP problems than rawstats. (See http://doc.ntp.org/current-stable/monopt.html#types for more on this.) Personally, I think if you're going to bother logging rawstats, you'd be better to just capture every NTP packet on the wire and process it with wireshark or a similar protocol analyser.