Bug#787404: ntp_intres.request: permission denied

[Klaus Ethgen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Package: ntp
Version: 1:4.2.6.p5+dfsg-7
Severity: normal

This is a successor of bug #571469. All is said there. NTP needs running
DNS when it starts. Please add $named to Required-Start in init script.

Funny thing, reportbug does include my changed init.d script below but
not the changed part:
# Required-Start: $network $remote_fs $syslog $named

In my setup, ntp and dns was start at the same runlevel. But as
"unbounce" comes lexically after "ntp", ntp was start first. With bind,
that could work as "bind" is lexically earlier in the list. However,
There is a dependency between ntp and dns so that dependency has to be
configured correctly.

- -- System Information:
Debian Release: stretch/sid
APT prefers unstable
APT policy: (800, 'unstable'), (500, 'testing'), (110, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.19.5 (SMP w/8 CPU cores)
Locale: LANG=de_DE, LC_CTYPE=de_DE (charmap=ISO-8859-1) (ignored: LC_ALL set to de_DE)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)

Versions of packages ntp depends on:
ii adduser 3.113+nmu3
ii dpkg 1.18.1
ii libc6 2.19-18
ii libcap2 1:2.24-8
ii libedit2 3.1-20150325-1
ii libopts25 1:5.18.5-2
ii libssl1.0.0 1.0.2a-1
ii lsb-base 4.1+Debian13+nmu1
ii netbase 5.3

Versions of packages ntp recommends:
ii perl 5.20.2-6

Versions of packages ntp suggests:
ii ntp-doc 1:4.2.6.p5+dfsg-7

- -- Configuration Files:
/etc/init.d/ntp changed:
PATH=/sbin:/bin:/usr/sbin:/usr/bin
. /lib/lsb/init-functions
DAEMON=/usr/sbin/ntpd
PIDFILE=/var/run/ntpd.pid
test -x $DAEMON || exit 5
if [ -r /etc/default/ntp ]; then
. /etc/default/ntp
fi
if [ -e /var/lib/ntp/ntp.conf.dhcp ]; then
NTPD_OPTS="$NTPD_OPTS -c /var/lib/ntp/ntp.conf.dhcp"
fi
LOCKFILE=/var/lock/ntpdate
lock_ntpdate() {
if [ -x /usr/bin/lockfile-create ]; then
lockfile-create $LOCKFILE
lockfile-touch $LOCKFILE &
LOCKTOUCHPID="$!"
fi
}
unlock_ntpdate() {
if [ -x /usr/bin/lockfile-create ] ; then
kill $LOCKTOUCHPID
lockfile-remove $LOCKFILE
fi
}
RUNASUSER=ntp
UGID=$(getent passwd $RUNASUSER | cut -f 3,4 -d:) || true
if test "$(uname -s)" = "Linux"; then
NTPD_OPTS="$NTPD_OPTS -u $UGID"
fi
case $1 in
start)
log_daemon_msg "Starting NTP server" "ntpd"
if [ -z "$UGID" ]; then
log_failure_msg "user \"$RUNASUSER\" does not exist"
exit 1
fi
lock_ntpdate
start-stop-daemon --start --quiet --oknodo --pidfile $PIDFILE --startas $DAEMON -- -p $PIDFILE $NTPD_OPTS
status=$?
unlock_ntpdate
log_end_msg $status
;;
stop)
log_daemon_msg "Stopping NTP server" "ntpd"
start-stop-daemon --stop --quiet --oknodo --pidfile $PIDFILE
log_end_msg $?
rm -f $PIDFILE
;;
restart|force-reload)
$0 stop && sleep 2 && $0 start
;;
try-restart)
if $0 status >/dev/null; then
$0 restart
else
exit 0
fi
;;
reload)
exit 3
;;
status)
status_of_proc $DAEMON "NTP server"
;;
*)
echo "Usage: $0 {start|stop|restart|try-restart|force-reload|status}"
exit 2
;;
esac

/etc/ntp.conf changed:
logfile /var/log/ntpd
driftfile /var/lib/ntp/ntp.drift
statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable
server 0.ch.pool.ntp.org iburst
server 1.ch.pool.ntp.org iburst
server 2.ch.pool.ntp.org iburst
server 3.ch.pool.ntp.org iburst
restrict -4 default kod notrap nomodify nopeer noquery
restrict 127.0.0.1 nomodify
restrict 192.168.17.0 mask 255.255.255.0 nomodify


- -- no debconf information

- --
Klaus Ethgen http://www.ethgen.ch/
pub 4096R/4E20AF1C 2011-05-16 Klaus Ethgen <Kl...@Ethgen.de>
Fingerprint: 85D4 CA42 952C 949B 1753 62B3 79D0 B06F 4E20 AF1C
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQGcBAEBCgAGBQJVbBS+AAoJEKZ8CrGAGfasz80MAL+wqpbxY/Rve7VSQGcq0ZES
zeVVJ+smEWyeKO6xnZ5Fxqcr7OyTKfz9kU5+bZUkBgOsjP3ecscTioEN6KGCAUD7
DEoSoC4iOGWpyLNtbWH9fm+8yMKDelYMlyggTD2L/BsMjql/ETnxa+dFp75FZZ3/
SKqrVp1fRqd9gzoeu4oAlEz9DwcKepBXwfabAWpWGgHCqdKX7M2Mo/y3uY4NxCOi
fpIVrb4jcv1qsW3FhBR7waXk7F1MYMfDhZ7tVe+JZYnzMIM/Yeiwd2jO79j6u0x5
WqTKseWv6J4JrtpKMGzJHQIvr2ai5ycSg9gYKf6E2eo3BFs6NUjlRdR2PWHNDnT2
V6r/IEHZC16eCCyAH5ghXAa4SMgPBmt1/Y6XajgPJKGL/0HuszbJZGuZwEEg+GjT
pS0+qIQe4dNura6bIqtht9/uD6PPpoJeoobnR5yf25VDnC/5XMzhGIbL1ia/hrZg
RLU/HpxMJ7CNOVngjDuxe4bq1mFE+07wqNQRvRtbqg==
=GfAm
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-bugs-...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listm...@lists.debian.org

[Klaus Ethgen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hello,

please let me add that the problem starts with reboot at 2014-09-09 with
a reboot. But as I do not boot my system that often, that doesn't mean
that a update short before is the reason.

I would just address regressions added by 1:4.2.6.p5+dfsg-3.1 as that is
the version right before.

Regards
Klaus

- --
Klaus Ethgen http://www.ethgen.ch/
pub 4096R/4E20AF1C 2011-05-16 Klaus Ethgen <Kl...@Ethgen.de>
Fingerprint: 85D4 CA42 952C 949B 1753 62B3 79D0 B06F 4E20 AF1C
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQGcBAEBCgAGBQJVeAI7AAoJEKZ8CrGAGfasbSEL/0oYi7un/PEkEiPc5OvzSMbd
7G0UT1mGOh3GjQT023MrhrbgJIOO+0j+A8epgAHOnSzkqDpdyvWUnx36eVVNmKK7
8PLBzt7FZRsZ2Le782vuBVmHDWjNT7TOx0lh+UX8wttG4P3eEmJImoIDDHCPdJck
UeSI2fLyuE3g0CoPiwkr816wgcdHBsblbx39W3OLJCH1iAOXmFNDs7fF9Uyto46O
Kb7cJAev6ZoDdXfcLmgLIR6Vy1XHPEdU3/E8zBqwqZ9CoyzpVc7Kmo6uQKn+y4NM
FS8dXpwEvEzmgOCV6L1DWwi5j6GfxyoaejIWxAe7uUSOsKFUeaTimNKhzms5W9vi
SCL6tT4ZhlITe/LAtIa5gYXqsHvWbS7JZehbkpdU2oifmmM0D9NxkuBTiUXF0Dmf
nKVT9WkECLpTel1nVfdBr9q/oEW29OVDO+yh4oCTp4hk8rPlu4cLK/fRRZk5wb9y
s5AVchClC3ANY5mv318NvGw+nYGU2rMm7DSiqV5QhA==
=5MIh

[Roger Lynn]

On 01/06/2015 09:16, Klaus Ethgen wrote:
> This is a successor of bug #571469. All is said there. NTP needs running
> DNS when it starts. Please add $named to Required-Start in init script.

What if a $named is not installed? Shouldn't it be Should-Start?

Roger
(Not an NTP maintainer or a Debian Developer)

[Klaus Ethgen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Am Mi den 10. Jun 2015 um 12:20 schrieb Roger Lynn:
> On 01/06/2015 09:16, Klaus Ethgen wrote:
> > This is a successor of bug #571469. All is said there. NTP needs running
> > DNS when it starts. Please add $named to Required-Start in init script.
>
> What if a $named is not installed? Shouldn't it be Should-Start?

I have no idea. But this error should be handled somehow.

But I think you have proper DNS when it is handled via dhcp, so if
network is up ...

However, I am even not fully convinced that it is working proper when
started to shortly after DNS daemon. I tuned that in my local box and
still see that errors after some boots until I restart ntpd manually.

Regards
Klaus

- --
Klaus Ethgen http://www.ethgen.ch/
pub 4096R/4E20AF1C 2011-05-16 Klaus Ethgen <Kl...@Ethgen.de>
Fingerprint: 85D4 CA42 952C 949B 1753 62B3 79D0 B06F 4E20 AF1C
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQGcBAEBCgAGBQJVeB/hAAoJEKZ8CrGAGfasAs0L/igSfCA7GyuFhqP2pw2IDmGa
WTtT28rm4o+FurZv7Tmiu0aCGIHWkN4zxPjLlaI7LuNkD0eIPxH+LAAY0zjv6pDP
wm27dswwXZv4e0nz0qt71qwTLtSsjVkpqtEpL+Lb0DJ2rY0XiuJ7CjsynYEYMN8N
lCCMWhegrRoLK8hhYSuPnVKStqej5MyoIE49jIo8Ev0UKFzYKi4952vAXS3aPgNh
tNUYFxUKoxv5lQ3SYsyF/PeaXH0ZTetOn+WPzA2d4Y3WVz6kW6AW8xh/NKJFFpqZ
ocABCZGrUfbQPQVg6DycQXfQjgpMaUhHAfUdGB3aqHYpLzRYPGFs9bUXExV6VUsE
g4KaWSyrp8mBAt6jUP15G7Sxzn91nsuq9hhNiLYXqZQAGJlkdJP7oI6QYC1c0XYX
xAtKJFQ+Pz0Vlg9Uk4Bkxb7sDk6rlKqLhGqiVSCPfF9GrfCuoCdXddwEH6W/H8Yr
1le5l7Y70MffNk/aAWWmXmAONfMN8orrz6W6MZGWVg==
=aw5n
-----END PGP SIGNATURE-----

[Klaus Ethgen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi,

Am Mo den 3. Apr 2017 um 21:59 schrieb Bernhard Schmidt:
> > # Required-Start: $network $remote_fs $syslog $named
> >
> > In my setup, ntp and dns was start at the same runlevel. But as
> > "unbounce" comes lexically after "ntp", ntp was start first. With bind,
> > that could work as "bind" is lexically earlier in the list. However,
> > There is a dependency between ntp and dns so that dependency has to be
> > configured correctly.
>

> I tried to reproduce this with current Jessie and the future Stretch
> release. As far as I can tell ntp handles this situation just fine.
>
> When ntpd starts up and cannot resolve the servers it logs
>
> ntpd[...]: Deferring DNS for 0.debian.pool.ntp.org 1
> ntpd_initres[...]: host name not found: 0.debian.pool.ntp.org
>
> as soon as DNS and/or network connectivity is available again (a couple
> of minutes later) it logs
>
> ntpd_initres[...]: DNS 0.debian.pool.ntp.org -> IP
>
> and starts using this server.

Well, my experiences are that ntp is not very graceful when dealing with
not existing dns. It should handle that situation but fails to often.

On the other hand, that "$named" in the Required-Start solves the
problem and does no harm.

Regards
Klaus

- --
Klaus Ethgen http://www.ethgen.ch/

pub 4096R/4E20AF1C 2011-05-16 Klaus Ethgen <Kl...@Ethgen.ch>

Fingerprint: 85D4 CA42 952C 949B 1753 62B3 79D0 B06F 4E20 AF1C
-----BEGIN PGP SIGNATURE-----

Comment: Charset: ISO-8859-1

iQGzBAEBCgAdFiEEMWF28vh4/UMJJLQEpnwKsYAZ9qwFAljiubAACgkQpnwKsYAZ
9qwUowv/fM7D2GjFlbLNLUkvmLz0iVKuqtkFgEZjkELDJfJzzbD9QWMK6kfk/S01
A1bhQxSPNOkWG/iGQz4zjQf5jdZYChk9xV3z5PJ/l0YOqSu0vOq6t9RDOpzDHIpZ
IZU3A47PkQdwFxE88ZQOFDoxPwQcqcH1SFU4TJlk+LXUYtDJ5VNpcHYSetKHIr59
OIPdDbYpsRH1cfOG2+egKe4NfUlBwnb08nswMW9Odn7YReneo/Io37I2SPzUFtxx
wWBkkiaeD5yWhpv7+xLXylX2RdSjAi9aZlvtHcOM+he5Ihox+jFKAOuI/AjpGF15
1cRAQJU84+f1Ksrri8B3aaCRgNYf4jMzz4hqySRYQqm+C5YgwPUrSVsaklHvjq7J
WdS0O3oNf//cxrENCGe7JAFEXQvDv+b8Yr527VsAa034LLG5QUNdf1Ctoo1BFyvi
sZnpXDfOlOW6KHCTAXd+yJR/MIMEbfYBjxyZcm4tdkSrm7il8KQX+nCeW/fE9SFa
pGnelNHG
=Oy/3
-----END PGP SIGNATURE-----

[Bernhard Schmidt]

Control: tags -1 + moreinfo unreproducible

On Mon, Jun 01, 2015 at 09:16:05AM +0100, Klaus Ethgen wrote:

> This is a successor of bug #571469. All is said there. NTP needs running
> DNS when it starts. Please add $named to Required-Start in init script.
>
> Funny thing, reportbug does include my changed init.d script below but
> not the changed part:
> # Required-Start: $network $remote_fs $syslog $named
>
> In my setup, ntp and dns was start at the same runlevel. But as
> "unbounce" comes lexically after "ntp", ntp was start first. With bind,
> that could work as "bind" is lexically earlier in the list. However,
> There is a dependency between ntp and dns so that dependency has to be
> configured correctly.

I tried to reproduce this with current Jessie and the future Stretch
release. As far as I can tell ntp handles this situation just fine.

When ntpd starts up and cannot resolve the servers it logs

ntpd[...]: Deferring DNS for 0.debian.pool.ntp.org 1
ntpd_initres[...]: host name not found: 0.debian.pool.ntp.org

as soon as DNS and/or network connectivity is available again (a couple
of minutes later) it logs

ntpd_initres[...]: DNS 0.debian.pool.ntp.org -> IP

and starts using this server.

Bernhard

[Kurt Roeckx]

As far as I know, this only works with the "pool" command, not
with any of the server commands.


Kurt

[Bernhard Schmidt]

On Mon, Apr 03, 2017 at 11:15:35PM +0200, Kurt Roeckx wrote:

HI,

> > I tried to reproduce this with current Jessie and the future Stretch
> > release. As far as I can tell ntp handles this situation just fine.
> >
> > When ntpd starts up and cannot resolve the servers it logs
> >
> > ntpd[...]: Deferring DNS for 0.debian.pool.ntp.org 1
> > ntpd_initres[...]: host name not found: 0.debian.pool.ntp.org
> >
> > as soon as DNS and/or network connectivity is available again (a couple
> > of minutes later) it logs
> >
> > ntpd_initres[...]: DNS 0.debian.pool.ntp.org -> IP
> >
> > and starts using this server.
>
> As far as I know, this only works with the "pool" command, not
> with any of the server commands.

Don't think so, I've tested in on Jessie which still uses "server" in
the default configuration. Worked just fine.

Bernhard

[Kurt Roeckx]

Sometimes it works, sometimes it fails, without changing any
configuration. I think the case that fails is waiting a very long
time to bring up the network.


Kurt