I've read this forum guide and a number of answers to do with NTP servers.

I need to use authentication, but when I restart the ntp service I get an error in the log saying "ntpd[1710]: authreadkeys: file /etc/ntp.keys: Permission denied"

This is my config file:

driftfile /var/lib/ntp/ntp.drift

statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable

server 0.uk.pool.ntp.org iburst
server 1.uk.pool.ntp.org iburst
server 2.uk.pool.ntp.org iburst
server 3.uk.pool.ntp.org iburst

restrict -4 default kod notrap nomodify nopeer noquery
restrict -6 default kod notrap nomodify nopeer noquery

restrict mask nomodify notrap

restrict ::1

#enable auth
keys /etc/ntp.keys

trustedkey 17
controlkey 17
requestkey 17

I've confirmed that the file is readable, and have tried it in a number of permissions (400, 600, 700, 777).

How can I get my server to read the authentication keys?


I was experiencing this same problem on 19.10. It exhibits successive entries in /var/log/syslog like this...

Jun 10 12:34:56 HOSTNAME ntpd[12345]: authreadkeys: file '/etc/ntp.keys': Permission denied
Jun 10 12:34:56 HOSTNAME kernel: [...] audit: type=1400 audit(...): apparmor="DENIED" operation="open" profile="/usr/sbin/ntpd" name="/etc/ntpkey_MD5key_HOSTNAME.1234567890" pid=12345 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

Looking at what files in /etc AppArmor allows ntpd to access...

$ grep /etc/ntp /etc/apparmor.d/usr.sbin.ntpd
  /etc/ntp.conf r,
  /etc/ntp.conf.dhcp r,
  /etc/ntpd.conf r,
  /etc/ntpd.conf.tmp r,
  /etc/ntp.keys r,
  /etc/ntp/** r,
  /etc/ntp.drift rwl,
  /etc/ntp.drift.TEMP rwl,
  /etc/ntp/drift* rwl,

...I could see that /etc/ntp.keys and /etc/ntp/** are included. However, when using ntp-keygen to generate symmetric keys it creates ntp.keys as a symlink to a filename including the host name and filestamp...

$ ls -l /etc/ntp*
-rw-r--r-- 1 root root 123 Jun 10 12:34 /etc/ntp.conf
-rw-r----- 1 root root 456 Jun 10 12:34 /etc/ntpkey_MD5key_HOSTNAME.1234567890
lrwxrwxrwx 1 root root  33 Jun 10 12:34 /etc/ntp.keys -> ntpkey_MD5key_HOSTNAME.1234567890

AppArmor evidently doesn't follow symlinks in its rules, so you either need to...

  • Make ntp.keys a hard/only link instead of a symlink, or...
  • Move the key file somewhere inside of a /etc/ntp/ directory, or...
  • The approach I took was inspired by a comment on a duplicate post of this question. I created a /etc/apparmor.d/local/usr.sbin.ntpd file with this content...
    /etc/ntpkey_MD5key_HOSTNAME.1234567890 r,
    ...then instructed AppArmor to reload the profile for ntpd...
    sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.ntpd
    ...and after restarting ntpd...
    sudo service ntp restart
    ...it successfully loaded the key file.

I spun up an Ubuntu 14.04 instance and noticed that an app armor message in the logs after the same "permission denied" message.

Disabling the ntp profile for apparmor resolved the issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.