(git commit 892fbb435e71349da502b7e2436648f52a09af6f ) Hal, I have the other end of the stick now.
My LetsEncrypt certificate path is /etc/letsencrypt/archive/ntpmon.dcs1.biz/ The file: -rw-r--r-- 1 root root 3558 May 9 09:39 fullchain28.pem However, root@ntpmon:/etc/letsencrypt# ls -dl /etc/letsencrypt/archive/ drwx------ 3 root root 4096 Jan 17 2016 /etc/letsencrypt/archive/ Which causes ntpd to fail on startup (I assume after dropping root): <snip> 2020-06-09T11:15:58 ntpd[15250]: INIT: OpenSSL 1.1.1g 21 Apr 2020, 1010107f 2020-06-09T11:15:58 ntpd[15250]: NTSs: starting NTS-KE server listening on port 4460 2020-06-09T11:15:58 ntpd[15250]: NTSs: OpenSSL security level is 2 2020-06-09T11:15:58 ntpd[15250]: NTSs: starting NTS-KE server listening on old port 123 2020-06-09T11:15:58 ntpd[15250]: NTSs: listen4 worked 2020-06-09T11:15:58 ntpd[15250]: NTSs: listen6 worked 2020-06-09T11:15:58 ntpd[15250]: NTSs: starting NTS-KE server listening on port 4460 2020-06-09T11:15:58 ntpd[15250]: NTSs: listen4 worked 2020-06-09T11:15:58 ntpd[15250]: NTSs: listen6 worked 2020-06-09T11:15:58 ntpd[15250]: NTSc: Using system default root certificates. 2020-06-09T11:15:58 ntpd[15250]: NTSs: can't stat certificate (chain) from /etc/letsencrypt/live/ntpmon.dcs1.biz/fullchain.pem: Permission denied 2020-06-09T11:15:58 ntpd[15250]: NTS: troubles during init2. Bailing. 2020-06-09T11:15:58 ntpd[15250]: PROTO: 0.0.0.0 c01d 0d kern kernel time sync disabled Um, what do I do? I want to use LE, I want that directory secure, and I want to drop root. -- Sanjeev Gupta +65 98551208 http://www.linkedin.com/in/ghane On Wed, Apr 8, 2020 at 12:16 AM Richard Laager via devel <devel@ntpsec.org> wrote: > ntpd seems to load the TLS certificate and key before dropping > privileges. Unfortunately, when it tries to *reload* the certificate > later, it has dropped privileges and fails. This is a bit of a trap, as > a sysadmin can think a setup is working when it isn't. (This bit me.) I > think it would be better to do the initial load after dropping > privileges so that it is consistent with reloading. > > -- > Richard > > _______________________________________________ > devel mailing list > devel@ntpsec.org > http://lists.ntpsec.org/mailman/listinfo/devel >
_______________________________________________ devel mailing list devel@ntpsec.org http://lists.ntpsec.org/mailman/listinfo/devel
