Two instances of ntpd are launched, only one is stopped by the init script

[Sam Morris]

Binary package hint: ntp-server

:) 01:03 sam@shodan ~
$ pgrep ntpd

:( 01:03 sam@shodan ~
$ sudo /etc/init.d/ntp-server start
 * Starting NTP server... [ ok ]

:) 01:03 sam@shodan ~
$ pgrep ntpd -fl
31544 /usr/sbin/ntpd -p /var/run/ntpd.pid -u 116:116
31548 /usr/sbin/ntpd -p /var/run/ntpd.pid -u 116:116

:) 01:03 sam@shodan ~
$ sudo /etc/init.d/ntp-server stop
 * Stopping NTP server... [ ok ]

:) 01:03 sam@shodan ~
$ pgrep ntpd -fl
31548 /usr/sbin/ntpd -p /var/run/ntpd.pid -u 116:116

:) 01:04 sam@shodan ~
$ sudo /etc/init.d/ntp-server start
 * Starting NTP server... [ ok ]

:) 01:04 sam@shodan ~
$ pgrep ntpd -fl
31548 /usr/sbin/ntpd -p /var/run/ntpd.pid -u 116:116
31585 /usr/sbin/ntpd -p /var/run/ntpd.pid -u 116:116
31589 /usr/sbin/ntpd -p /var/run/ntpd.pid -u 116:116

:) 01:04 sam@shodan ~
$ sudo /etc/init.d/ntp-server stop
 * Stopping NTP server... [ ok ]

:) 01:04 sam@shodan ~
$ pgrep ntpd -fl
31589 /usr/sbin/ntpd -p /var/run/ntpd.pid -u 116:116

:) 01:04 sam@shodan ~
$ sudo /etc/init.d/ntp-server start
 * Starting NTP server... [ ok ]

:) 01:04 sam@shodan ~
$ pgrep ntpd -fl
31589 /usr/sbin/ntpd -p /var/run/ntpd.pid -u 116:116
31622 /usr/sbin/ntpd -p /var/run/ntpd.pid -u 116:116
31626 /usr/sbin/ntpd -p /var/run/ntpd.pid -u 116:116

:) 01:04 sam@shodan ~
$ sudo /etc/init.d/ntp-server stop
 * Stopping NTP server... [ ok ]

:) 01:04 sam@shodan ~
$ pgrep ntpd -fl
31589 /usr/sbin/ntpd -p /var/run/ntpd.pid -u 116:116
31626 /usr/sbin/ntpd -p /var/run/ntpd.pid -u 116:116

[chantra (chantra)]

is this still happening?

which ubuntu and package releases does that happen on?
I can't reproduce it on ntp-server 4.2.0a+stable-9ubuntu2.

[Sam Morris (yrro)]

I think it was on dapper (1:4.2.0a+stable-8.1ubuntu6). I'm not seeing it at the moment, however it has happened several times in the last few months, and I have also seen it happen on Debian (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=327138).

[Grzegorz Bieniasz (gutek)]

My friend noticed the same thing. I've tested it, here's result.
Kubuntu runs two instances of ntpd when /etc/init.d/ntp-server script is run on system startup.

root@gutek-laptop:~# date; ps aux | grep ntpd
Thu Jan 25 23:30:05 CET 2007
ntp 4851 0.0 0.3 3732 3732 ? SLs 23:23 0:00 /usr/sbin/ntpd -p /var/run/ntpd.pid -u 110:117
root 4880 0.0 0.1 3732 1048 ? S 23:23 0:00 /usr/sbin/ntpd -p /var/run/ntpd.pid -u 110:117
root 5405 0.0 0.0 2812 776 pts/2 S+ 23:30 0:00 grep ntpd

Now lets stop it. Only one instance is stoped by the script.

root@gutek-laptop:~# date; /etc/init.d/ntp-server stop; ps aux | grep ntpd
Thu Jan 25 23:31:30 CET 2007
 * Stopping NTP server... [ ok ]
root 4880 0.0 0.1 3732 1048 ? S 23:23 0:00 /usr/sbin/ntpd -p /var/run/ntpd.pid -u 110:117
root 5431 0.0 0.0 2812 772 pts/2 S+ 23:31 0:00 grep ntpd

but lets wait a while, and ...
root@gutek-laptop:~# date; ps aux | grep ntpd
Thu Jan 25 23:32:11 CET 2007
root 5438 0.0 0.0 2812 768 pts/2 S+ 23:32 0:00 grep ntpd

Now lets start ntpd.
root@gutek-laptop:~# date; /etc/init.d/ntp-server start
Thu Jan 25 23:34:02 CET 2007
 * Starting NTP server... [ ok ]

Everything looks ok.
root@gutek-laptop:~# date; ps aux | grep ntpd
Thu Jan 25 23:35:22 CET 2007
ntp 5456 0.0 0.3 3708 3708 ? SLs 23:34 0:00 /usr/sbin/ntpd -p /var/run/ntpd.pid -u 110:117
root 5462 0.0 0.0 2808 764 pts/2 S+ 23:35 0:00 grep ntpd

ii ntp 4.2.0a+stable-9ubuntu2
ii ntp-doc 4.2.0a+stable-9ubuntu2
ii ntp-server 4.2.0a+stable-9ubuntu2
ii ntp-simple 4.2.0a+stable-9ubuntu2
ii ntpdate 4.2.0a+stable-9ubuntu2

My friend has found the solution.
(http://thread.gmane.org/gmane.linux.debian.devel.bugs.general/202577/focus=202577)

[Sam Morris (yrro)]

Thanks for the info! This is now very easy to reproduce:

 1. stop ntpd
 2. comment out all nameservers in /etc/resolv.conf
 3. start ntpd
 4. there are now two ntpd processes
 5. stop ntpd
 6. there is now one ntpd process
 7. start ntpd
 8. there are now three ntpd processes

... etc.

[Sam Morris (yrro)]

Forgot to add that this was fixed in debian by changing the default ntp configuration:

   * Don't use the nomodify option for localhost. Modification
     is only allowed when authenticated, so having the nomodify
     option doesn't buy us anything. It just prevents the resolver
     slave process who does authenticate itself from properly working
     (Closes: #385334, #401847)

Though I'm not sure whether this configuration allows local users to screw with the ntp server's configuration... I find the docs for ntpd rather confusing.

[Sam Morris (yrro)]

https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/92560/ is possibly a dupe of this.

[Johnathon (kirrus)]

Confirming

[Steve Kowalik (stevenk)]

This is fixed by the upload of ntp version 1:4.2.4p0+dfsg-1ubuntu1 to Ubuntu Gutsy.

[Martin Emrich (emme)]

I still have this problem on hardy i386. ntpd is restarted every morning whenn my DSL line reconnects. Then every 2-5 days, my syslog is filled with these "permission denied" errors, as there are two instances of ntpd running. I can quickly fix it by killing both instances and restarting ntpd. I am currently running ntp 1:4.2.4p4+dfsg-3ubuntu2.

[Andrea Ballarati (ballarati)]

I have this problem too with ubuntu server 2.6.20-16 with two instances of ntpd running the first running as ntp and the second as root.
The ntp script has seq higher than DNS script.

[Martin Emrich (emme)]

Today, it happened again. It looks like the second (root) ntpd process is a child of the first. from "ps auxf":

ntp 6501 0.0 0.0 4132 1268 ? Ss 06:00 0:00 /usr/sbin/ntpd -p /var/run/ntpd.pid -u 127:127 -g
root 6513 0.0 0.0 4124 920 ? S 06:00 0:00 \_ /usr/sbin/ntpd -p /var/run/ntpd.pid -u 127:127 -g

[Martin Emrich (emme)]

Hmm, of course the removal of the "nomodify" entry did not happen for me as the package was already installed. I removed it now manually from the localhost line, let's see if the problem disappears...

[Sam Morris (yrro)]

Seems to be fixed in hardy.

[Pik Master (pikmaster)]

I observed the same bug in Centos 7, 2 instances of ntpd were created on system boot, ie:

# ps -ef | grep ntp
ntp 619 1 0 15:57 ? 00:00:00 /usr/sbin/ntpd -u ntp:ntp -g
root 633 619 0 15:57 ? 00:00:00 /usr/sbin/ntpd -u ntp:ntp -g

And it produced these errors in the log:
 9 Sep 15:57:23 ntpd[619]: process_private: failed auth mod_okay 0
 9 Sep 15:57:23 ntpd[633]: ntp_intres.request: permission denied

What's surprising, when you restart the service after the system has booted (ie. systemctl restart ntpd), the problem is gone.

I had this ntp.conf config:
restrict default kod nomodify notrap nopeer

So I had to add this line, and now the service starts correctly on system boot:
restrict 127.0.0.1

For IPv6 you probably need this as well:
restrict -6 default kod nomodify notrap nopeer
restrict -6 ::1