Version 3 (modified by robert@…, 15 years ago) ( diff )

ntpd privsep


The download URL is

NTPD privsep

Installing ntpd to drop to non-root -

If you have libacl and libattr installed, you can configure NTP with:


Then add an ntpd user:

groupadd ntpd &&
useradd -c 'ntpd PrivSep' -d /var/lib/ntpd -g ntpd \
    -s /bin/false ntpd &&
install -v -m710 -g ntpd -d /var/lib/ntpd

Install the blfs bootscript, and modify /etc/rc.d/init.d/ntp with this:

loadproc /usr/sbin/ntpd --configfile=/etc/ntpd.conf \
                   --jaildir=/var/lib/ntpd --logfile=/var/log/ntpd.log \
                   --pidfile=/var/run/ --user=ntpd:ntpd \

To give the ntpd user minimal privileges create a tmpfs just big enough for the drift file:

install -d -m 0000 /var/lib/ntpd/drift

And add this to /etc/fstab, and replace the gid with ntpd's group id:

tmpfs /var/lib/ntpd/drift tmpfs size=9k,nosuid,noexec,nodev,mode=1770,gid=1003,nr_inodes=2,nr_blocks=2 0 0


Note: See TracWiki for help on using the wiki.