NTP server does not resolve host names

This document (7016873) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 11 Service Pack 4 (SLES 11 SP4)
SUSE Linux Enterprise Server 12 SP1
ntp 4.2.8

Situation

The ntp server ntpd does not synchronize with its peers anymore and the peers are specified by their host name in /etc/ntp.conf
The output of ntpq --peers lists IP numbers of the remote servers instead of their host names

Name resolution for the affected hosts works otherwise.

Resolution

Configure ntpd to not run in chroot mode by setting

NTPD_RUN_CHROOTED="no"

in /etc/sysconfig/ntp and restart the service with

SLES 11 --> rcntp restart

SLES 12 --> systemctl restart ntpd

Cause

Newer versions of ntpd are using getaddrinfo() to properly support IPv6 instead of the deprecated gethostbyname() and may require additional files in the chroot environment. Due to the modular nature of the libnss_* mechanism, it is not possible to determine which files have to be copied over in the general case.

Additional Information

Due to the architecture of ntpd, it does not start reliably in chroot mode anyway. (It often does due to a race condition, though.) Furthermore, the daemon drops all capabilities except for the one needed to open sockets on reserved ports, so chroot isn't required. Apparmor can be used to further limit the process in what it can do if political requirements mandate this.
Reference Documentation:
ntp documentation Section 9.2.4.2.5.3
SLES12 SP1 - release notes

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.