KB
Linux Administration

Configuring NTP in Linux

4 min read771 words12 code blocks

At a glance#

  • Purpose: Point a Linux server at an internal NTP source so its clock stays in step with the rest of the estate.
  • Applies to: RHEL/CentOS/Rocky 7+ and Ubuntu 18.04+, using Chrony.
  • Risk: Low on a new server; High on a running database or authentication server if time steps abruptly.
  • Time: About 10 minutes.

Overview#

This is the short client-side procedure for getting a server synchronised against an internal NTP server. It is the version to follow when building or fixing a single machine.

For production changes on systems with compliance or transaction requirements — where time must never step and every change needs a rollback plan — follow NTP (Chrony) Installation & Configuration instead. That article covers the safe-slewing configuration and validation steps required in those environments.

Why it matters#

Clock drift is one of those faults that presents as something else entirely:

  • Kerberos and Active Directory authentication fail outright once drift exceeds five minutes.
  • TLS handshakes fail with confusing "certificate not yet valid" errors.
  • Log timestamps stop lining up across servers, making incident investigation far harder.
  • Database replication and clustered services misbehave in ways that are difficult to trace.

Before you start#

  • The IP or hostname of the internal NTP server. The examples use 192.168.100.20.
  • Root or sudo access.
  • UDP port 123 open outbound to that server.

Check the current state before changing anything:

bash
timedatectl
chronyc sources

Procedure#

1. Install Chrony#

Chrony has replaced ntpd as the default on both distribution families.

bash
# RHEL / CentOS / Rocky
sudo yum install chrony -y

# Ubuntu / Debian
sudo apt update && sudo apt install chrony -y

2. Set the correct timezone#

Time synchronisation and timezone are separate settings. Both need to be right.

bash
sudo timedatectl set-timezone Asia/Kathmandu

3. Back up the configuration#

bash
sudo cp /etc/chrony.conf /etc/chrony.conf.bak
Note: On Ubuntu the file is /etc/chrony/chrony.conf. On RHEL it is /etc/chrony.conf. Adjust the paths below accordingly.

4. Edit the configuration#

bash
sudo nano /etc/chrony.conf

Comment out the existing public pool and server lines by prefixing each with #, then add your internal source:

text
server 192.168.100.20 iburst

The iburst option sends a rapid burst of initial requests so the first synchronisation completes in seconds rather than minutes.

Warning: On a production database or authentication server, also add makestep 0 -1 to prevent Chrony from correcting large offsets with a sudden jump. A backwards time step can break transaction ordering. See the detailed Chrony article before changing time on such a host.

5. Enable and start the service#

bash
# RHEL
sudo systemctl enable --now chronyd

# Ubuntu
sudo systemctl enable --now chrony

If it was already running, restart it to pick up the new configuration:

bash
sudo systemctl restart chronyd

6. Allow NTP through the firewall#

Only needed if this host also serves time to others:

bash
# firewalld
sudo firewall-cmd --add-service=ntp --permanent
sudo firewall-cmd --reload

# ufw
sudo ufw allow 123/udp

Verification#

Check the source list:

bash
chronyc sources -v

Your server should be listed, and after a minute or two should be marked with ^*, which means it is the selected synchronisation source:

text
MS Name/IP address         Stratum Poll Reach LastRx Last sample
===============================================================
^* 192.168.100.20                3   6   377    23   +14us[ +18us] +/-  12ms

The leading characters matter:

SymbolMeaning
^*Current synchronisation source — this is what you want
^+Reachable and acceptable, but not selected
^?Unreachable
^xConsidered a falseticker; its time disagrees with the others

Confirm the overall state:

bash
chronyc tracking
timedatectl

timedatectl should report System clock synchronized: yes and NTP service: active.

Troubleshooting#

SymptomCause and fix
Source stuck at ^?Server unreachable. Test with chronyc -a 'burst 4/4', then check firewall and routing to UDP 123.
Number of sources = 0No server or pool lines are active. Confirm you edited the correct file for the distribution.
Clock synced but wrong local timeTimezone is wrong, not the clock. Fix with timedatectl set-timezone.
systemctl start chronyd fails on UbuntuThe unit is named chrony on Ubuntu, not chronyd.
Large offset never correctsChrony refuses to step by default. Force a one-off correction with chronyc makestep, but only outside business hours on a production host.
Conflicts with systemd-timesyncdBoth are trying to manage the clock. Disable the other: sudo systemctl disable --now systemd-timesyncd