NTP (Chrony) Installation & Configuration

At a glance#

• Purpose: Configure Chrony for safe, non-disruptive time synchronisation on production servers.
• Applies to: RHEL 8 and RHEL 9.
• Risk: Medium - time changes on a live database or authentication server can disrupt transactions.
• Time: About 30 minutes.

Platform: RHEL 8 / RHEL 9

Location: Nepal

Timezone: Asia/Kathmandu

NTP Region: South Asia (Asia Pool + Optional Internal NTP)

1. Objective#

To configure a secure, stable, and non-disruptive NTP time synchronization:

• No sudden system time jumps
• No impact to database transactions
• No impact to logs, certificates, or audit trails
• Compliance with banking operational standards

2. Install Chrony#

Chrony is the supported NTP client for RHEL 8 and RHEL 9.

sudo yum install chrony -y

3. Configure Timezone (Asia/Kathmandu)#

sudo timedatectl set-timezone Asia/Kathmandu

Verify:

timedatectl

4. Configure Chrony#

4.1 Open Configuration File#

sudo nano /etc/chrony.conf

4.2 Disable All Default Public Servers#

Comment out all default lines starting with:

server
pool

4.3 Add South Asia / Nepal Region NTP Servers#

server 0.asia.pool.ntp.org iburst
server 1.asia.pool.ntp.org iburst
server 2.asia.pool.ntp.org iburst
server 3.asia.pool.ntp.org iburst

Optional Regional Pools:

server in.pool.ntp.org iburst
server np.pool.ntp.org iburst

Optional Internal NTP:

server <internal-ntp-ip> iburst

4.4 Safety Setting (Critical)#

Disable all time stepping to prevent sudden time jumps:

makestep 0 -1

This ensures:

• No instant time correction
• Only slow safe slewing

4.5 Save and Exit#

5. Enable and Start Chrony#

sudo systemctl enable chronyd
sudo systemctl start chronyd

Restart only if already running:

sudo systemctl restart chronyd

6. Firewall Configuration (If Firewalld Is Enabled)#

sudo firewall-cmd --add-service=ntp --permanent
sudo firewall-cmd --reload

7. Post-Change Validation (Mandatory)#

timedatectl
chronyc tracking
chronyc sources -v

Expected Output:#

• System clock synchronized: yes
• Time offset gradually reducing
• At least one reachable NTP source marked with ^*

8. Rollback Plan (If Any Issue Is Observed)#

Restore previous configuration:

cp /etc/chrony.conf.bak /etc/chrony.conf
systemctl restart chronyd

Or immediately stop Chrony:

sudo systemctl stop chronyd

9. Best Practices for NTP#

• Always use:
  • Internal NTP servers OR
  • Regional South Asia NTP pools
• Never allow time stepping in production
• Always capture:
  • Pre-change output
  • Post-change output
• Never restart chronyd during peak transaction hours
• NTP change must be logged as a controlled production change