Linux Time Synchronization: Configuring NTP and chrony Correctly

SEO Metadata

SEO Title Options

1. Linux Time Synchronization: Configuring NTP and chrony
2. Linux Time Synchronization: Configuring: Practical 2026
3. Administration Playbook: Linux Time Synchronization

Meta Description Options

1. Learn Linux Time Synchronization: Configuring NTP and chrony Correctly with a practical Administration framework, expert mistakes, implementation steps.
2. Sets up chrony as an NTP client and server, configures stratum hierarchy, verifies sync status, and handles leap second adjustments.

URL Slug

linux-time-synchronization-configuring-ntp-chrony-correctly

Focus Keyword

Linux Time Synchronization: Configuring NTP and chrony Correctly

Additional LSI Keywords

• Administration
• Linux
• chrony
• NTP
• Time Synchronization
• Ubuntu
• Linux Time Synchronization: Configuring NTP and chrony Correctly
• production checklist
• implementation guide
• best practices
• architecture decisions
• testing strategy

Table of Contents

• Article overview
• What Linux Time Synchronization: Configuring NTP and chrony Correctly means
• Why it matters now
• Implementation framework
• Practical comparison
• Expert workflow
• Common mistakes
• Media and link plan
• Original technical deep dive
• FAQ
• Structured data
• Conclusion

Article overview

Linux Time Synchronization: Configuring NTP and chrony Correctly is the kind of topic that looks simple until it reaches production. Teams usually discover the real cost late: unclear boundaries, weak defaults, hidden maintenance work, and decisions that seemed harmless when the codebase was small.

The problem gets worse when the article, tutorial, or implementation guide only explains the happy path. This guide closes that gap with a practical framework, a comparison table, common mistakes, and a deep technical section you can use while planning real work.

Keep reading for the non-obvious part: the safest implementation is rarely the most impressive-looking one. It is the one your team can debug, test, document, and evolve without turning every future change into archaeology.

Key Takeaways

• Linux Time Synchronization: Configuring NTP and chrony Correctly should be evaluated as a production decision, not only as a syntax or tooling choice.
• The best implementation keeps responsibilities visible, with clear ownership, tests, documentation, and rollback paths.
• Search visibility improves when practical depth, structured answers, and expert examples live on the same page.

[IMAGE: A mobile-first technical article layout showing the main concept, decision table, implementation checklist, and FAQ blocks. Alt: Linux Time Synchronization: Configuring NTP and chrony Correctly expert guide for Administration]

What Linux Time Synchronization: Configuring NTP and chrony Correctly means

Linux Time Synchronization: Configuring NTP and chrony Correctly means applying administration knowledge to a concrete engineering decision, then turning that decision into reliable code, documentation, and operational behavior. In practice, it combines the topic's core concepts with trade-off analysis, implementation boundaries, testing strategy, and maintenance discipline.

This is the definition worth optimizing for featured snippets because it avoids hype. It tells the reader what the topic does and what a professional implementation must include.

Why it matters now

The technical web is more crowded than it was a few years ago. Thin tutorials can still get indexed, but they rarely earn trust from senior developers, buyers, AI answer systems, or teams that need production guidance.

For administration topics, the strongest content now has three layers:

• a clear answer for fast scanning
• a practical framework for implementation
• expert context that explains what breaks later

That same structure helps search engines understand the page. It also helps readers decide whether the advice fits their project.

Implementation framework

Use this framework before adopting the approach described in this article.

1. Define the user problem and the production risk.
2. Identify the smallest reliable implementation boundary.
3. Keep configuration, secrets, and environment-specific behavior outside the article's core logic.
4. Add tests for the behavior that would hurt if it regressed.
5. Document the trade-off, not only the final code.
6. Measure the result with logs, metrics, or user-facing outcomes.
7. Revisit the decision after real usage exposes edge cases.

The sequence is deliberately conservative. It keeps the work grounded in outcomes instead of novelty.

[IMAGE: A seven-step implementation framework with discovery, boundary design, configuration, tests, documentation, measurement, and iteration. Alt: Linux Time Synchronization: Configuring NTP and chrony Correctly implementation framework]

Practical comparison

This table is intentionally practical. It gives a reviewer something to check before the implementation becomes expensive to change.

Expert workflow

Expert tip: "Treat Linux Time Synchronization: Configuring NTP and chrony Correctly as a system boundary. If the next developer cannot find where the decision lives, how it is tested, and when it should be avoided, the implementation is not finished."

A useful workflow is simple:

• Start with the smallest working example.
• Add the constraints that exist in your real project.
• Remove anything that only demonstrates cleverness.
• Write down the failure modes.
• Add links to related decisions so future readers can navigate the topic cluster.

That last point matters for both humans and search systems. A single article can answer a question; a cluster proves authority.

Common mistakes

Mistake 1: Copying a pattern without its context

A pattern that works in a small demo can fail in a real application. The missing context is usually data volume, team experience, deployment process, security requirements, or observability.

Before copying the pattern, ask what assumption made it safe in the original example.

Mistake 2: Putting business logic in the wrong layer

This is the fastest way to make future debugging expensive. In Laravel, PHP, and server-rendered websites, presentation should receive prepared data, not discover rules on its own.

Keep decision logic in models, actions, services, policies, requests, jobs, or documented helpers where it can be tested directly.

Mistake 3: Optimizing for novelty instead of maintainability

Newer tools and language features can be valuable. They can also hide simple behavior behind unfamiliar syntax.

Use the option that makes the next production incident easier to understand.

Mistake 4: Publishing without a measurement plan

If the article describes a performance, SEO, security, or architecture improvement, define how success will be checked. Logs, tests, crawl diagnostics, analytics, and user behavior are all stronger than assumptions.

[IMAGE: A common-mistakes board with context loss, wrong layer, novelty bias, and missing measurement highlighted. Alt: Linux Time Synchronization: Configuring NTP and chrony Correctly common mistakes]

Media and link plan

Image placeholders

• [IMAGE: A concept diagram for Linux Time Synchronization: Configuring NTP and chrony Correctly with input, decision boundary, implementation, tests, and production feedback. Alt: Linux Time Synchronization: Configuring NTP and chrony Correctly concept diagram]
• [IMAGE: A mobile screenshot-style checklist for Linux Time Synchronization: Configuring NTP and chrony Correctly. Alt: Linux Time Synchronization: Configuring NTP and chrony Correctly mobile checklist]
• [IMAGE: A comparison table visualization for strong versus weak implementation choices. Alt: Linux Time Synchronization: Configuring NTP and chrony Correctly comparison table]

Video placeholder

[VIDEO: Insert a 5-8 minute YouTube walkthrough that demonstrates the main decision, the implementation boundary, the test strategy, and the production caveats for Linux Time Synchronization: Configuring NTP and chrony Correctly.]

Trustworthy outbound links

• Linux manual pages - use this as the trust reference for operating-system reference.
• Google Search quality guidance - use this as the trust reference for people-first content and E-E-A-T alignment.

Internal linking opportunities

• Internal guide: Linux systemd Services: Create, Enable - use this when readers need a related Administration follow-up.
• Internal guide: Linux Resource Limits: ulimit, cgroups v2 - use this when readers need a related Administration follow-up.

Original Technical Deep Dive

The short version

Time synchronization is infrastructure, not decoration. Bad time breaks TLS validation, logs, Kerberos, database replication, distributed tracing, backup ordering, MFA tokens, cron schedules, and incident timelines.

Use this rule:

one time daemon per host
chrony for serious Linux servers
UTC hardware clock
multiple trusted sources
local NTP servers for private networks
monitor offset, stratum, and leap status

For most Ubuntu servers, install chrony, configure upstream NTP sources, and verify with:

timedatectl status
chronyc tracking
chronyc sources -v
chronyc sourcestats

Do not run systemd-timesyncd, ntpd, and chronyd at the same time. They all want to control the same system clock.

NTP, chrony, chronyd, and chronyc

The names matter:

Chrony can act as:

• an NTP client;
• an NTP server for other machines;
• a source-aware clock controller for intermittent networks;
• a local time authority for isolated networks when configured carefully.

On Ubuntu 25.10 and newer, chrony is the default time synchronization service. Older Ubuntu servers may still use systemd-timesyncd unless chrony was installed manually or by policy.

Check the current state

Start with systemd:

timedatectl status

Important lines:

System clock synchronized: yes
NTP service: active
RTC in local TZ: no

Check which services exist:

systemctl status chrony --no-pager
systemctl status systemd-timesyncd --no-pager
systemctl status ntp --no-pager 2>/dev/null || true
systemctl status ntpd --no-pager 2>/dev/null || true

Check chrony directly:

chronyc tracking
chronyc sources -v
chronyc sourcestats
chronyc activity

If chronyc tracking says Not synchronised, check sources and network access before changing random settings.

Install chrony

Ubuntu or Debian:

sudo apt update
sudo apt install -y chrony

RHEL, Rocky Linux, AlmaLinux, or Fedora:

sudo dnf install -y chrony

Enable the daemon:

sudo systemctl enable --now chrony

On some distributions the service is named chronyd:

sudo systemctl enable --now chronyd

Check:

systemctl status chrony --no-pager || systemctl status chronyd --no-pager
chronyc tracking

Avoid daemon conflicts

Disable systemd-timesyncd when chrony owns time:

sudo timedatectl set-ntp false
sudo systemctl disable --now systemd-timesyncd 2>/dev/null || true

If ntpd is installed, stop it:

sudo systemctl disable --now ntp 2>/dev/null || true
sudo systemctl disable --now ntpd 2>/dev/null || true

Then start chrony:

sudo systemctl enable --now chrony

Check for active time services:

systemctl --type=service --state=running | grep -E 'chrony|timesyncd|ntp'

There should be one active service controlling the system clock.

Configure a basic chrony client

Ubuntu stores the main config in:

/etc/chrony/chrony.conf

Some distributions use:

/etc/chrony.conf

Back it up:

sudo cp /etc/chrony/chrony.conf /etc/chrony/chrony.conf.$(date +%F).bak

Open it:

sudoedit /etc/chrony/chrony.conf

Simple client config:

pool ntp.ubuntu.com iburst
pool 0.ubuntu.pool.ntp.org iburst
pool 1.ubuntu.pool.ntp.org iburst

driftfile /var/lib/chrony/chrony.drift
makestep 1.0 3
rtcsync

logdir /var/log/chrony

Meaning:

Restart:

sudo systemctl restart chrony

[IMAGE: Supporting visual 1 for Linux Time Synchronization: Configuring NTP and chrony Correctly, showing Linux Time Synchronization: Configuring NTP and chrony Correctly decisions, examples, and Linux, Administration, chrony. Alt: Linux Time Synchronization: Configuring NTP and chrony Correctly linux-time-synchronization-configuring-ntp-chrony-correctly visual 1]

[IMAGE: Supporting visual 1 for Linux Time Synchronization: Configuring NTP and chrony Correctly, showing Linux Time Synchronization: Configuring NTP and chrony Correctly decisions, examples, and Linux, Administration, chrony. Alt: Linux Time Synchronization: Configuring NTP and chrony Correctly linux-time-synchronization-configuring-ntp-chrony-correctly visual 1]

Verify:

chronyc tracking
chronyc sources -v

Use internal NTP servers

Production fleets should usually use internal NTP servers instead of every host polling the public Internet.

Client config:

server ntp1.internal.example.com iburst
server ntp2.internal.example.com iburst
server ntp3.internal.example.com iburst

driftfile /var/lib/chrony/chrony.drift
makestep 1.0 3
rtcsync

Use server for named fixed servers. Use pool when the name intentionally resolves to a changing pool.

Reload:

sudo systemctl restart chrony

Force a source recheck:

sudo chronyc burst 4/4
chronyc sources -v

Do not set all clients to one server unless you have a deliberate single-time-authority design. Use at least two sources, preferably three or four, so chrony can detect bad sources.

Interpret chronyc tracking

Run:

chronyc tracking

Example:

Reference ID    : C0A8010A (ntp1.internal.example.com)
Stratum         : 3
Ref time (UTC)  : Mon Mar 07 12:14:48 2022
System time     : 0.000002345 seconds slow of NTP time
Last offset     : -0.000003102 seconds
RMS offset      : 0.000021884 seconds
Frequency       : 2.143 ppm fast
Residual freq   : -0.001 ppm
Skew            : 0.036 ppm
Root delay      : 0.004218391 seconds
Root dispersion : 0.001023441 seconds
Update interval : 64.3 seconds
Leap status     : Normal

Key fields:

For a normal server, you want:

Leap status: Normal
Stratum: reasonable for your hierarchy
System time: small and stable
sources: at least one selected source marked with *

Interpret chronyc sources

Run:

chronyc sources -v

The selected source is marked with *:

MS Name/IP address         Stratum Poll Reach LastRx Last sample
===============================================================================
^* ntp1.internal.example.com     2   6   377    34   -12us[  -15us] +/-  823us
^+ ntp2.internal.example.com     2   6   377    31    +4us[   +1us] +/-  910us
^- ntp3.internal.example.com     3   6   377    32  +120us[ +117us] +/- 2500us

Useful source marks:

Check source statistics:

chronyc sourcestats

This helps distinguish a briefly unreachable source from a noisy or drifting source.

Configure chrony as an internal NTP server

On the server that should provide time to clients, keep upstream sources and add an allow rule.

Example:

server time1.example.net iburst
server time2.example.net iburst
server time3.example.net iburst

driftfile /var/lib/chrony/chrony.drift
makestep 1.0 3
rtcsync

allow 10.20.0.0/16
allow 192.168.50.0/24

Restart:

sudo systemctl restart chrony

Open the firewall for NTP:

sudo ufw allow from 10.20.0.0/16 to any port 123 proto udp
sudo ufw allow from 192.168.50.0/24 to any port 123 proto udp

For firewalld:

sudo firewall-cmd --permanent --add-service=ntp
sudo firewall-cmd --reload

Check that the daemon is listening:

sudo ss -ulpn | grep ':123'

From a client:

chronyc -N sources -v
chronyd -Q 'server ntp1.internal.example.com iburst'

Use allow narrowly. Do not expose an internal NTP server to the public Internet unless you are intentionally operating a public time service and have abuse controls, monitoring, and capacity.

Design the stratum hierarchy

NTP stratum is hop distance from a reference clock:

[IMAGE: Supporting visual 2 for Linux Time Synchronization: Configuring NTP and chrony Correctly, showing Linux Time Synchronization: Configuring NTP and chrony Correctly decisions, examples, and Linux, Administration, chrony. Alt: Linux Time Synchronization: Configuring NTP and chrony Correctly linux-time-synchronization-configuring-ntp-chrony-correctly visual 2]

Example production hierarchy:

public / GPS / provider NTP
  -> ntp1.internal, ntp2.internal, ntp3.internal
  -> app servers, databases, Kubernetes nodes, network devices

Internal NTP servers:

server time.cloudflare.com iburst nts
server time.google.com iburst
server ntp.ubuntu.com iburst

allow 10.0.0.0/8
driftfile /var/lib/chrony/chrony.drift
makestep 1.0 3
rtcsync

Clients:

server ntp1.internal.example.com iburst
server ntp2.internal.example.com iburst
server ntp3.internal.example.com iburst

driftfile /var/lib/chrony/chrony.drift
makestep 1.0 3
rtcsync

Avoid synchronization loops:

server A uses server B
server B uses server A

That can produce a stable-looking but wrong time island.

[IMAGE: Supporting visual 2 for Linux Time Synchronization: Configuring NTP and chrony Correctly, showing Linux Time Synchronization: Configuring NTP and chrony Correctly decisions, examples, and Linux, Administration, chrony. Alt: Linux Time Synchronization: Configuring NTP and chrony Correctly linux-time-synchronization-configuring-ntp-chrony-correctly visual 2]

Use local mode only for isolated networks

Chrony's local directive lets a server appear synchronized even when it has no external source.

Use it only when the network is intentionally isolated:

local stratum 10
allow 192.168.165.0/24
driftfile /var/lib/chrony/chrony.drift
manual
rtcsync

Better isolated design with multiple local servers:

server ntp2.local
server ntp3.local
local stratum 10 orphan
allow 192.168.165.0/24
driftfile /var/lib/chrony/chrony.drift
rtcsync

Do not use local stratum 1 to make a server look authoritative. Stratum should communicate hierarchy, not ego.

Handle large clock offsets

Chrony normally slews time by speeding up or slowing down the clock. That avoids time jumps that can break applications.

At boot, large offsets should be corrected early:

makestep 1.0 3

This allows stepping when the offset is larger than 1 second during the first 3 updates.

For a one-time check without setting the clock:

chronyd -Q 'server ntp.ubuntu.com iburst'

For a one-time sync and exit:

sudo chronyd -q 'server ntp.ubuntu.com iburst'

To force chrony to step immediately on a running host:

sudo chronyc makestep

Use forced steps carefully. Databases, queues, logs, token validation, leases, and distributed systems can behave badly when time jumps.

Handle leap seconds

UTC occasionally receives a leap second to keep civil time aligned with Earth's rotation. NIST describes this as an adjustment between UTC and TAI; as of the current NIST table, TAI is 37 seconds ahead of UTC.

For normal Linux clients:

do not manually schedule leap seconds
use reliable upstream sources
monitor Leap status
keep tzdata updated

Check leap status:

chronyc tracking | grep 'Leap status'

Possible statuses include:

Normal
Insert second
Delete second
Not synchronised

If you run a time server with reference clocks or sources that do not announce leap seconds reliably, configure leap-second data:

leapsectz right/UTC

Verify the timezone data supports leap seconds:

TZ=right/UTC date -d 'Dec 31 2008 23:59:60'

For leap-smearing environments, be consistent. Clients that use leap-smearing sources should not mix them with non-smearing sources. If half the fleet follows normal UTC and half follows a smear, the clocks can disagree during the smear window.

Chrony can be configured to smear leap corrections on a server:

leapsecmode slew
maxslewrate 1000
smoothtime 400 0.001024 leaponly

Use leap smear only when the whole client population is designed for it. For most systems, reliable upstream NTP plus monitoring Leap status is the right operational answer.

[IMAGE: Supporting visual 3 for Linux Time Synchronization: Configuring NTP and chrony Correctly, showing Linux Time Synchronization: Configuring NTP and chrony Correctly decisions, examples, and Linux, Administration, chrony. Alt: Linux Time Synchronization: Configuring NTP and chrony Correctly linux-time-synchronization-configuring-ntp-chrony-correctly visual 3]

Configure NTS when available

Network Time Security adds authentication to NTP. It uses NTS-KE over TCP port 4460 to establish keys, then normal NTP over UDP port 123.

Client source example:

server time.cloudflare.com iburst nts
server nts.netnod.se iburst nts

Ubuntu 25.10 and newer may configure Ubuntu NTS pools in /etc/chrony/sources.d/.

Check sources:

chronyc -N sources -v

If NTS fails on a network that intercepts or blocks time traffic, check:

TCP 4460 outbound
UDP 123 outbound
certificate validation
initial clock sanity
DNS resolution

[IMAGE: Supporting visual 3 for Linux Time Synchronization: Configuring NTP and chrony Correctly, showing Linux Time Synchronization: Configuring NTP and chrony Correctly decisions, examples, and Linux, Administration, chrony. Alt: Linux Time Synchronization: Configuring NTP and chrony Correctly linux-time-synchronization-configuring-ntp-chrony-correctly visual 3]

Do not assume nts is a drop-in fix for every environment. It depends on TLS, and TLS needs the clock to be close enough for certificate validation.

Monitor time sync

Minimal shell check:

#!/usr/bin/env bash
set -euo pipefail

if ! chronyc tracking | grep -q 'Leap status.*Normal'; then
  echo "chrony leap status is not normal" >&2
  exit 1
fi

if ! chronyc sources | awk '$1 ~ /\*/ { found=1 } END { exit found ? 0 : 1 }'; then
  echo "chrony has no selected source" >&2
  exit 1
fi

Better checks:

chronyc -c tracking
chronyc -c sources
chronyc -c sourcestats

Track:

• selected source;
• stratum;
• system time offset;
• root delay;
• root dispersion;
• leap status;
• source reachability;
• number of clients on internal NTP servers.

On an internal NTP server:

sudo chronyc clients
sudo chronyc serverstats

Troubleshooting order

Use this sequence:

1. Confirm only one time daemon is active.
2. Check timedatectl status.
3. Check chronyc tracking.
4. Check chronyc sources -v.
5. Check network reachability to UDP 123.
6. Check NTS TCP 4460 if using nts.
7. Check DNS resolution for NTP sources.
8. Check firewall rules.
9. Check logs.
10. Check whether the source itself is synchronized.

Commands:

timedatectl status
chronyc tracking
chronyc sources -v
chronyc sourcestats
chronyc activity
systemctl status chrony --no-pager
journalctl -u chrony --since '30 minutes ago' --no-pager
sudo ss -ulpn | grep ':123'
resolvectl query ntp.ubuntu.com

Common failures:

Production checklist

[ ] Exactly one time daemon controls the clock.
[ ] Hardware clock is UTC.
[ ] chrony config is backed up and managed by configuration management.
[ ] At least three upstream sources exist for core time servers.
[ ] Clients use internal NTP servers where appropriate.
[ ] NTP server access is restricted with allow and firewall rules.
[ ] UDP 123 is open only where required.
[ ] NTS TCP 4460 is open only when NTS is used.
[ ] makestep is limited to boot-time updates.
[ ] Leap status is monitored.
[ ] Stratum and selected source are monitored.
[ ] VM snapshot and resume procedures include time verification.

FAQ

What is Linux Time Synchronization: Configuring NTP and chrony Correctly?

Linux Time Synchronization: Configuring NTP and chrony Correctly is a practical administration topic that should be evaluated through implementation scope, production risk, testing, documentation, and long-term maintainability.

When should a team use Linux Time Synchronization: Configuring NTP and chrony Correctly?

Use Linux Time Synchronization: Configuring NTP and chrony Correctly when it solves a real project constraint, improves clarity, or reduces operational risk. Avoid it when it only adds novelty or hides behavior from future maintainers.

What is the biggest risk with Linux Time Synchronization: Configuring NTP and chrony Correctly?

The biggest risk is copying a pattern without its context. Production systems need clear boundaries, rollback options, tests, and observability before a technique becomes dependable.

How do you test Linux Time Synchronization: Configuring NTP and chrony Correctly?

Test the smallest unit that owns the behavior, then add integration coverage for the path users or systems actually rely on. Include failure cases, configuration differences, and regression checks.

How does Linux Time Synchronization: Configuring NTP and chrony Correctly affect SEO and AI search visibility?

It improves visibility when the article gives a direct answer, expert context, structured headings, internal links, trustworthy references, and FAQ content that matches the visible page.

Conclusion

Linux Time Synchronization: Configuring NTP and chrony Correctly is worth doing when the implementation improves clarity, reliability, or delivery speed. It is not worth doing when it hides ownership, increases operational risk, or makes the system harder to explain.

Use the framework above as a review checklist. Then connect this topic to the rest of the project documentation so readers can move from concept to implementation without losing context.