Server clocks drift. A few seconds off sounds harmless, but it breaks things. TLS handshakes fail with “certificate not yet valid”, TOTP two-factor codes are rejected, logs from different servers can’t be correlated, and databases or distributed systems (Galera, CockroachDB, Kerberos) refuse to work. NTP keeps clocks in sync, and chrony is the standard NTP implementation on modern Linux.

Check whether time is synchronised

timedatectl

Look for System clock synchronized: yes and NTP service: active. Many distributions already sync time with systemd-timesyncd (Ubuntu, Debian) or chrony (RHEL, Rocky, AlmaLinux, Fedora).

chrony vs systemd-timesyncd

systemd-timesyncd chrony
Type Simple SNTP client Full NTP client and server
Accuracy Good enough for most hosts Better, especially on VMs with irregular clocks
Large offsets Steps slowly Configurable stepping
Serve time to other hosts No Yes
Monitoring Basic (timedatectl timesync-status) Detailed (chronyc)

For servers, especially databases and clusters, chrony is the better choice.

Install chrony

Ubuntu and Debian:

sudo apt install chrony

This replaces systemd-timesyncd automatically.

RHEL family (usually preinstalled):

sudo dnf install chrony
sudo systemctl enable --now chronyd

The service is called chrony on Debian/Ubuntu and chronyd on RHEL.

Configure time sources

Config file: /etc/chrony/chrony.conf (Debian/Ubuntu) or /etc/chrony.conf (RHEL).

The defaults use distribution pools, which is fine for most servers:

pool ntp.ubuntu.com        iburst maxsources 4
pool 0.ubuntu.pool.ntp.org iburst maxsources 1

You can also use the global pool, regional pools or public services:

pool pool.ntp.org iburst
pool time.cloudflare.com iburst nts
server time.google.com iburst
  • iburst speeds up the initial sync.
  • nts enables Network Time Security (authenticated NTP) where the server supports it, as Cloudflare’s does.
  • Don’t mix Google’s leap-smearing servers with non-smearing ones. During a leap second they disagree by up to half a second.

Important defaults to keep:

makestep 1.0 3      # step the clock if off by >1 s during the first 3 updates
rtcsync             # keep the hardware clock in sync
driftfile /var/lib/chrony/chrony.drift

Restart after changes:

sudo systemctl restart chrony    # or chronyd

Check sync status with chronyc

chronyc tracking
Reference ID    : A29FC801 (time.cloudflare.com)
Stratum         : 4
System time     : 0.000012345 seconds fast of NTP time
Last offset     : +0.000003210 seconds
Leap status     : Normal

System time is the current offset. Microseconds to low milliseconds is normal.

chronyc sources -v

This lists the time servers. ^* marks the server in use, ^+ acceptable alternatives and ^? unreachable ones.

chronyc sourcestats
chronyc activity

Fix a large offset immediately

If the clock is minutes or hours off (after a long suspend or a VM restore), force a step:

sudo chronyc makestep

Restart services that are sensitive to time afterwards.

Firewall

NTP clients use UDP 123 outbound. Most VPS firewalls allow outbound traffic by default. If you filter outbound traffic, allow it:

sudo ufw allow out 123/udp

You don’t need to open port 123 inbound unless the server provides time to others.

Serve time to your other servers

On one server (or two, for redundancy):

allow 10.0.0.0/24

Then point the other servers at it with server 10.0.0.10 iburst, and open UDP 123 from the private network only. This is useful for clusters on a private network. Never run an open public NTP server, because they can be abused for amplification attacks.

Troubleshooting

System clock synchronized: no — check chronyc sources. If every source shows ^?, outbound UDP 123 is blocked or DNS fails.

Two NTP daemons fighting — make sure only one is active: systemctl status systemd-timesyncd chrony ntp.

Containers use the host’s clock. Fix time on the host, not inside containers.

Time zone vs time — chrony syncs UTC time. The displayed local time also depends on the time zone setting. See timedatectl and time zones.

Quick reference

Task Command
Install apt install chrony / dnf install chrony
Status chronyc tracking
Sources chronyc sources -v
Step now sudo chronyc makestep
Is it synced? timedatectl
Restart systemctl restart chrony (chronyd on RHEL)

Related: Linux server hardening checklist and CockroachDB basics.

  • Linux
  • NTP
  • Time