Synchronizing Time Using NTP/NTS

The Network Time Protocol (NTP) is designed to synchronize the system time over the network. Its goal is to maintain the absolute time and use it to synchronize the system time of all machines within a network.

Network Time Security (NTS) is a security extension of NTP. NTS provides mechanisms to authenticate NTP messages and encrypt them, ensuring that the time data received is both secure and authentic. NTS is designed to be backward compatible with existing NTP infrastructure. This allows for gradual deployment without requiring changes to existing NTP servers that do not support NTS.

When the NTP service is properly configured, it continuously queries and adjusts the system time with reliable time servers. Typically, home computers and other devices connected to the internet are configured to query a public time server on the Internet.

Figure 1: Individual devices querying a public time server #

 

Conversely, desktop computers and servers that reside inside a corporate subnet are configured to query a dedicated time server within the local network. The time server itself synchronizes its time with a public time server.

Figure 2: Multiple hosts querying an internal time server #

 

Using NTP to maintain the accurate time has the following benefits:

To keep the computer clock synchronized, you need to tell chronyd what time sources to use. For this purpose, use server, pool and peer directives. You can use each of them multiple times.

The server directive tells chronyd to use a specific host as a time server by its name or IP address.

server 0.europe.pool.ntp.org offline1
server 1.europe.pool.ntp.org offline prefer2
server 192.168.2.254

The pool directive lets you specify a network name that resolves to multiple IP addresses that may change over time.

pool pool.ntp.org iburst1 maxsources 32

The peer directive specifies an NTP peer host instead of a time server. System time synchronization among peers uses a symmetric architecture instead of the client/server mode invoked by server and pool options. You can use peer multiple times to specify more than one peer.

peer 192.168.1.116
peer ntp.example.com

By default, chronyd works as a client to specified NTP servers. To make it operate as an NTP server as well, add the allow directive to the /etc/chrony.conf file. It opens the NTP server port (123 by default) and responds to client requests.

You can either specify a single IP of an NTP client, or a subnet to include multiple clients. You can use the allow directive multiple times:

allow 1.2.3.4
allow 3.4.5.0/24

Tip

If you do not specify an IP address or a subnet, the stand-alone allow directive allows access from all IPv4 and IPv6 addresses.

To limit the access of the previous allow directive, use the deny directive:

allow 1.2.3.4
deny 1.2.3.0/24
allow 1.2.0.0/16

In the above example, the effect is the same regardless of the order of the three directives. The 1.2.0.0/16 subnet is allowed access except for the 1.2.3.0/24 subnet, which is denied access. However, the host 1.2.3.4 is allowed access.

chronyd relies on other programs (such as gpsd) to access the timing data via a specific driver. Use the refclock directive in /etc/chrony.conf to specify a hardware reference clock to be used as a time source. It has two mandatory parameters: a driver name and a driver-specific parameter. The two parameters are followed by zero or more refclock options. chronyd includes the following drivers:

Tip

For more information on individual drivers' options, see man 8 chrony.conf.

Although chronyd starts up normally on a system that boots without a network connection, it cannot access the time servers specified in /etc/chrony.conf. To prevent chronyd from trying to query inaccessible time servers, use the offline option next to the time source directive, for example:

server ntp.example.org offline

chronyd then does not try to poll the server until it is enabled using the following command:

# chronyc online ntp.example.org

Tip

When the auto_offline option is set instead of the offline option, chronyd assumes that the time server has gone offline when two requests have been sent to it without receiving a response. This option avoids the need to run the offline command from chronyc when disconnecting the network link.

chronyc is the client part of the chrony NTP implementation. You can use the chronyc command to change the behavior of the chronyd service at runtime. It also generates status reports about the operation of chronyd.

Note: Temporary changes

Changes made using chronyc are not permanent. They are lost after the next chronyd restart. For permanent changes, modify /etc/chrony.conf as described in Section 3, “Configuring NTP by adjusting /etc/chrony.conf”.

You can run chronyc either in an interactive or non-interactive mode. To run chronyc interactively, enter chronyc on the command line and press Enter. It displays a prompt and waits for your command input. For example, to check how many NTP sources are online or offline, run the activity command:

# chronyc
chronyc> activity
200 OK
4 sources online
2 sources offline
1 sources doing burst (return to online)
1 sources doing burst (return to offline)
0 sources with unknown address

To exit chronyc's prompt, enter quit or exit.

If you do not need to use the interactive prompt, enter the command directly, for example:

# chronyc activity