Caring & Sharing

How to configure chrony as an NTP client or server in Linux

Luc Cao's photo
Luc Cao
·

3 min read

Refer from

Maintaining accurate time is critical for computers to communicate, run system components, and more, and chrony can help.

In Red Hat Enterprise Linux (RHEL), the chronyd daemon provided by the chrony package is the default NTP client. Alternatively, the chronyd daemon can be configured as a server to provide accurate time to computer systems in your internal network.

This article explains both configurations so that you can implement these settings with your network devices.

Configure chrony as an NTP client

At installation, RHEL configures the chronyd service with default settings. One of these settings utilizes an NTP.org pool as the source for time. This is a perfectly acceptable configuration for most home users as these are reliable time sources. However, in an enterprise environment that follows security best practices, outbound NTP is probably restricted, so an internal NTP time source is required.

To configure the chronyd daemon to utilize an internal or another NTP source, you need to edit the /etc/chrony.conf file. Once in the file, you will configure one of three different settings for your time source. The two most common options used with chrony to set a time source are server and pool. The server directive allows you to specify a single NTP server as a time source. The pool directive is similar to the server directive, but instead of using a single NTP time source, it allows you to specify a pool of NTP servers. The pool name is expected to resolve to multiple addresses, which could change over time.

The following is an example of a default configuration that syncs the chronyd client to an NTP server listed as ntp.lab.int with the iburst option that allows chronyd to make the first update of the clock sooner:

server ntp.lab.int iburst
driftfile /var/lib/chrony/drift
makestep 1.0 3
rtcsync
keyfile /etc/chrony.keys
leapsectz right/UTC
logdir /var/log/chrony

After applying the configuration changes, restart the chronyd service and verify it is up and running. Finally, check the NTP sources and confirm that the system clock is synchronized correctly to the upstream time server:

$ sudo systemctl restart chronyd.service

$ systemctl is-active chronyd.service
active

$ chronyc sources
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^* 192.168.50.13                 4   6    17    22    +28us[  +26us] +/-   27ms

$ timedatectl
               Local time: Wed 2022-05-18 12:47:41 EDT
           Universal time: Wed 2022-05-18 16:47:41 UTC
                 RTC time: Wed 2022-05-18 16:47:42
                Time zone: America/New_York (EDT, -0400)
System clock synchronized: yes
              NTP service: active
          RTC in local TZ: no

Configure chrony as an NTP server

One of the best features of the chrony package is the ease with which you can configure an authoritative time server. The first step is to configure the server's own time source, as I showed in the previous section. Once you have configured the time source, you need to configure the allow directive in the chrony.conf file. The allow directive specifies a particular subnet from which NTP clients can access the NTP server. By default, no clients are allowed access, and chronyd operates purely as an NTP client. Therefore, enabling this directive is a requirement for chronyd to act as an NTP server. You can find more information regarding the allow directive in the chrony.conf man pages.

The following example configures the allow directive to accept connections from the 192.168.0.0/24 subnet:

server ntp.lab.int iburst
allow 192.168.0.0/24
driftfile /var/lib/chrony/drift
makestep 1.0 3
rtcsync
keyfile /etc/chrony.keys
leapsectz right/UTC
logdir /var/log/chrony

After configuring the time source, adding the allow directive, and restarting the chronyd service, you need to configure firewalld to permit the NTP service:

$ sudo firewall-cmd --add-service=ntp --permanent

$ sudo firewall-cmd --reload

Wrap up

This article shows how to configure chrony as an NTP client so you can configure your server to utilize a server or a pool-based time source. It also shows how to configure chrony as an authoritative time server to provide accurate time to your NTP clients in your network.

NTP Linux#Chrony