How to configure chrony as an NTP client or server in Linux

Accurate timekeeping is one of the most important configurations required for reliable communication between network-based computers. It is also needed to ensure system components, including systemd timers and cronjobs, run at the correct time. Computers can utilize the Network Time Protocol (NTP) to synchronize their time to an upstream time server or a pool of servers to maintain accurate time.

In Red Hat Enterprise Linux (RHEL), the chronyd daemon provided by the chrony package is the default NTP client. Alternatively, the chronyd daemon can be configured as a server to provide accurate time to computer systems in your internal network.

This article explains both configurations so that you can implement these settings with your network devices.

Configure chrony as an NTP client

At installation, RHEL configures the chronyd service with default settings. One of these settings utilizes an NTP.org pool as the source for time. This is a perfectly acceptable configuration for most home users as these are reliable time sources. However, in an enterprise environment that follows security best practices, outbound NTP is probably restricted, so an internal NTP time source is required.

To configure the chronyd daemon to utilize an internal or another NTP source, you need to edit the /etc/chrony.conf file. Once in the file, you will configure one of three different settings for your time source. The two most common options used with chrony to set a time source are server and pool. The server directive allows you to specify a single NTP server as a time source. The pool directive is similar to the server directive, but instead of using a single NTP time source, it allows you to specify a pool of NTP servers. The pool name is expected to resolve to multiple addresses, which could change over time.

The following is an example of a default configuration that syncs the chronyd client to an NTP server listed as ntp.lab.int with the iburst option that allows chronyd to make the first update of the clock sooner:

server ntp.lab.int iburst
driftfile /var/lib/chrony/drift
makestep 1.0 3
rtcsync
keyfile /etc/chrony.keys
leapsectz right/UTC
logdir /var/log/chrony

[ Download the Manage your Linux environment for success eBook to learn ways to streamline your work. ]

After applying the configuration changes, restart the chronyd service and verify it is up and running. Finally, check the NTP sources and confirm that the system clock is synchronized correctly to the upstream time server:

$ sudo systemctl restart chronyd.service

$ systemctl is-active chronyd.service
active

$ chronyc sources
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^* 192.168.50.13                 4   6    17    22    +28us[  +26us] +/-   27ms

$ timedatectl
               Local time: Wed 2022-05-18 12:47:41 EDT
           Universal time: Wed 2022-05-18 16:47:41 UTC
                 RTC time: Wed 2022-05-18 16:47:42
                Time zone: America/New_York (EDT, -0400)
System clock synchronized: yes
              NTP service: active
          RTC in local TZ: no

Configure chrony as an NTP server

One of the best features of the chrony package is the ease with which you can configure an authoritative time server. The first step is to configure the server's own time source, as I showed in the previous section. Once you have configured the time source, you need to configure the allow directive in the chrony.conf file. The allow directive specifies a particular subnet from which NTP clients can access the NTP server. By default, no clients are allowed access, and chronyd operates purely as an NTP client. Therefore, enabling this directive is a requirement for chronyd to act as an NTP server. You can find more information regarding the allow directive in the chrony.conf man pages.

[ Ready to move up? Download RHEL 9 for free through the Red Hat Developer program​​​​​​. ]

The following example configures the allow directive to accept connections from the 192.168.0.0/24 subnet:

server ntp.lab.int iburst
allow 192.168.0.0/24
driftfile /var/lib/chrony/drift
makestep 1.0 3
rtcsync
keyfile /etc/chrony.keys
leapsectz right/UTC
logdir /var/log/chrony

After configuring the time source, adding the allow directive, and restarting the chronyd service, you need to configure firewalld to permit the NTP service:

$ sudo firewall-cmd --add-service=ntp --permanent

$ sudo firewall-cmd --reload

Finally, configure the NTP clients, as shown in the first section.

Wrap up

This article shows how to configure chrony as an NTP client so you can configure your server to utilize a server or a pool-based time source. It also shows how to configure chrony as an authoritative time server to provide accurate time to your NTP clients in your network.