​

NTP Time Synchronization

​

Prerequisites

• Linux host with root/sudo access
• Enterprise NTP servers or domain controllers providing time
• Firewall allows UDP port 123 outbound
• Network connectivity to NTP sources

​

Installation and Configuration

​

1. Install Time Synchronization Service

sudo apt update
sudo apt install -y chrony

sudo dnf install -y chrony

chronyd -v

sudo apt install -y ntp  # Debian/Ubuntu
sudo dnf install -y ntp  # RHEL/CentOS

​

2. Configure Time Sources

• Debian/Ubuntu: /etc/chrony/chrony.conf
• RHEL/CentOS: /etc/chrony.conf

sudo nano /etc/chrony/chrony.conf

# For Active Directory environments, prefer domain controllers:
server dc1.company.com iburst
server dc2.company.com iburst

# Or use enterprise NTP servers:
server ntp1.company.com iburst
server ntp2.company.com iburst

# For AD, set minimal sources to 2:
# minsources 2

# Allow large initial time corrections:
makestep 1.0 3

# Drift file (tracks clock frequency):
driftfile /var/lib/chrony/chrony.drift

# Log directory:
logdir /var/log/chrony

• server … iburst — Speeds up initial synchronization
• makestep 1.0 3 — Allows step (immediate) corrections if offset >1 second, up to 3 times
• driftfile — Saves clock frequency for faster sync after restart
• logdir — Where chrony logs are stored

​

3. Enable and Start Chrony

sudo systemctl enable --now chronyd
systemctl is-active chronyd
systemctl is-enabled chronyd

​

4. Validate Synchronization

chronyc tracking

Reference ID    : 192.168.1.10 (ntp1.company.com)
Stratum         : 3
System time     : 0.000123 seconds slow of NTP time
Last offset     : -0.000045 seconds
RMS offset      : 0.000123 seconds

• Reference ID: Your NTP server
• Stratum: Lower is better (1-4 typical)
• System time offset: Should be within milliseconds (< 0.1 seconds)

chronyc sources -v

  .-- Source mode  '^' = server, '=' = peer
 / .- Source state '*' = current best, '+' = combined, '-' = not combined,
| /             '?' = unreachable, 'x' = time may be in error
||
|| MS Name/IP address         Stratum Poll Reach LastRx Last sample
|| ===============================================================================
^* ntp1.company.com                 2   6   377    25   -123us[ -156us] +/-   12ms
^+ ntp2.company.com                 2   6   377    26   +234us[ +201us] +/-   15ms

• * (asterisk) — Current best source (should have at least one)
• Reach — Should be 377 (all recent polls successful)
• Last sample — Time offset in microseconds/milliseconds

​

5. Align SafeSquid Authentication

# Check local time:
date

# Check DC time (if accessible):
net time \\DC1.company.com /set /yes

ntpdate -q dc1.company.com

​

Verify NTP is Working

​

Check Synchronization Status

chronyc tracking

• Reference ID: Shows your NTP server (not 0.0.0.0)
• System time offset: < 0.1 seconds
• Stratum: 2-4 (depending on your NTP server)

​

View Source Statistics

chronyc sourcestats -v

​

Monitor Logs

# Check recent sync events:
sudo journalctl -u chronyd -n 50

# Or check chrony log:
sudo tail -f /var/log/chrony/tracking.log

Selected source 192.168.1.10
System time wrong by 0.123 seconds
Clock was stepped

​

Troubleshooting

1. Test NTP server connectivity:
   ntpdate -q ntp1.company.com
   
   Should show offset.
2. Check chrony configuration:
   chronyc sources
   chronyc tracking
   
3. Force time sync:
   sudo chronyd -q 'server ntp1.company.com iburst'
   sudo systemctl restart chronyd
   
4. Check logs:
   sudo journalctl -u chronyd -n 50
   

​

Production Best Practices

1. Use at least 3 NTP sources for redundancy:
   server ntp1.company.com iburst
   server ntp2.company.com iburst
   server ntp3.company.com iburst
   
2. For Active Directory, prefer domain controllers:
   server dc1.company.com iburst prefer
   server dc2.company.com iburst
   
3. Monitor time drift with Monit: Add to /etc/monit/conf.d/chrony:
   check process chronyd matching chronyd
     start program = "/bin/systemctl start chronyd"
     stop program = "/bin/systemctl stop chronyd"
   
4. Alert on large offsets:
   • Configure monitoring to alert if offset >1 second
   • Investigate VM host time sync conflicts
   • Check for network latency to NTP servers

​

Source register

​

Next Steps

1. Monit — Monitor chronyd and auto-restart if needed
2. BIND — DNSSEC validation requires accurate time
3. Authentication — Configure SSO/Kerberos (requires NTP)
4. SSL Inspection — TLS certificate validation requires accurate time