How to Configure Chrony on Fedora Server: Setting Up an Accurate NTP Server for Your Local Network - ITFROMZERO - Share tobe shared! Configure Fedora Server as an internal NTP server using Chrony to keep all workstations and servers accurately synchronized down to the millisecond. This guide covers a rapid 5-minute setup alongside practical tips to maintain accurate time even during Internet outages.

When running a server cluster, database cluster, or simply a fleet of accounting workstations within an office, a discrepancy of just a few seconds on one machine can scramble logs, trigger expired TLS/SSL certificate errors, or instantly break Active Directory/Kerberos authentication transactions. Instead of letting dozens of devices reach out across the Internet to fetch time, deploying a local NTP server is a far more bandwidth-efficient and secure solution.

I have used Fedora as my primary development machine for two years and have been very satisfied with its package update frequency. Even on Fedora Server, Chrony is always selected as the default NTP service replacing the legacy ntpd, thanks to its blazing-fast synchronization and extremely lightweight resource footprint.

Table of Contents

Quick start: Setting Up an NTP Server with Chrony in 5 Minutes

If you need to deploy this right away for a lab or an internal infrastructure, the steps are straightforward:

Step 1: Check and enable chronyd

Fedora Server comes with the chrony package pre-installed. You only need to verify the service status:

systemctl status chronyd
# If it is not running, enable and start it immediately:
sudo systemctl enable --now chronyd

Step 2: Allow the local network to synchronize time

By default, Chrony only acts as a client fetching time from the outside for itself. To turn it into an NTP server for other machines, open the configuration file:

sudo nano /etc/chrony.conf

Find and uncomment (or append to the end of the file) your local network subnet using the allow directive:

# Allow the 192.168.1.0/24 LAN subnet to query time
allow 192.168.1.0/24

# Keep the server serving time even if the Internet drops
local stratum 10

Step 3: Restart the service and open the firewall

Fedora enables firewalld by default. The NTP protocol operates on UDP port 123, so you need to open this port:

sudo systemctl restart chronyd
sudo firewall-cmd --add-service=ntp --permanent
sudo firewall-cmd --reload

Step 4: Quick verification from a client machine

On another Linux machine within the same LAN, install the client tools and try querying the Fedora Server IP (e.g., IP 192.168.1.10):

chronyc -h 192.168.1.10 tracking

If you see detailed Reference ID and Stratum values returned, your NTP server is ready to serve.

Detailed Explanation of the chrony.conf Configuration File

The /etc/chrony.conf file on Fedora contains numerous parameters. Here are the core directives you need to master for custom tuning:

1. Upstream Server Sources (pool/server)

pool 2.fedora.pool.ntp.org iburst

pool: Declares public NTP server pools. If your infrastructure is located in Vietnam or Asia, consider switching to closer pools to minimize latency:

server 0.asia.pool.ntp.org iburst
server 1.asia.pool.ntp.org iburst
server time.google.com iburst

The iburst (initial burst) parameter sends 4 to 8 packets in rapid succession right at startup to calculate clock drift and lock onto an accurate timestamp within seconds.

2. The makestep Parameter

makestep 1.0 3

Standard NTP typically slews the clock gradually to avoid jumping database timestamps. However, if the offset exceeds 1 second, slewing the clock slowly can take hours. The makestep 1.0 3 directive allows Chrony to step the clock immediately if the offset is greater than 1.0 second during the first 3 clock updates after startup.

3. The driftfile Parameter

driftfile /var/lib/chrony/drift

Chrony records the rate at which the server’s hardware crystal gains or loses time into this file. This allows Chrony to maintain highly accurate clock drift compensation even across reboots or temporary network outages.

Advanced: Maintaining Accurate Time During Internet Outages and Stratum Hierarchies

Configuring a Fallback Local Stratum

When international Internet connectivity suffers an outage, the server cannot reach upstream NTP sources. Without a fallback configuration, Chrony stops responding to client queries, leaving all internal workstations without a time reference.

The following directive resolves this issue:

local stratum 10

This line instructs Chrony: “If connectivity to external reference sources is lost, confidently fall back to the local hardware clock to serve time to the LAN at Stratum 10.” Stratum 10 is sufficiently low so that once the Internet recovers, Chrony will automatically lower this flag and transition back to more accurate upstream sources (Stratum 1, 2) without interruption.

Monitoring and Debugging Performance with chronyc

The chronyc command is a powerful CLI utility. Keep these two commands handy for troubleshooting:

# Display time sources and drift offsets
chronyc sources -v

# Display detailed time variance statistics
chronyc sourcestats -v

Key symbols in the M (Mode) column of the chronyc sources output:

^*: The current time source selected for synchronization.
^+: Acceptable candidate source, ready to take over if the current source fails.
^?: Unreachable source or excluded due to excessive offset.

Practical Tips for Operating Chrony in Production LANs

Tip 1: Disable Hypervisor Time Sync When Running Fedora in a VM

If Fedora Server runs on VMware ESXi, Proxmox, or KVM, utilities like VMware Tools or QEMU Guest Agent frequently intervene to synchronize time with the physical host. This causes a “clock fight”: Chrony attempts to slew time according to NTP standards, while the guest agent forces time to match the host.

You should disable the time sync feature in the guest agent or retain only a single reference source:

# For VMware Tools on Linux, disable time synchronization:
vmware-toolbox-cmd timesync disable

Tip 2: Troubleshooting Clients That Refuse to Sync with Fedora Server

If clients report timeouts or fail to sync, check these three common bottlenecks in order:

Firewall rule missing: Run sudo firewall-cmd --list-services on the Fedora Server to verify if ntp is listed.
Subnet range not allowed: Double-check the subnet mask in the allow directive. If your network uses 10.0.0.0/8 or a VLAN like 192.168.10.0/24, that exact subnet must be specified in /etc/chrony.conf.
SELinux blocking custom files or ports: Fedora runs SELinux in Enforcing mode by default. If you change the NTP port or move the drift/log directory to a separate partition, update the SELinux context with semanage fcontext.

Tip 3: One-Liner Script to Check Clock Drift Across Multiple Clients

After deploying your NTP server, you can run a quick one-liner via SSH to audit all internal servers and verify whether they are closely tracking the Fedora server:

for ip in 192.168.1.{20..30}; do
  echo "=== Checking $ip ==="
  ssh -o ConnectTimeout=2 user@$ip "chronyc tracking | grep 'System time'"
done

The optimal clock offset between internal network nodes should stay well below 0.0005 seconds (half a millisecond). With Chrony on Fedora, achieving this level of precision is well within reach without requiring specialized hardware.