In Part 1, we discussed setting up Chrony from a client perspective. This post will show how to configure the server side and investigate some of the options available within the /etc/chrony.conf configuration file.

Server Setup

Install the Chrony package

# dnf install chrony

Enable and start the chrony daemon

# systemctl enable chronyd
# systemctl start chronyd

Verify that NTP is working correctly as a client

# chronyc sources
210 Number of sources = 4
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^+ voipmonitor.wci.com           2   6    17     1  -2428us[-3365us] +/-   85ms
^* clock.trit.net                2   6    17     1   -362us[-1299us] +/-   94ms
^- radio-sunshine.org            2   6    17     1  -5644us[-5644us] +/-  177ms
^* time.cloudflare.com           2   6    17     0    +12ms[  +12ms] +/-  205ms

Allow for Client connections

By default, chronyd acts only as a client and doesn’t allow any remote connections. To change the daemon to act as a server, the allow directive must be added to the /etc/chrony.conf file. You can specify a single ip address or an entire subnet, each added per line. In my case, I have 3 subnets and a local server. There is also a deny directive which I will use to block access from a separate range.

# vi /etc/chrony.confg

allow 10.10.10.5
allow 10.10.30.0/24
allow 10.10.40.0/24
allow 10.10.75.0/24
deny 192.168.150.0/24

Restart chronyd and verify the NTP sources are available

# systemctl restart chronyd

# chronyc sources
210 Number of sources = 4
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^+ voipmonitor.wci.com           2   6    17     1  -2428us[-3365us] +/-   85ms
^* clock.trit.net                2   6    17     1   -362us[-1299us] +/-   94ms
^- radio-sunshine.org            2   6    17     1  -5644us[-5644us] +/-  177ms
^* time.cloudflare.com           2   6    17     0    +12ms[  +12ms] +/-  205ms

Edit the firewall rules to allow client connections through the default NTP port 123 and reload

# firewall-cmd --permanent --zone=public --add-port=123/udp
# firewall-cmd --reload

Now if your clients are configured to point to your new NTP server, you can see them listed using the clients option from chronyc.

# chronyc clients
Hostname                      NTP   Drop Int IntL Last     Cmd   Drop Int  Last
===============================================================================
localhost                       4      0   2   -   119      14      0  -1     6    
client.networklogician.com     17      0   5   -    18       0      0   -     -

Finally, lets review a few of the options available for use within the /etc/chrony.conf configuration file.

# Run the server on a differnet port number than the default 123. For example, running the server on port 11223

port 11223

(from the client /etc/chrony.conf, you would need to specify this new port when pointing to the NTP server)

server t1.networklogician.com port 11223

# Log the drift changes to the system clock over time.

driftfile /var/lib/chrony/drift

# State the directory for logging measurements.
 
dumpdir /var/lib/chrony

# Log measurements when chronyd exits.
 
dumponexit

# Turn on hardware timestamping if the interface in question support it.

hwtimestamp

# NTP authentication uses the keys in this file.

keyfile /etc/chrony.keys

# Use an isolated local NTP server that does not sync.

local stratum 10

# Set logging perimeters such as measurements, statistics, and tracking.

log measurements statistics tracking

# Set the directory for log files.

logdir /var/log/chrony

# In this example, chronyd will check the offset on each update and ignore two adjustments larger  
# than 300 seconds and then exit on the next one.

makestep 300 1 2

# State the amount of offset corrected on a clock update.

maxchange 300 

# Set the range to determine if an estimates is unreliable. 
 
maxupdateskew 100

# This option sets the smallest number of sources that should be potentially available
# before updating the local clock. The below example is set to 2 sources.  

minsources 2

# Do not log client activity.

noclientlog

# Set the amount of distance to add to sources that are not at presently chosen.

reselectdist

# stratumweight – set the distance to add for each stratum when chronyd picks from possible
# sources. In the example below, the stratumweight is set to 2 milliseconds.

stratumweight 2

# rtcfile – this option sets the file name for chronyd to log the tracking of the real-time clock (RTC).
# In the example below, the rtcfile is /var/lib/chrony/rtc

rtcfile /var/lib/chrony/rtc

# Sync the real-time clock (RTC) with the kernel. Don’t use this option with the rtcfile option above.

rtcsync

In Part 3, we will discuss the steps to setup ID-key pairs for symmetric authentication between the clients and server.