Keep Server Time Accurate with NTP and chrony

A server's clock quietly affects many things: TLS certificate checks, log timestamps, two-factor codes, DNSSEC validation, scheduled jobs and database replication. NTP keeps the clock in sync with accurate time servers. This guide shows how to check and configure time sync on Linux with chrony or systemd-timesyncd.

Before you start

You need root or sudo on a Linux VPS or dedicated server. Containers and some VPS types inherit time from the host and cannot change it themselves.

Why accurate time matters

TLS/HTTPS – a wrong clock makes valid certificates look expired or not yet valid.
Authentication – TOTP 2FA codes and Kerberos fail if clocks drift.
DNSSEC – signatures have validity windows.
Logs and forensics – correlating events across servers needs matching clocks.
Cron and backups – jobs run at the wrong time.

Check the current status

timedatectl

Look for System clock synchronized: yes and NTP service: active.

Option 1: chrony (recommended for servers)

chrony is the default on AlmaLinux and Rocky and handles VMs and intermittent networks well.

Install: sudo dnf install -y chrony or sudo apt install -y chrony (on Ubuntu this replaces systemd-timesyncd).
Check servers in /etc/chrony.conf (RHEL) or /etc/chrony/chrony.conf (Debian/Ubuntu). A typical line:
```
pool pool.ntp.org iburst
```
Enable: sudo systemctl enable --now chronyd (service name chrony on Debian/Ubuntu).
Verify sources and offset:
```
chronyc sources -v
chronyc tracking
```
A ^* marks the source currently used; System time in tracking shows the offset.

If the clock is far off after a long outage, step it immediately with sudo chronyc makestep.

Option 2: systemd-timesyncd

A lightweight SNTP client, default on Ubuntu and Debian. Enable it with:

sudo timedatectl set-ntp true

Set custom servers with NTP= in /etc/systemd/timesyncd.conf, then sudo systemctl restart systemd-timesyncd. It is fine for most single servers; use chrony when you need better accuracy or to serve time to other machines.

Set the timezone

List zones: timedatectl list-timezones.
Set one: sudo timedatectl set-timezone UTC.

Many admins keep servers on UTC so logs from different locations line up; applications can still display local times to users.

Firewall note

NTP clients use outbound UDP port 123. Allow it if you filter outbound traffic. Do not open inbound UDP 123 unless you intentionally run a time server for your network.

Troubleshooting

"System clock synchronized: no": outbound UDP 123 blocked, no NTP service running, or two services fighting – run only one of chrony or timesyncd.
Clock drifts on a VPS: install chrony; if it persists, contact the provider about the host clock.
Certificate errors right after boot: the hardware clock is wrong; after syncing, save it with sudo hwclock --systohc.

FAQ: server time and NTP

What is the difference between NTP and SNTP?

NTP implementations like chrony filter many samples and discipline the clock precisely; SNTP clients like timesyncd are simpler and slightly less accurate.

Should all my servers use the same timezone?

Using UTC everywhere avoids confusion with daylight saving time and makes log comparison easy.

Does shared hosting need NTP configuration?

No. The host keeps the server clock in sync.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket