Sync System Time with Chrony for Skew-Sensitive Work
Install chrony, point it at a nearby NTP source, and verify the clock skew stays under 50 milliseconds so certificate and log timestamps stay trustworthy.
Task
Keep system clock skew under 50 milliseconds so TLS certificate validation and log correlation do not break.
When to use this
A service rejects tokens with "not before" in the future because its clock is 200 ms ahead of the auth server. Logs across hosts are impossible to correlate because every clock reads differently. The team needs a single, accurate time source.
Prerequisites
- A Linux host with chrony available in the package manager
- The address of a reachable NTP server or pool
- Permission to restart the time service
Steps
1. Install chrony and replace the default config with one that points at your NTP source.
apt-get install -y chrony
cat > /etc/chrony/chrony.conf <<EOF
server ntp.example.com iburst
makestep 1.0 3
rtcsync
EOF
Expected output: chronyd starts and the config contains only the chosen server, the makestep directive, and rtcsync.
2. Restart the service and wait for it to select the source and sync.
systemctl restart chronyd && chronyc waitsync 60Expected output: chronyc sources shows one source with ^* (selected), and waitsync returns within the timeout.
3. Verify the skew is under 50 milliseconds and track it as a metric.
chronyc tracking | grep "System time"Expected output: The reported system time offset is below 0.05 seconds, and the metric is exported for alerting.
Troubleshooting
Problem
chrony cannot reach the NTP server
Solution
Check the firewall for UDP 123 and fall back to a local NTP relay; a host with no time source drifts quickly.
Problem
The clock jumps backward after makestep
Solution
Limit makestep to the first few samples on boot; in steady state, chrony slews the clock instead of stepping, so monotonic time is preserved.
Limitations
- chrony corrects the system clock but not the hardware RTC until rtcsync runs; reboot with a dead CMOS battery still drifts.
- A host behind a restrictive firewall may need a local NTP relay rather than a public pool.
One source, one truth
Pick a single NTP source for every host in the fleet. Different sources drift differently, so mixing them reintroduces the skew you are trying to remove. Chrony slews the clock gently, so timestamps stay monotonic.
server ntp.example.com iburst
makestep 1.0 3
rtcsyncVerify and alert
chronyc tracking reports the current offset. Export it as a metric and alert above 50 milliseconds. A host that drifts past the threshold is a certificate-validation incident waiting to happen.
chronyc tracking | grep "System time"Expected outcome
Every host selects the same source, the offset stays under 50 milliseconds, and the metric alerts before skew breaks tokens or log correlation. makestep runs only on boot, so the clock never jumps backward in steady state.