How to Set Up NTP with chrony on Ubuntu

When a server’s clock drifts, certificate checks can fail and logs from different machines become difficult to compare. chrony keeps the system clock synchronized with NTP (Network Time Protocol) servers and can also provide time to other machines on your network.

This guide explains how to configure chrony on Ubuntu, check synchronization, and set up an NTP server for a local network.

The examples were tested on Ubuntu 26.04.1 LTS with chrony 4.8. You need a user with sudo privileges to install packages and change the configuration.

Quick Reference #

Install and Start chrony #

Ubuntu 25.10 and newer include chrony by default. Earlier Ubuntu releases generally use systemd-timesyncd, a simpler time synchronization client. If chrony is already running, you can skip the installation and go straight to checking its sources.

To install the package, update the package index and run:

sudo apt update
sudo apt install chrony

The package provides two programs: chronyd, the background service that adjusts the clock, and chronyc, the command-line tool for checking and controlling it. When installing chrony replaces systemd-timesyncd, APT removes the conflicting package. Check APT’s proposed changes before confirming the installation.

Enable chrony at boot and start it now:

sudo systemctl enable --now chrony

Check that the service is running:

systemctl is-active chrony

A running service returns:

active

This confirms that the daemon is running. It does not yet tell you whether it has reached a time server or synchronized the clock.

Check Time Synchronization #

Before changing the configuration, see which time sources chrony already uses:

chronyc -N sources

The -N option shows the source names from the configuration instead of looking up hostnames from their IP addresses. On our Ubuntu system, the output was:

MS Name/IP address         Stratum Poll Reach LastRx Last sample
===============================================================================
^* 1.ntp.ubuntu.com              2   6     7     1    +47us[+1998us] +/-   27ms
^- 2.ntp.ubuntu.com              2   6     7     1    +45ms[  +47ms] +/-   79ms
^- 3.ntp.ubuntu.com              2   6     7     2  -3375us[-1424us] +/-   90ms
^- 4.ntp.ubuntu.com              2   6     7     1    +50ms[  +52ms] +/-  145ms
^- ntp-bootstrap.ubuntu.com      2   6     7     1   -192us[+1759us] +/-   29ms

The ^ identifies an NTP server. The character after it tells you how chrony is using that source:

• * - The source currently selected for synchronization.
• + - Another source whose measurements are combined with the selected source.
• - - A source that is usable but is not currently selected.
• ? - A source that is not selectable, for example because it is unreachable or chrony has not collected enough measurements yet.

In this example, chrony selected 1.ntp.ubuntu.com. The Reach value is an octal record of the last eight polling results. It starts small after startup; 377 means replies were received for all eight.

For a summary of the clock’s synchronization state, run:

chronyc -N tracking

Our test system returned:

Reference ID    : B97DBE7A (1.ntp.ubuntu.com)
Stratum         : 3
Ref time (UTC)  : Sun Nov 15 20:46:39 2026
System time     : 0.000168156 seconds fast of NTP time
Last offset     : +0.000450228 seconds
RMS offset      : 0.000450228 seconds
Frequency       : 0.295 ppm fast
Residual freq   : +42.802 ppm
Skew            : 17.226 ppm
Root delay      : 0.051487859 seconds
Root dispersion : 0.000817624 seconds
Update interval : 0.0 seconds
Leap status     : Normal

Reference ID identifies the selected server. System time is the remaining difference between the system clock and chrony’s estimate of NTP time, about 0.17 milliseconds here. It is not a guarantee of absolute accuracy; network delay and the uncertainty reported under Root dispersion also matter.

Leap status: Normal indicates that chrony has synchronized its NTP clock. The system clock may still be catching up if a large correction is being applied gradually. Check System time as well as the status.

You can also check the system-wide state with timedatectl :

timedatectl

Look for System clock synchronized: yes and NTP service: active. These are separate checks: the second means a time service is active, while the first reports whether the system clock is synchronized. Allow some time for the status to change after startup.

Configure Time Servers #

On current Ubuntu releases, chrony’s main settings are in /etc/chrony/chrony.conf, with additional configuration under /etc/chrony/conf.d/ and time sources under /etc/chrony/sources.d/.

The default sources are in /etc/chrony/sources.d/ubuntu-ntp-pools.sources. Ubuntu 26.04 uses these entries:

pool 1.ntp.ubuntu.com iburst maxsources 1 nts prefer
pool 2.ntp.ubuntu.com iburst maxsources 1 nts prefer
pool 3.ntp.ubuntu.com iburst maxsources 1 nts prefer
pool 4.ntp.ubuntu.com iburst maxsources 1 nts prefer
pool ntp-bootstrap.ubuntu.com iburst maxsources 1 nts certset 1

A pool entry can resolve to multiple servers, while a server entry adds a single server address. The iburst option sends a burst of requests when a source first comes online, so the initial synchronization is faster. The nts option enables Network Time Security, which authenticates the time source. The bootstrap entry uses Ubuntu’s supplied certificate configuration to help systems whose initial clock is far off.

If the default sources work for you, there is no need to replace them. To add another source, create a separate file:

sudo nano /etc/chrony/sources.d/custom.sources

For example, to add Cloudflare’s NTS-enabled time service, enter:

server time.cloudflare.com iburst nts

Save the file, then reload the sources without restarting chrony:

sudo chronyc reload sources

A successful reload returns 200 OK. Run chronyc -N sources again to see the new entry. It is added alongside the defaults, and it may not be selected immediately. Ubuntu’s default entries have prefer set, so adding a source does not force chrony to use it.

NTS needs outbound TCP port 4460 for key exchange and UDP port 123 for NTP traffic. To inspect the authentication state, run:

sudo chronyc -N authdata

Look for NTS in the Mode column and nonzero values in KeyID, Type, and KLen after a successful exchange. An NTS entry with zeros in those fields has not completed key exchange yet.

On older Ubuntu releases, the default pool lines may be in /etc/chrony/chrony.conf instead. Changes to that file or to .conf files under conf.d require a service restart:

sudo systemctl restart chrony

Use reload sources for .sources files and a restart for changes to the daemon’s other settings.

Correct a Large Clock Offset #

chrony normally adjusts the clock gradually by making it run slightly faster or slower. Ubuntu’s default makestep 1 3 setting also allows a correction larger than one second to jump the clock during the first three clock updates after chrony starts.

If a running machine still has a large pending correction, you can apply it immediately. First confirm that chrony has selected a source and check the offset with chronyc -N tracking.

To apply the correction chrony has already calculated, run:

sudo chronyc makestep

The command returns 200 OK. It applies the remaining correction; it does not make an unreachable NTP server start responding. Check the offset afterward with chronyc -N tracking.

Serve Time to a Local Network #

chrony does not serve NTP to other machines by default. To enable it, we will use an Ubuntu server at 192.168.1.10 and allow clients on 192.168.1.0/24. Replace these addresses with your server’s address and local subnet.

Before continuing, confirm that the server itself is synchronized using the checks above. Give it a static address or a DHCP reservation so clients can keep finding it.

Configure the Server #

Create a configuration file for the network access rule:

sudo nano /etc/chrony/conf.d/local-network.conf

Add an allow directive for your subnet:

allow 192.168.1.0/24

This permits clients on that subnet to request time. It does not grant remote access to chrony’s administrative commands.

Restart chrony to load the rule:

sudo systemctl restart chrony

If you use UFW , allow incoming NTP requests from the same subnet:

sudo ufw allow from 192.168.1.0/24 to any port 123 proto udp

This rule limits access to your LAN. The server still needs outbound access to its upstream time sources. If another firewall sits between the clients and server, allow the same UDP traffic there too.

Configure a Client #

On another Ubuntu machine with chrony installed, create a source file:

sudo nano /etc/chrony/sources.d/local-server.sources

Point it at your NTP server:

server 192.168.1.10 iburst

Ubuntu’s default entries already use prefer, so adding it here would not rank your server above them. If the client should follow only your server, disable the other sources as shown below. This example uses ordinary NTP within the LAN; the server’s upstream NTS authentication does not provide NTS to its clients.

Reload the client’s sources and check the result:

sudo chronyc reload sources
chronyc -n sources

The -n option keeps addresses numeric, so you can identify your server even if reverse DNS returns a different name. The ^* marker identifies the selected server. In our isolated LAN test, the default Ubuntu servers were not available, so only the local server appears:

MS Name/IP address         Stratum Poll Reach LastRx Last sample
===============================================================================
^* 192.168.1.10                  3   6     7     1   -185us[-9921ns] +/-   28ms

Adding this entry leaves the client’s default sources in place. If the client must use only your internal server, disable the other sources too. On Ubuntu 26.04, rename ubuntu-ntp-pools.sources so its name no longer ends in .sources, review other files in sources.d, and check for server or pool lines in chrony.conf and conf.d. DHCP-provided sources can also be loaded through sourcedir /run/chrony-dhcp; comment out that directive in chrony.conf if you need to exclude them.

Reload the sources after changing .sources files, or restart chrony if you changed .conf files. Check the source list again to confirm that only the intended servers remain.

Back on the NTP server, see which clients have sent requests:

sudo chronyc clients

Our test client appeared with three NTP requests:

Hostname                      NTP   Drop Int IntL Last     Cmd   Drop Int  Last
===============================================================================
192.168.1.20                    3      0   1   -     0       0      0   -     -

The NTP column counts requests received from that client. An entry confirms that requests reached the server; check the client’s selected source as well to confirm that it is using the replies.

Troubleshooting #

Sources show ^? and no server is selected
Wait for the initial measurements, then check DNS resolution and outbound UDP port 123. NTS sources also need outbound TCP port 4460. A Reach value of 0 means chrony has not received valid NTP replies in its recent polling history; a nonzero value with ? can mean it needs more measurements or the source has another selection problem.

The service is active, but the clock is not synchronized
Check chronyc -N tracking for the selected server, Leap status, and remaining System time correction. A running service can still be waiting for a usable source or applying an adjustment. Review recent service messages with:

sudo journalctl -u chrony -n 30 --no-pager

Look for failed name lookups, NTS certificate errors, or messages about unreachable sources. If another time daemon is installed, check that it is not also trying to adjust the clock.

A custom server does not appear after editing a file
Source files under sources.d must end in .sources. Run sudo chronyc reload sources after changing them. For a file under conf.d, use a .conf extension and restart the service instead. On older installations, check that chrony.conf includes the relevant sourcedir or confdir directive.

LAN clients cannot synchronize
Check that the server is synchronized, its allow rule matches the clients’ addresses, and UDP port 123 is reachable. Run sudo chronyc clients on the server to see whether requests arrive. A client’s address may differ from the expected subnet if a router performs NAT.

The clock is off by hours, but NTP is synchronized
Check the time zone. NTP synchronizes the system clock; the time zone determines how local time is displayed. See how to set or change the time zone in Linux .

Conclusion #

Keep the default Ubuntu sources unless you need a different time service or a local NTP server. After changing the configuration, check the selected source and remaining clock offset before relying on the machine to serve time to others.

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 1000+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page