How to Configure Network Time Synchronization with Chrony

Accurate system time is essential on Linux servers. Authentication tokens, TLS certificates, scheduled jobs, database records, firewall logs, and monitoring alerts can all become unreliable when a machine clock drifts. On RHEL, CentOS, and Fedora, chrony is the standard tool for keeping time aligned with trusted Network Time Protocol (NTP) sources.

Chrony is designed for modern systems, including virtual machines, laptops that disconnect from networks, and servers with intermittent connectivity. It usually synchronises faster than older NTP implementations and can estimate clock drift so that time remains stable between updates.

Australian administrators may need to account for Australian Eastern, Central, and Western time zones, along with daylight saving in New South Wales, Victoria, Tasmania, South Australia, and the Australian Capital Territory. Time synchronisation itself should use UTC; the local time zone controls how that time is displayed.

The following procedure works well for a fresh server in Sydney, Melbourne, Brisbane, Perth, or an on-premises environment connected through an NBN business service. It covers installation, configuration, firewall access, verification, and basic troubleshooting.

Install Chrony On RHEL-Based Systems

Check whether chrony is already installed:

rpm -q chrony

Install it with DNF on current RHEL, CentOS Stream, and Fedora systems:

sudo dnf install -y chrony

On older CentOS releases that use YUM, run:

sudo yum install -y chrony

Enable the service at boot and start it immediately:

sudo systemctl enable --now chronyd

Confirm that the daemon is running:

systemctl status chronyd

A healthy service should show active (running). If the package is unavailable, verify repository configuration and check that DNS can resolve external NTP hostnames.

Configure Reliable Time Sources

The main configuration file is /etc/chrony.conf. Before editing it, create a backup:

sudo cp /etc/chrony.conf /etc/chrony.conf.backup

Open the file with a text editor and define suitable sources. Australian systems can use the regional NTP pool:

pool au.pool.ntp.org iburst
makestep 1.0 3
rtcsync

The iburst option speeds up the first synchronisation. makestep 1.0 3 permits a large correction during the first three updates, which is useful after installation or a long outage. rtcsync periodically copies the synchronised system time to the hardware clock.

For production servers, an organisation may provide internal NTP servers instead:

server ntp1.example.com iburst
server ntp2.example.com iburst

Internal sources reduce dependence on public services and make auditing easier. Keep at least two reliable sources where possible. General Linux administration references, including project resources, can also help when documenting a repeatable server build.

Set The Correct Australian Time Zone

Set the system time zone with timedatectl. For Sydney or Melbourne, use:

sudo timedatectl set-timezone Australia/Sydney

For Brisbane:

sudo timedatectl set-timezone Australia/Brisbane

For Adelaide and Perth, use Australia/Adelaide and Australia/Perth respectively. Verify the result:

timedatectl

The output should show the selected zone and indicate whether the system clock is synchronised. Brisbane does not observe daylight saving, while Sydney and Melbourne switch between standard time and daylight time. The time zone database handles those changes automatically, so administrators should avoid manually changing clocks twice a year.

Keep servers on the correct local zone for operational clarity, but remember that logs and applications often store timestamps in UTC. This is especially important for teams working across Perth, Brisbane, and the eastern states.

Allow NTP Through The Firewall

Chrony uses UDP port 123 for NTP traffic. If the server runs firewalld, permit the service permanently:

sudo firewall-cmd --permanent --add-service=ntp
sudo firewall-cmd --reload

Check the active rules:

sudo firewall-cmd --list-services

A client that only contacts upstream time servers needs outbound UDP/123 access. A server acting as an NTP source for other hosts also needs inbound access. Avoid opening the port to the whole internet unless there is a specific operational reason.

If the host is behind a cloud security group, hardware firewall, or managed Australian data-centre network, that control must allow UDP/123 as well. Network filtering at more than one layer is common in hosted environments.

Verify Synchronisation And Correct Drift

Use chronyc tracking to inspect the current clock state:

chronyc tracking

Important fields include Reference ID, Stratum, System time, Last offset, and Leap status. A small system-time offset and a valid reference indicate normal operation.

List the configured sources and their status:

chronyc sources -v

A source marked with ^* is currently selected, while ^+ identifies another acceptable source. The reach value should become non-zero after successful polling. To view source performance and measurements, run:

chronyc sourcestats -v

If the system clock is badly wrong, force an immediate correction:

sudo chronyc makestep

Then review the tracking output again. Significant clock changes can affect running applications, so use this command carefully on databases and high-traffic production systems.

Troubleshoot Persistent Time Problems

When synchronisation fails, begin with service and name-resolution checks:

systemctl is-active chronyd
getent hosts au.pool.ntp.org
chronyc activity

Review recent service messages:

sudo journalctl -u chronyd --since "30 minutes ago"

Common causes include blocked UDP/123 traffic, incorrect DNS, invalid server names, virtualisation time policies, and a host with no route to the internet. A virtual machine should generally use one authoritative time strategy rather than competing guest and hypervisor corrections.

Check the configuration for syntax errors and confirm that the selected sources are reachable. If root access is unavailable because of an administrative mistake, the guide on resetting a forgotten root password covers a related recovery task.

Accurate timestamps also support security investigations and compliance work. Under the Australian Privacy Act 1988, organisations handling personal information need dependable records for access, incidents, and system activity, although exact retention obligations vary by sector. A synchronised clock helps ensure those records can be compared across systems.

After configuration, confirm that chronyd starts automatically, that at least one source is selected, and that firewall rules permit the required traffic. The practical baseline is simple: install the service, use trusted regional or internal NTP sources, set the correct Australian time zone, and verify synchronisation with chronyc tracking and chronyc sources -v.