Chrony | Manual Time & Date Configuration (NTP Offline)

Chrony

timedatectl status

apt install chrony
systemctl status chrony
systemctl restart chrony

Configuration file – /etc/chrony/chrony.conf

# Use Debian vendor zone.
pool 2.debian.pool.ntp.org iburst

# # # #  # You can set a certain server # # # # # 
#server 0.ru.pool.ntp.org iburst
#server 1.ru.pool.ntp.org iburst

# Allow access from a specific subnet
#allow 192.168.1.0/24

# Serve time even without internet access (Stratum 10)
local stratum 10

# # # # # # # # # # # # # # # # # # # # # # # # #

# Use time sources from DHCP.
#sourcedir /run/chrony-dhcp

# Use NTP sources found in /etc/chrony/sources.d.
sourcedir /etc/chrony/sources.d

# This directive specifies the location of the file containing ID/key pairs for
# NTP authentication.
keyfile /etc/chrony/chrony.keys

# This directive specifies the file into which chronyd will store the rate
# information.
driftfile /var/lib/chrony/chrony.drift

# Save NTS keys and cookies.
ntsdumpdir /var/lib/chrony

# Uncomment the following line to turn logging on.
#log tracking measurements statistics

# Log files location.
logdir /var/log/chrony

# Stop bad estimates upsetting machine clock.
maxupdateskew 100.0

# This directive enables kernel synchronisation (every 11 minutes) of the
# real-time clock. Note that it can't be used along with the 'rtcfile' directive.
rtcsync

# Step the system clock instead of slewing it if the adjustment is larger than
# one second, but only in the first three clock updates.
makestep 1 3

# Get TAI-UTC offset and leap seconds from the system tz database.
# This directive must be commented out when using time sources serving
# leap-smeared time.
leapseclist /usr/share/zoneinfo/leap-seconds.list

# Include configuration files found in /etc/chrony/conf.d.
confdir /etc/chrony/conf.d

Most Frequently Used Commands

• chronyc tracking
  • Purpose: Check if the system clock is synchronized, see the current time error (offset), and system leap status.
  • Когда использовать: Самая первая команда для проверки — идут ли часы правильно и синхронизировано ли время прямо сейчас.

• chronyc sources -v
  • Purpose: List all time servers with their current connection status, stratum levels, and measurement metrics.
  • Когда использовать: Проверить, до каких серверов chrony смог достучаться по сети, а какие лежат или заблокированы.

• chronyc sourcestats -v
  • Purpose: Show stability and frequency drift statistics for each configured time source.
  • Когда использовать: Понять, насколько качественный и стабильный сервер времени вы используете (высокий дрейф частоты говорит о плохой связи).

• sudo chronyc makestep
  • Purpose: Force an immediate time synchronization by stepping the system clock, ignoring the configured safe limits.
  • Когда использовать: Когда время сильно сбилось (например, после перезагрузки или простоя виртуалки) и нужно выровнять его прямо сейчас, не дожидаясь плавной подгонки.

• chronyc clients
  • Purpose: Display a report of all client machines (IP addresses) that are currently synchronized with this server.
  • Когда использовать: Когда ваш сервер сам раздает время в локальной сети, и вам нужно проверить, подключились ли к нему рабочие станции и Windows-клиенты.

• chronyc ntsdata
  • Purpose: Check the status of Network Time Security (NTS) connections, including established keys and cookies.
  • Когда использовать: Проверить, работает ли современное шифрование времени с внешними серверами (например, Cloudflare/Netnod).

System Clock & Verification

• chronyc tracking — Displays system time accuracy, error rate, and current offset.
• chronyc sources -v — Shows detailed status and connectivity of all time sources.
• chronyc sourcestats -v — Displays drift rate and stability stats for each source.
• chronyc ntsdata — Shows active Network Time Security (NTS) session status.
• chronyc makestep — Forces an immediate clock correction by stepping the time.

NTP Source Management

• chronyc activity — Reports how many NTP sources are currently online or offline.
• chronyc ntpdata <IP> — Displays detailed statistics of the last measurement from a specific server.
• sudo chronyc add server <Name> [options] — Adds a new NTP server dynamically on the fly.
• sudo chronyc delete <IP> — Removes an NTP server or peer from the active polling list.
• sudo chronyc refresh — Refreshes IP addresses of sources defined by domain names.
• sudo chronyc reload sources — Forces chrony to re-read modern *.sources configuration files.

Server & Client Control

• sudo chronyc allow <Subnet> — Permits a specific subnet to query this server for time.
• sudo chronyc deny <Subnet> — Blocks a specific subnet from accessing this time server.
• chronyc clients — Generates a report of all clients that have accessed this NTP server.
• chronyc serverstats — Shows packet statistics for the time server operation.

Security & Keys

• chronyc authdata — Displays authentication information (KeyID and NTS state) for sources.
• sudo chronyc keygen <ID> <Type> <Bits> — Generates a new cryptographic key for symmetric authentication.

Manual Time & RTC

• sudo chronyc settime <Time> — Sets the daemon time manually (e.g., “16:30:05”) when offline.
• chronyc rtcdata — Prints current Real-Time Clock (hardware clock) performance parameters.
• sudo chronyc trimrtc — Corrects the hardware clock relative to the accurate system time.

Manual Time & Date Configuration (NTP Offline)

• Core Difference: timedatectl vs date
  • timedatectl (Modern): Manages everything at once. Automatically syncs system time with the hardware clock (BIOS), pauses conflicting time services, and controls time zones. Use it as the main tool on modern systems.
  • date (Classic): Changes time only in RAM. It is fast and universal but knows nothing about the BIOS or background time services. If you use it, you must manually sync with the BIOS using hwclock.

• sudo chronyc manual on
  • Prepares chrony for manual overrides (prevents it from reverting your changes).

• sudo timedatectl set-time "2026-06-25 15:45:00"
  • Sets both date and time simultaneously (Format: YYYY-MM-DD HH:MM:SS).

• sudo timedatectl set-time "2026-06-25"
  • Sets the date only (resets the clock to midnight 00:00:00).

• sudo timedatectl set-time "15:45:00"
  • Sets the time only (keeps the current date).

• sudo timedatectl set-timezone America/Los_Angeles
  • Changes the system time zone (updates the clock offset instantly).

• timedatectl list-timezones
  • Lists all available time zones for the system.

• timedatectl status
  • Verifies the final system time, time zone, and NTP status.

• sudo chronyc manual on
  • Prepares chrony for manual overrides.

• sudo date -s "+5 minutes"
  • Quickly shifts the current system time forward by 6 minutes.

• sudo date -s "+10 days"
  • Shifts the calendar forward by 10 days.

• sudo date -s "+1 month"
  • Shifts the calendar forward by 1 month.

• sudo date -s "-5 days"
  • Shifts the calendar backward by 5 days.
• sudo date -s "2026-06-25"
  • Sets the date only using a standard string.

• sudo date -s "15:45:00"
  • Sets the time only using a standard string.

• sudo date 062515452026.00
  • Sets both date and time at once (Strict format: MMDDhhmmYYYY.ss).

• sudo hwclock --systohc
  • CRITICAL STEP: Manually saves the RAM time into the physical BIOS/RTC chip.

• sudo chronyc manual off
  • Disables manual mode (run this when internet/NTP connectivity returns).

• Stratum 0 — Atomic clocks, GPS, GLONASS (the time source itself).
• Stratum 1 — Servers directly connected to a Stratum 0 device.
• Stratum 2–4 — Public internet time servers and enterprise servers.
• Stratum 10 — Standard fallback level (Local Clock) if the internet drops.
• Stratum 16 — Synchronisation lost / Unsynchronized (clients will reject it).

• Stratum 0 (Reference Clock): High-precision timekeeping devices, such as atomic (cesium) clocks, GPS/GLONASS receivers, or rubidium frequency standards. They are not directly connected to the network.
• Stratum 1 (Primary Servers): Servers directly attached via cable (COM port, PPS, or a dedicated card) to a Stratum 0 device. They offer near-perfect accuracy.
• Stratum 2 (Secondary Servers): Internet servers (such as pool.ntp.org) that sync with Stratum 1 servers over the network. Due to network jitter, accuracy is slightly lower but still measured in milliseconds.
• Stratum 3 and below: Clients of Stratum 2 servers that distribute time further down the chain. Each network “hop” increases the Stratum level by 1.
• Stratum 16 (Unsynchronized): A special value meaning “Time is not synchronized”. If a client detects Stratum 16, it will reject the server as untrusted.

Why exactly do we use local stratum 10?

When your server has internet access, it syncs with a Stratum 2 pool and acts as a Stratum 3 server for your local virtual machines.
The local stratum 10 parameter is a fallback plan for network outages. It tells the system:

“If connection to the outside world is lost, do not panic and do not switch to Stratum 16. Keep serving your internal clock, but announce to clients that your accuracy level has dropped to 10.”

• Low priority (while internet is up): The number 10 is intentionally high. As long as the server accesses the internet and operates at Stratum 3, the fallback local stratum 10 rule remains dormant.
• Local network stability: The number 10 is strictly less than 16. Your VMs and routers will keep accepting time from Proxmox even during a week-long internet outage. Clocks within your local infrastructure will remain perfectly synchronized with each other, preventing database and log errors.

Firewall rule: