EMZETT.
Login

Emzett Wiki

Time synchronisation with NTP and chrony: Why the clock must be right

Properties1
tagsglossar, linux, netzwerk

2 min read

Time synchronisation with NTP and chrony: Why the clock must be right

In short: A wrong system time breaks TLS certificates, logs, 2FA codes, Kerberos and backups; NTP services such as chrony or systemd-timesyncd keep the clock accurate over the network.

In more detail: Computer clocks drift (seconds per day). Many procedures need common time: TLS certificates (validity window), TOTP codes (30-second window), Kerberos (max. 5 minutes deviation), JWT expiry, log correlation, cron, database replication, blockchain/signatures.

In Depth

NTP in brief

The Network Time Protocol fetches time from time servers (stratum 1: atomic clock/GPS; stratum 2 …), estimates delay and offset and adjusts the clock gently (slew) or with a jump for large deviation. Public pools: pool.ntp.org, de.pool.ntp.org, PTB (ptbtime1.ptb.de), providers (Cloudflare, Google). PTP delivers microseconds on the LAN (industry), NTS secures NTP cryptographically.

Linux

  • systemd-timesyncd: lean SNTP client (default on many desktops): timedatectl status, timedatectl set-ntp true.
  • chrony: accurate, fast, good with changing networks/VMs; chronyc tracking, chronyc sources -v, configuration /etc/chrony/chrony.conf (pool de.pool.ntp.org iburst).
  • ntpd: classic. Time zone: timedatectl set-timezone Europe/Berlin. Hardware clock (RTC): hwclock; dual boot with Windows: RTC as UTC (timedatectl set-local-rtc 0) or adjust the Windows registry.

Windows, macOS, routers

  • Windows: Settings → Time & language → Sync now; w32tm /query /status, w32tm /resync; domain computers get time from the domain controller.
  • macOS: Date & Time → automatic (time.apple.com).
  • Routers/Fritz!Box and IoT use NTP; smart devices with wrong time report certificate errors.
  • Containers/VMs inherit host time (Docker), VMs need guest time sync (chrony in the guest or hypervisor service).

Troubleshooting and tips

  • Certificate errors/“connection not private”: check the date first.
  • 2FA code invalid: check the clock of phone/server.
  • Firewall: allow UDP 123 (outbound).
  • Own NTP server in home network/company (chrony allow 192.168.0.0/24) for sealed-off networks.
  • Daylight saving/time zones: store internal time in UTC, convert only for display; databases timestamptz.
  • Leap seconds are smeared (Google/Cloudflare) or inserted: build applications robust against jumps (monotonic clock for measurements).

See also: Time zones and calendar pitfalls, ERR_CERT_DATE_INVALID, TOTP and WebAuthn, Vector clocks and logical time

Backlinks