Linux online course

Configure a Linux NTP Server and Clients with ntpd

Learn to install and configure ntpd on Debian or Ubuntu, set upstream sources, restrict clients, restart the service, and verify synchronization with ntpq.

Network Time Protocol (NTP) synchronizes system clocks across IP networks. An NTP server has two roles: it obtains time from approved upstream sources, then supplies that time to permitted clients on the local network.

Accurate, consistent time is important for log correlation, authentication protocols, certificate validation, scheduled jobs, monitoring alerts, databases, and distributed services. Even when applications are otherwise healthy, clock differences can make events appear out of order or cause time-sensitive operations to fail.

Understand the NTP time hierarchy

An upstream NTP server is a time source that your server contacts. It may be an Internet service or another time server higher in your organization's hierarchy. An NTP client is a system that obtains time from an NTP server. The legacy Linux daemon that maintains local time and serves clients is called ntpd.

A typical arrangement has several independent upstream sources feeding one internal server. Workstations and application hosts then use the internal server instead of each contacting external sources directly.

Install the ntpd daemon

On an older Debian or Ubuntu-style system, the ntp apt package provides the legacy ntpd implementation, its service definition, and related configuration.

sudo apt-get update
sudo apt-get install ntp

Check the service after installation. The exact status output depends on whether the host uses systemd or a SysV-style service manager.

sudo service ntp status

# On systemd-based systems, this is also useful:
sudo systemctl status ntp
sudo systemctl is-enabled ntp
sudo systemctl is-active ntp

The service should be active or running. If it is not enabled, enable it so it starts during boot:

sudo systemctl enable ntp
sudo systemctl start ntp

On a system that does not provide systemctl, use the distribution's service-management tools instead. Do not run two different time-synchronization daemons against the same clock unless you have deliberately configured that arrangement.

Locate and inspect /etc/ntp.conf

The primary configuration file for ntpd is /etc/ntp.conf. Make a backup before editing it:

sudo cp /etc/ntp.conf /etc/ntp.conf.bak

Open the file with an editor:

sudo editor /etc/ntp.conf

The important parts of the file are upstream source entries and access-control rules. Upstream entries tell the daemon where to obtain time. restrict directives determine which addresses may query or use the service and what operations they may perform.

Configure reliable upstream sources

Review the existing server or pool lines. Keep several independent sources so ntpd can compare them and continue operating if one source is unavailable. For example:

server 0.pool.ntp.org iburst
server 1.pool.ntp.org iburst
server 2.pool.ntp.org iburst
server 3.pool.ntp.org iburst

Alternatively, use organization-approved names or addresses:

server ntp-a.example.net iburst
server ntp-b.example.net iburst
server ntp-c.example.net iburst

The names above are examples. Replace them with time sources approved for your environment. Confirm that DNS and network access to those sources work from the server.

After starting or changing ntpd, allow time for measurements and source selection. The internal server should first become synchronized with a valid upstream source before clients depend on it.

Restrict access to a trusted LAN

A restrict directive applies permissions or limitations to an IPv4 address or network. This example permits clients in the private 192.168.198.0/24 network to query and synchronize with the server:

restrict 192.168.198.0 mask 255.255.255.0 nomodify notrap

The address and mask describe a subnet boundary. The mask 255.255.255.0 is equivalent to /24: the first three octets identify the network, and the final octet identifies a host. Therefore, this example covers addresses from 192.168.198.0 through 192.168.198.255. The network and broadcast addresses are normally not assigned to clients.

nomodify prevents remote clients from changing daemon settings through NTP control requests. notrap disables legacy NTP control-message trap services. Ordinary clients still need to make normal time queries and receive synchronization responses; those activities are distinct from administrative modification and trap functions.

Keep the distribution's loopback and default restrictions unless you understand why they are being changed. A configuration might contain rules similar to these, followed by the trusted LAN rule:

restrict default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery
restrict 127.0.0.1
restrict -6 ::1
restrict 192.168.198.0 mask 255.255.255.0 nomodify notrap

Exact defaults vary between package versions. Review how more-specific network rules interact with general rules on your system. Allow only internal ranges that genuinely need the service. Also restrict UDP port 123 in host and network firewalls so that only approved clients can reach the server, and so that the server can reach its approved upstream sources.

Apply the configuration

After saving /etc/ntp.conf, reload or restart the service. A reload is often sufficient for configuration changes:

sudo service ntp reload

If reload is unsupported or the daemon needs a full restart, use:

sudo service ntp restart

On systemd-based systems, the equivalent commands are:

sudo systemctl reload ntp
# If reload is unavailable or insufficient:
sudo systemctl restart ntp

Check status after applying the change:

sudo service ntp status
sudo journalctl -u ntp --no-pager

Service-management syntax varies between SysV-style systems and systemd. Use the command family supported by the host.

Configure NTP clients

Each client must point to the internal server's reachable IP address or hostname. On a legacy ntpd client, edit its /etc/ntp.conf and add the internal source. Remove or comment out unwanted public sources if the client should use only the internal hierarchy.

server 192.168.198.10 iburst

Here, 192.168.198.10 represents the internal NTP server. Replace it with the server's actual address or a resolvable internal hostname. The client must be able to route to that address, and firewalls must permit UDP port 123 in the required direction.

sudo cp /etc/ntp.conf /etc/ntp.conf.bak
sudo editor /etc/ntp.conf
sudo service ntp reload
sudo service ntp status

If reload does not apply the client change, restart the service:

sudo service ntp restart

For a systemd-based client, use sudo systemctl reload ntp or sudo systemctl restart ntp as appropriate. Ensure that another time service is not simultaneously managing the client clock.

Verify synchronization with ntpq

ntpq queries ntpd and displays peer information. Run it first on the server:

sudo ntpq -p

Then run it on a client:

sudo ntpq -p

A typical peer list looks like this:

     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
*ntp-a.example.net  .GPS.        1 u   42   64   377    12.4    -0.31   0.18
+ntp-b.example.net  .GPS.        1 u   39   64   377    14.1     0.22   0.24
-ntp-c.example.net  .GPS.        1 u   40   64   377    18.7     1.10   0.51

The character at the beginning of a peer row indicates its state. An asterisk (*) identifies the currently selected synchronization source. A plus sign (+) identifies a usable candidate, while a minus sign (-) identifies a source that is not currently preferred. The exact peer set and columns vary, but a selected source is the key indicator.

Verification is hierarchical: first confirm that the server has selected a valid upstream source. Only then interpret a client's selected peer. On the client, the selected row should correspond to the internal server's address or hostname.

Server and client responsibilities

Troubleshoot common problems

Clients cannot synchronize

• Confirm the client uses the correct server IP address or hostname in /etc/ntp.conf.
• Confirm UDP port 123 is permitted by both host and network firewalls.
• Confirm the client's address belongs to a network allowed by a restrict rule.
• Confirm ntp is running on both the server and client.
• Run ntpq -p on the server. A client cannot obtain dependable time from a server that has not selected an upstream source.

The server has no reliable time source

• Inspect the server's peer list and look for a selected upstream row marked with *.
• Review the server and pool entries in /etc/ntp.conf.
• Check DNS resolution and network connectivity to upstream sources.
• Wait for initial synchronization after installation, a restart, or a source change.

Configuration changes have no effect

• Verify that the edit was made to /etc/ntp.conf.
• Reload or restart the ntp service.
• Review service status and logs for syntax or startup errors.
• Check that another time-synchronization implementation is not competing with ntpd.

The client selects an unexpected source

• Run ntpq -p on the client and inspect the row marked with *.
• Remove or deprioritize sources that should not be used.
• Confirm the intended internal server is reachable and synchronized.
• Check that the internal server's restriction and firewall rules permit this client.

Exam-relevant points

• NTP synchronizes clocks over IP networks; ntpd is the legacy daemon that maintains local time and can serve clients.
• /etc/ntp.conf contains upstream source and access-control configuration.
• restrict controls permissions for addresses or networks. nomodify blocks remote administrative modification, and notrap blocks legacy trap services.
• 255.255.255.0 is a /24 mask. In the example, 192.168.198.0/24 covers the 192.168.198.0 through 192.168.198.255 address range.
• NTP uses UDP port 123.
• An asterisk (*) in ntpq -p identifies the selected synchronization source.
• Validate the hierarchy in order: synchronize the server from upstream sources, then synchronize clients from the server.