Clock drift causes failures that are genuinely confusing to debug: TLS certificate validation failures (certs have exact validity windows), Kerberos authentication rejecting requests outside a tight time skew, cluster quorum systems (including corosync, the same one behind Proxmox clustering) behaving erratically, and log timestamps across servers that don’t line up during an incident investigation. chrony is the modern NTP client/server most current distros ship by default, replacing the older ntpd.
This guide checks and fixes time sync on a single server, then sets up a local chrony server so other machines on an isolated network (or a Proxmox cluster) can sync against it without needing internet access.
Step 1: Why Accurate Time Matters Enough to Check
Beyond the obvious (logs matching wall-clock reality), accurate time is a hard requirement for TLS handshakes (a client with a badly wrong clock will reject valid certificates as expired or not-yet-valid), Kerberos tickets (typically rejected outside a 5-minute skew), and corosync-based clustering — the same technology behind Proxmox HA clusters, where our HA cluster guide specifically calls out clock sync as a prerequisite. Drift problems tend to surface as bizarre, hard-to-trace failures elsewhere rather than an obvious “clock is wrong” error.
Step 2: Check Current Sync Status
timedatectl gives a quick summary including System clock synchronized: yes/no. For detail, chronyc tracking shows the current offset from reference time and the clock’s estimated error — a System time offset in the single-digit milliseconds is healthy; anything in whole seconds indicates a real problem.
Step 3: Install and Enable chrony
Most modern distros ship chrony by default, but confirm: apt install chrony or dnf install chrony, then systemctl enable --now chronyd. If ntpd or systemd-timesyncd is also installed and running, disable it first — two time daemons fighting over the clock produces worse results than either alone.
Step 4: Configure Time Sources
Edit /etc/chrony/chrony.conf (or /etc/chrony.conf on RHEL-family). Default pool entries (pool 2.debian.pool.ntp.org iburst or similar) work fine for most servers with internet access. For better accuracy or regional preference, add specific servers like server time.cloudflare.com iburst. The iburst option speeds up initial sync by sending several requests quickly rather than waiting on the normal poll interval.
Step 5: Force an Initial Sync
After a config change or on a server whose clock has drifted significantly, chronyc makestep forces an immediate step correction instead of waiting for chrony’s normal gradual adjustment (which deliberately avoids large sudden jumps during regular operation, since abrupt time jumps can confuse running applications). Use this right after initial setup, not as a routine command.
Step 6: Verify Sources and Stratum
chronyc sources lists every configured time source with its stratum (distance from a reference clock — stratum 1 is closest, directly attached to a precision clock) and current offset. A ^* prefix marks the currently selected best source; ^+ marks acceptable alternates being tracked as backups.
Step 7: Run a Local chrony Server for a Cluster or Isolated Network
For a Proxmox cluster or any isolated network without direct internet access, designate one host to sync from the internet (or a hardware clock) and serve time to the rest internally: add allow 192.168.1.0/24 to that host’s chrony.conf to permit client requests from your subnet, then point every other node’s server line at this internal host instead of the public pool. This keeps all cluster nodes tightly synced to each other even if external connectivity is briefly interrupted.
Step 8: Monitor Drift and Troubleshoot Failures
Periodically check chronyc tracking across your fleet — sustained growing offset on one host despite chrony running suggests a hardware clock problem or a firewall blocking NTP’s UDP port 123. If a source shows as unreachable in chronyc sources, confirm outbound UDP 123 is actually allowed through any firewall between the host and that time source.
Command reference
# Status
timedatectl
chronyc tracking
chronyc sources
# Force sync after setup
chronyc makestep
# Local server config (on the internal time server)
echo 'allow 192.168.1.0/24' >> /etc/chrony/chrony.conf
systemctl restart chronydRelated tutorials
- Proxmox HA Cluster Setup
- Proxmox Cluster Setup: Multi-Node Configuration
- SSL Certificate Expiry Checker Shell Script
Terminal screenshots are original illustrations created for Gnome IT Solutions (blog.gnomeitsolutions.com).