blog.6admin.io
guest@6admin.io:~$
network, ntp

NTP: time synchronization over the network

NTP (Network Time Protocol) synchronizes machine clocks over the network. It sounds trivial until the day a script that depends on the date drifts by 3 seconds and misses its connection window, or two servers that must agree on “now” have a 4-minute gap.

Installation

apt-get install ntp

The ntpd daemon starts and synchronizes automatically with the Debian pool servers (0.debian.pool.ntp.org through 3.debian.pool.ntp.org).

The minimal config

# /etc/ntp.conf
server 0.debian.pool.ntp.org iburst
server 1.debian.pool.ntp.org iburst
server 2.debian.pool.ntp.org iburst
server 3.debian.pool.ntp.org iburst

# Restrict access
restrict default kod notrap nomodify nopeer noquery
restrict 127.0.0.1
restrict ::1

The iburst option accelerates initial sync (4 packets instead of 1 at startup). The restrict lines block access from the network: the NTP server only serves itself, not others (unless you want to run a local NTP server).

Verification

ntpq -p

     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
*0.debian.pool.n 193.52.28.1      2 u   45   64  377   12.345    0.123   0.456
+1.debian.pool.n 193.52.28.1      2 u   32   64  377   15.678   -0.234   0.789
 2.debian.pool.n 193.52.28.1      2 u   28   64  377   14.567    0.345   1.234

The asterisk (*) indicates the current reference server. The offset is the gap between the local clock and the NTP server: an offset of 0.123 ms is excellent, an offset of 500 ms is a problem.

What it is for

Three concrete cases from this year:

  1. The portknocking: the kssh/kscp functions compute the combination from the system date. If the client and server have a 3-second gap at midnight, today’s combination does not match and the door does not open.
  2. The logs: when two servers log the same event with a 4-minute gap, chronological sorting becomes a guessing game. SIEMs and log analysis require synchronized clocks.
  3. TLS certificates: a server whose clock drifts by several minutes can reject valid certificates or accept expired ones.

The drift

Every clock drifts: the quartz crystal on the motherboard is not exact. The drift is measured in ppm (parts per million): 10 ppm = 0.86 seconds per day. The file /var/lib/ntp/ntp.drift stores the measured drift and ntpd compensates continuously.

[edit: 2026] ntpd has been replaced by chrony on modern distributions (faster sync, better on unstable networks, container-compatible). The NTP protocol has not changed (RFC 5905), the Debian pool servers have not changed and the lesson remains the same: a server without NTP is a server whose logs lie. The portknocking is dead, but NTP has survived everything.

[edit: 2026] The Ansible implementation of all this: the ntp role .