LFCE 72 🐧 NTP — Concepts and Setup - KandZ

⏱️ Estimated read: 12 min | |

The previous chapter covered chrony, the modern default on RHEL and its derivatives. This chapter covers the legacy NTP implementation, ntpd, and the protocol concepts that both implementations share. The LFCE exam objectives require implementing and configuring a time synchronization server , and the exam may present ntpd as the daemon on Debian systems or as the reference implementation for the protocol. The concepts—the stratum hierarchy, the offset and delay calculation, and the poll interval—are the same for both daemons, but the configuration file and the diagnostic tools differ.

Quick How-To Guides & Fast FixesNeed a quick fix or step-by-step solution? Browse our fast answers on HowTo.KandZ.me:

Operating Systems CLI →Dev Environment Languages →Web Network Tools →Security Accounts →Security Access Tech →Device Phone Basics →Social Messaging →Digital Files Media →

ntpd is the reference implementation maintained by the NTP Project. It is available on Debian and Ubuntu as the ntp package, and it is configured in /etc/ntp.conf. The daemon uses UDP port 123, and it synchronizes the clock by polling a set of servers and selecting the best subset from the responses . The ntpq command is the diagnostic tool, and the ntpstat command shows whether the system is synchronized. The previous chapter’s chrony commands (chronyc tracking, chronyc sources) do not apply to ntpd; the equivalent is ntpq -p and ntpstat.

Key point: ntpd and chronyd cannot run at the same time. Both try to discipline the system clock, and they conflict. The choice between them depends on the distribution’s default: RHEL and its derivatives use chronyd, and Debian and Ubuntu use systemd-timesyncd by default but offer ntpd as an alternative. The ntp.conf file uses the server directive for a single source and the pool directive for a DNS name that resolves to multiple sources. The iburst option speeds up the initial synchronization, and the restrict directive controls which clients are allowed to query the server .

Why ntpd requires separate configuration from chrony

The daemon-conflict problem.

A system that has both ntpd and chronyd installed may have both services enabled, and they will fight over the system clock. The systemctl status command shows which one is active, and the other must be disabled and stopped. The ntpd configuration file is /etc/ntp.conf, and the chronyd configuration file is /etc/chrony.conf or /etc/chrony/chrony.conf. The two files have different syntaxes and different directives, and a configuration copied from one to the other will not work.

The diagnostic-tool problem.

The ntpq command is the diagnostic tool for ntpd. The ntpq -p command lists the configured servers, their stratum, their reachability, and the offset. The ntpstat command shows a summary of the synchronization state: whether the clock is synchronized, and if so, the approximate offset. The chronyc commands (tracking, sources) do not work with ntpd; they are specific to chrony. The exam may ask which command to use with which daemon, and mixing them up is a common mistake .

The restrict-directive problem.

The restrict directive in ntp.conf controls which clients can query the server and what they are allowed to do. The default is to deny all access, and the administrator must add explicit restrict lines for the networks that should be allowed. The restrict directive is the equivalent of chrony’s allow directive, but its syntax is different. A server that is configured as a time source for a local network must have a restrict line for that network, or the clients receive a “permission denied” response.

a. The server and pool directives

The server directive defines a single NTP server, and the pool directive defines a DNS name that resolves to multiple servers. The iburst option sends a burst of packets at startup to speed up the initial synchronization.

# /etc/ntp.conf
# Use a pool of public servers
pool 2.pool.ntp.org iburst

# Or use specific servers
server 0.pool.ntp.org iburst
server 1.pool.ntp.org iburst

The pool directive is the recommended form for public NTP, because the DNS name resolves to multiple servers and ntpd selects the best ones. The server directive is used when the addresses are known and stable . The iburst option is recommended for both forms, because it sends a burst of packets when the daemon starts, which allows it to reach synchronization faster than the normal polling interval would allow.

The prefer option marks a server as preferred, and the noselect option marks a server as never selected. These are useful when a specific server is known to be more accurate or when a server should be used only as a backup.

server ntp1.example.com iburst prefer
server ntp2.example.com iburst

The prefer option on ntp1 tells ntpd to choose it over ntp2 when both are available and accurate .

b. The restrict directive and access control

The restrict directive controls which clients can query the server and what they are allowed to do. The default is to deny all access, so the administrator must add explicit lines for the networks that should be allowed.

# /etc/ntp.conf
# Deny all access by default
restrict default ignore

# Allow the local host
restrict 127.0.0.1
restrict ::1

# Allow the local network to query the server
restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap

The restrict default ignore line denies all access that is not explicitly allowed. The restrict 127.0.0.1 line allows the local host to query and modify the server. The restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap line allows the local network to query the server but not to modify its configuration or use it for trap messages . The nomodify and notrap options are the standard restrictions for a client network.

The restrict directive is the equivalent of chrony’s allow directive, but it is more granular. The ignore option denies all access, the noquery option denies queries but allows other operations, and the nomodify option denies configuration changes.

c. The driftfile and the ntpq diagnostic

The driftfile records the clock’s frequency offset, and the ntpq command shows the synchronization status.

# /etc/ntp.conf
driftfile /var/lib/ntp/ntp.drift

The driftfile path is /var/lib/ntp/ntp.drift on Debian and /var/lib/ntp/drift on some systems. The file is written by the daemon and read at startup. The ntpq -p command lists the configured servers and their state.

# List the configured servers
ntpq -p
# Output:
#      remote           refid      st t when poll reach   delay   offset  jitter
# ==============================================================================
# *ntp1.example.com .GPS.            1 u   42   64  377    0.512   -0.021   0.015
# +ntp2.example.com .PPS.            1 u   38   64  377    0.498    0.013   0.012

The * next to a server indicates the current synchronization source, and the + indicates a candidate source. The reach column is an octal bitmap of the last eight polls; a value of 377 means all eight were successful. The offset column is the difference between the local clock and the server’s clock, in milliseconds . The ntpstat command shows a summary.

# Check the synchronization status
ntpstat
# Output: synchronised to NTP server (192.168.1.10) at stratum 3
#         time correct to within 12 ms
#         polling server every 64 s

The ntpstat output confirms that the clock is synchronized and shows the stratum and the offset. A system that is not synchronized shows “unsynchronised” and the reason.

Complete Example Session

# ============================================
# PART 1: INSTALL NTPD
# ============================================
sudo apt install ntp

# ============================================
# PART 2: BACK UP THE DEFAULT CONFIGURATION
# ============================================
sudo cp /etc/ntp.conf /etc/ntp.conf.bak

# ============================================
# PART 3: CONFIGURE THE TIME SOURCES
# ============================================
sudo tee /etc/ntp.conf > /dev/null <<'EOF'
# Use public NTP pool servers
pool 2.pool.ntp.org iburst

# Record the clock rate
driftfile /var/lib/ntp/ntp.drift

# Deny all access by default
restrict default ignore

# Allow the local host
restrict 127.0.0.1
restrict ::1

# Allow the local network to query the server
restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap
EOF

# ============================================
# PART 4: DISABLE CHRONYD IF IT IS RUNNING
# ============================================
sudo systemctl stop chronyd 2>/dev/null
sudo systemctl disable chronyd 2>/dev/null

# ============================================
# PART 5: START AND ENABLE NTPD
# ============================================
sudo systemctl restart ntp
sudo systemctl enable ntp
sudo systemctl status ntp
# Output: active (running)

# ============================================
# PART 6: CHECK THE CONFIGURED SERVERS
# ============================================
ntpq -p
# Output shows the servers with * next to the selected source

# ============================================
# PART 7: CHECK THE SYNCHRONIZATION STATUS
# ============================================
ntpstat
# Output: synchronised to NTP server (...) at stratum ...

# ============================================
# PART 8: OPEN THE FIREWALL
# ============================================
sudo firewall-cmd --permanent --add-service=ntp
sudo firewall-cmd --reload

# ============================================
# PART 9: VERIFY THE LISTENING PORT
# ============================================
sudo ss -ulnp | grep :123
# Output: UNCONN 0 0 *:123 *:* users:(("ntpd",...))

# ============================================
# PART 10: TEST FROM A CLIENT
# ============================================
# On a client on the 192.168.1.0/24 network:
# ntpdate -q 192.168.1.10
# Output shows the offset and the delay

The ten parts demonstrate the complete ntpd setup: installation, backup, configuration, disabling chrony, starting the service, checking the servers, checking the synchronization, opening the firewall, verifying the port, and testing from a client. The critical verification is Part 7: ntpstat confirms that the clock is synchronized and shows the offset.

Quick Reference

Core Directives

Directive	Purpose	Example
`server`	Single NTP server	`server ntp1.example.com iburst`
`pool`	DNS name with multiple servers	`pool 2.pool.ntp.org iburst`
`driftfile`	Clock rate record	`/var/lib/ntp/ntp.drift`
`restrict`	Access control	`restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap`

Server Options

Option	Purpose
`iburst`	Send burst at startup
`prefer`	Prefer this source
`noselect`	Never select this source
`minpoll N` / `maxpoll N`	Polling interval range

Diagnostic Commands

Command	Purpose
`ntpq -p`	List servers and state
`ntpstat`	Show synchronization summary
`ntpdate -q <server>`	Query a server without setting the clock
`systemctl status ntp`	Check the daemon state

Config File Locations

Distribution	Path
Debian / Ubuntu	`/etc/ntp.conf`
Drift file	`/var/lib/ntp/ntp.drift`

Best Practices

✅ Do This:

# Use a pool for public servers
pool 2.pool.ntp.org iburst                                    # ✅

# Set a drift file
driftfile /var/lib/ntp/ntp.drift                              # ✅

# Restrict access by default
restrict default ignore                                       # ✅

# Allow the local network
restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap       # ✅

# Disable chronyd when using ntpd
systemctl disable chronyd                                     # ✅

# Verify with ntpq and ntpstat
ntpq -p; ntpstat                                              # ✅

❌ Don’t Do This:

# Run ntpd and chronyd at the same time
# They conflict and both try to discipline the clock         # ❌

# Forget the restrict directive
# The default denies all access                               # ❌

# Use chronyc commands with ntpd
chronyc tracking    # Does not work with ntpd                 # ❌

# Forget to open UDP 123
# Clients cannot reach the server                             # ❌

# Edit the wrong config file
# ntpd uses /etc/ntp.conf, chrony uses /etc/chrony.conf       # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
ntpd and chronyd conflict	Both installed and running	Disable one; use chrony on RHEL
Clients cannot query the server	`restrict` directive missing	Add `restrict` for the client network
Configuration not applied	Wrong file path	Check `ps -ef \| grep ntpd` for `-c`
`ntpq -p` shows no servers	Config file empty or wrong path	Verify `/etc/ntp.conf`
Service fails to start	Syntax error	Check `journalctl -u ntp`

Real-World Examples

1. Public pool

pool 2.pool.ntp.org iburst

2. Internal servers

server ntp1.example.com iburst prefer
server ntp2.example.com iburst

3. Drift file

driftfile /var/lib/ntp/ntp.drift

4. Restrict default

restrict default ignore

5. Allow local network

restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap

6. Check servers

ntpq -p

7. Check sync status

ntpstat

8. Query a server

ntpdate -q pool.ntp.org

9. Disable chrony

systemctl disable chronyd

10. Start ntpd

systemctl restart ntp

Visual

ntpd Architecture

┌──────────────────────────────────────────────────────────────┐
│  ntpd POLLS SERVERS AND SELECTS THE BEST SUBSET              │
│                                                              │
│  ntpd                                                        │
│  ├── pool 2.pool.ntp.org iburst                              │
│  ├── server ntp1.example.com iburst                          │
│  └── server ntp2.example.com iburst                          │
│       │                                                      │
│       ▼                                                      │
│  Poll process sends packets at intervals (64s–1024s)         │
│       │                                                      │
│       ▼                                                      │
│  Selection algorithm chooses the best subset                 │
│       │                                                      │
│       ▼                                                      │
│  Clock discipline adjusts the system clock                   │
└──────────────────────────────────────────────────────────────┘

ntpq -p Output

┌──────────────────────────────────────────────────────────────┐
│  ntpq -p SHOWS THE SERVER STATE                              │
│                                                              │
│       remote           refid      st t when poll reach offset│
│  ============================================================│
│  *ntp1.example.com .GPS.            1 u   42   64  377  -0.021│
│  +ntp2.example.com .PPS.            1 u   38   64  377   0.013│
│  -ntp3.example.com .GPS.            2 u   10   64  377   0.150│
│                                                              │
│  * = current synchronization source                          │
│  + = candidate source                                        │
│  - = outlier (rejected)                                      │
│  x = falseticker (rejected)                                  │
│  reach = octal bitmap of the last 8 polls                    │
└──────────────────────────────────────────────────────────────┘

chrony vs ntpd

┌──────────────────────────────────────────────────────────────┐
│  DIFFERENT DAEMONS, DIFFERENT TOOLS                          │
│                                                              │
│  chrony:                                                     │
│  ├── /etc/chrony.conf                                       │
│  ├── chronyc tracking                                       │
│  └── chronyc sources -v                                     │
│                                                              │
│  ntpd:                                                       │
│  ├── /etc/ntp.conf                                          │
│  ├── ntpq -p                                                │
│  └── ntpstat                                                │
│                                                              │
│  The concepts are the same; the commands are different.      │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Daemon	`ntpd`
Configuration	`/etc/ntp.conf`
Time source (single)	`server <host> iburst`
Time source (pool)	`pool <name> iburst`
Clock rate record	`driftfile`
Access control	`restrict`
Diagnostic (servers)	`ntpq -p`
Diagnostic (status)	`ntpstat`
Query without setting	`ntpdate -q <server>`
Firewall	UDP 123
Conflict	Cannot run with `chronyd`

Key takeaways:

ntpd and chronyd are alternative NTP daemons. They both discipline the system clock, and they cannot run at the same time. The choice depends on the distribution: RHEL and its derivatives use chronyd, and Debian and Ubuntu offer ntpd as an option .
The server and pool directives define the time sources. The pool form resolves a DNS name to multiple servers and is the recommended choice for public NTP. The iburst option speeds up the initial synchronization .
The restrict directive controls access. The default is to deny all access, and the administrator must add explicit lines for the networks that should be allowed to query the server. The nomodify and notrap options are the standard restrictions for a client network .
ntpq -p and ntpstat are the diagnostic tools. The ntpq -p command lists the servers and their state, with a * next to the selected source. The ntpstat command shows whether the clock is synchronized and the approximate offset .
The chronyc commands do not work with ntpd. The two daemons have different diagnostic tools, and mixing them up is a common mistake. The chronyc tracking command is for chrony, and ntpq -p is for ntpd.
The firewall must permit UDP 123. A server that cannot reach its time sources drifts, and the drift accumulates until the daemon reconnects or the clock is corrected manually.

Remember: ntpd is the legacy NTP daemon. The server and pool directives define the sources, the driftfile records the clock rate, and the restrict directive controls who can query the server. The ntpq -p and ntpstat commands show the synchronization state. The daemon uses UDP 123, and it cannot run alongside chronyd. The concepts are the same as chrony, but the configuration file and the diagnostic tools are different. The exam may present either daemon, and the correct commands depend on which one is running.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!