Configuration

NTP and NTS setup

Ready-made configuration for eleven platforms. Every example uses the hostname rather than the IP address — if the address changes, your configuration does not have to.

Configuration by platform

eleven platforms

chrony — AlmaLinux, RHEL, Rocky, Fedora, Debian, Ubuntu

In /etc/chrony.conf or /etc/chrony/chrony.conf:

server ntp.alastyr.com iburst

With NTS — recommended

Requires chrony 4.0 or newer. The ntsdumpdir line must be present; without it the handshake is repeated from scratch on every restart.

server ntp.alastyr.com iburst nts
ntsdumpdir /var/lib/chrony

Apply and verify:

sudo systemctl restart chronyd
chronyc -N sources -v
chronyc -N authdata      # the Mode column should read NTS

systemd-timesyncd

/etc/systemd/timesyncd.conf:

[Time]
NTP=ntp.alastyr.com
FallbackNTP=ptbtime1.ptb.de

sudo systemctl restart systemd-timesyncd
timedatectl timesync-status

Know the limitation: systemd-timesyncd is an SNTP client — it does not support NTS, works with a single source and never looks for agreement between sources. Use chrony on servers; timesyncd is fine for desktops and container hosts.

ntpd / ntpsec

/etc/ntp.conf or /etc/ntpsec/ntp.conf:

server ntp.alastyr.com iburst

sudo systemctl restart ntpd      # ntpsec: ntpsec.service
ntpq -pn

Note: if you are on classic ntpd, make sure your restrict lines are not blocking the incoming replies. If you need NTS, you need ntpsec or chrony.

A single machine — command prompt as Administrator

w32tm /config /manualpeerlist:"ntp.alastyr.com,0x8" /syncfromflags:manual /reliable:no /update
net stop w32time && net start w32time
w32tm /resync
w32tm /query /status

Domain controller — PDC emulator

Apply this only on the controller holding the PDC emulator role:

w32tm /config /manualpeerlist:"ntp.alastyr.com,0x8" /syncfromflags:manual /reliable:yes /update
net stop w32time && net start w32time
w32tm /query /configuration

Do not apply this on domain-joined clients. Domain members take their time from the domain hierarchy; overriding it by hand breaks Kerberos authentication. Point only the PDC emulator at this server and let every other machine take the time from it.

macOS

sudo systemsetup -setnetworktimeserver ntp.alastyr.com
sudo systemsetup -setusingnetworktime on
sudo sntp -sS ntp.alastyr.com     # one-off synchronisation

Graphical interface: System Settings → General → Date & Time → Set.

RouterOS 7

/system ntp client set enabled=yes servers=ntp.alastyr.com
/system ntp client print
/system clock print

RouterOS 6

/system ntp client set enabled=yes primary-ntp=5.2.80.90

RouterOS 6 resolves hostnames only in a limited way, so this release may need the IP address. If the address changes you will have to update the configuration by hand — move to RouterOS 7 and use the name if you can.

Cisco IOS / IOS-XE

ip name-server 5.2.82.2
ntp server ntp.alastyr.com
! if name resolution is unavailable:
ntp server 5.2.80.90
!
show ntp status
show ntp associations detail

Juniper Junos

set system ntp server 5.2.80.90
set system ntp server 2a06:ad40:0:1::90
commit
show ntp associations

pfSense / OPNsense

Put ntp.alastyr.com in System → General Setup → Timeservers; separate multiple sources with spaces. On OPNsense it can also be set under Services → Network Time → General.

On FreeBSD directly, in /etc/ntp.conf:

server ntp.alastyr.com iburst

VMware ESXi

esxcli system ntp set --enabled=false
esxcli system ntp set --server=ntp.alastyr.com
esxcli system ntp set --enabled=true
esxcli system ntp get

Proxmox VE

Debian-based, so chrony is recommended:

apt install -y chrony
echo 'server ntp.alastyr.com iburst nts' >> /etc/chrony/chrony.conf
systemctl restart chrony

KVM / libvirt guests

Configure the guest like any other Linux machine, and confirm that it is using a stable clock source:

cat /sys/devices/system/clocksource/clocksource0/current_clocksource
# expected: kvm-clock or tsc

The most common mistake on virtual machines: running an NTP client inside the guest while the hypervisor's own time synchronisation is also left enabled (VMware Tools time sync, the Hyper-V time synchronization service, qemu-guest-agent clock setting). Both pull the clock at the same time, and the result is a clock that constantly jumps back and forth. If NTP runs in the guest, turn the hypervisor's sync off.

Synology DSM

Control Panel → Regional Options → Time → Synchronize with NTP server → ntp.alastyr.com

QNAP QTS

Control Panel → System → General Settings → Time → NTP server → ntp.alastyr.com

OpenWrt

uci del system.ntp.server
uci add_list system.ntp.server='ntp.alastyr.com'
uci commit system
/etc/init.d/sysntpd restart

Raspberry Pi OS

Debian-based — follow the Linux · chrony or timesyncd section. A Pi has no hardware clock (RTC), so the time is wrong at boot until the network provides it; that is normal.

Docker · Podman · LXC · Kubernetes

Containers share the host's kernel clock and cannot set their own (CAP_SYS_TIME is not granted). Putting an NTP client in a container image is unnecessary and misleading — synchronise the host and every container sees the correct time immediately.

On Kubernetes nodes and LXC hosts:

server ntp.alastyr.com iburst nts
ntsdumpdir /var/lib/chrony
minsources 2

Inside a container you set only the time zone, never the clock:

docker run -e TZ=Europe/Istanbul ...

NTS — authenticated time

Plain NTP has no authentication. An attacker on the path can rewrite packets and move a client's clock wherever they like — and everything in the "what breaks when the clock drifts" table is then under their control.

NTS (Network Time Security, RFC 8915) closes that gap. The client first performs a TLS key exchange over TCP 4460 (NTS-KE); after that, NTP packets carry AEAD authentication. The time data is not hidden — it is verified; a modified packet is silently dropped.

Usage

server ntp.alastyr.com iburst nts
ntsdumpdir /var/lib/chrony

Confirming that it works

chronyc -N authdata

Name/IP address     Mode KeyID Type KLen Last Atmp NAK Cook CLen
================================================================
ntp.alastyr.com      NTS     1   15  256   12    0   0    8  100

The Mode column must read NTS, Cook must be greater than zero and NAK must be zero. Type 15 = AES-SIV-CMAC-256.

The NTS certificate is issued for ntp.alastyr.com. When connecting over NTS you must therefore use the hostname — connecting by IP address fails certificate validation and the handshake is refused.