Clock synchronisation
medium on-server
What it inspects
`timedatectl status`: the lines `System clock synchronized` and `NTP service`. Both synchronized and the NTP service active passes; synchronized with the NTP service inactive warns; not synchronized fails. If timedatectl is missing or prints nothing, the check is skipped.
Why it matters
TLS certificates, token expiry, Kerberos, cron and log correlation all depend on the clock. A server whose time drifts by more than a few minutes starts failing logins and certificate checks in confusing ways, and its logs can no longer be lined up with other machines during an incident.
How to verify
timedatectl status | grep -E 'synchronized|NTP service'How to fix
Install chrony and enable its service (chrony on Debian/Ubuntu, chronyd on the RHEL family), then confirm with chronyc tracking and timedatectl.
Install and start chrony
Debian / Ubuntu
# Installs chrony and starts it. chrony replaces systemd-timesyncd, ntp or ntpsec on Debian (they provide the same
# role) and their server settings do not carry over: copy any custom server lines into /etc/chrony/chrony.conf.
# If the clock is already synced and only the service shows as inactive (a warning), the lighter fix is
# `timedatectl set-ntp true`, which switches on the time service that is installed; use that instead of this step.
# Outbound UDP 123 must be allowed. On a private network, point chrony at your own time server by editing
# /etc/chrony/chrony.conf (a `server` or `pool` line) and running: systemctl restart chrony
apt-get install -y chrony
systemctl enable --now chrony
chronyc tracking
timedatectl status
RHEL / Rocky / Alma / Fedora
# Installs chrony and starts it (this is already the default time service on RHEL-family systems).
# Outbound UDP 123 must be allowed. On a private network, point chrony at your own time server by editing
# /etc/chrony.conf (a `server` or `pool` line) and running: systemctl restart chronyd
dnf install -y chrony
systemctl enable --now chronyd
chronyc tracking
timedatectl status