Cloudflare Timing
Configure secure NTS time synchronization using Cloudflare's time servers
Configuration
Edit the chrony config file:
nano /etc/chrony/chrony.conf
Delete everything in it and replace with:
# Welcome to the chrony configuration file. See chrony.conf(5) for more
# information about usable directives.
# Include configuration files found in /etc/chrony/conf.d.
confdir /etc/chrony/conf.d
# Use Cloudflare NTS as the only time source.
server time.cloudflare.com iburst nts
# Use time sources from DHCP (optional, can be commented out if not needed).
# sourcedir /run/chrony-dhcp
# Use NTP sources found in /etc/chrony/sources.d (optional, can be commented out if not needed).
# sourcedir /etc/chrony/sources.d
# This directive specify the location of the file containing ID/key pairs for
# NTP authentication.
keyfile /etc/chrony/chrony.keys
# This directive specify the file into which chronyd will store the rate
# information.
driftfile /var/lib/chrony/chrony.drift
# Save NTS keys and cookies.
ntsdumpdir /var/lib/chrony
# Uncomment the following line to turn logging on.
#log tracking measurements statistics
# Log files location.
logdir /var/log/chrony
# Stop bad estimates upsetting machine clock.
maxupdateskew 100.0
# This directive enables kernel synchronisation (every 11 minutes) of the
# real-time clock. Note that it can't be used along with the 'rtcfile' directive.
rtcsync
# Step the system clock instead of slewing it if the adjustment is larger than
# one second, but only in the first three clock updates.
makestep 1 3
# Get TAI-UTC offset and leap seconds from the system tz database.
# This directive must be commented out when using time sources serving
# leap-smeared time.
leapsectz right/UTC
Apply Configuration
Restart the service:
systemctl restart chrony
Check the status:
systemctl status chrony
Check your sources:
chronyc sources -v
Note: If Cloudflare shows as ?
give it a second and refresh the command.
Benefits of NTS
- Authenticated time: NTS provides cryptographic authentication of time data
- Secure: Protects against time-based attacks and manipulation
- Reliable: Cloudflare's global infrastructure ensures high availability
- Accurate: Sub-millisecond accuracy for critical systems