commit e066efa63f3e7c17cfd07fafc9d6c458e5fb263d
Author: Stephen Wadeley <swadeley(a)redhat.com>
Date: Thu Jun 27 17:57:07 2013 +0200
Adding chapter in file: Configuring_NTP_using_the_Chrony_suite.xml
en-US/Configuring_NTP_using_the_Chrony_suite.xml | 1081 ++++++++++++++++++++++
1 files changed, 1081 insertions(+), 0 deletions(-)
---
diff --git a/en-US/Configuring_NTP_using_the_Chrony_suite.xml
b/en-US/Configuring_NTP_using_the_Chrony_suite.xml
new file mode 100644
index 0000000..7c93b2f
--- /dev/null
+++ b/en-US/Configuring_NTP_using_the_Chrony_suite.xml
@@ -0,0 +1,1081 @@
+<?xml version='1.0' encoding='utf-8' ?>
+<!DOCTYPE chapter PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+<!ENTITY % BOOK_ENTITIES SYSTEM "Networking_Guide.ent">
+%BOOK_ENTITIES;
+]>
+<!--Topics, Concepts:-->
+
+<chapter
id="chap-Networking_Guide-Configuring_NTP_using_the_chrony_suite">
+ <title>Configuring NTP using the chrony suite</title>
+ <para>
+ Accurate time keeping is important for a number of reasons in IT. In networking for
example, accurate time stamps in packets and logs are required. In Linux systems, the
<systemitem class="protocol">NTP</systemitem> protocol is
implemented by a daemon running in user space.</para>
+ <para>
+ The user space daemon updates the system clock running in the kernel. The system clock
can keep time by using various clock sources. Usually, the <firstterm>Time Stamp
Counter</firstterm> (<acronym>TSC</acronym>) is used. The TSC is a CPU
register which counts the number of cycles since it was last reset. It is very fast, has a
high resolution, and there are no interrupts.
+ </para>
+ <para>
+There is a choice between the daemons <systemitem
class="daemon">ntpd</systemitem> and <systemitem
class="daemon">chronyd</systemitem>, which are available from the repos
in the <package>ntp</package> and <package>chrony</package>
packages respectively. This section describes the use of the
<application>chrony</application> suite of utilities to update the daemon on
systems that do not fit into the conventional permanently networked, always on, dedicated
server category.
+ </para>
+<section id="sect-Networking_Guide-Introduction_to_the_chrony_suite">
+ <title>Introduction to the chrony suite</title>
+ <para>
+ <application>Chrony</application> consists of <systemitem
class="daemon">chronyd</systemitem>, a daemon that runs in user space,
and <application>chronyc</application>, a command line program for making
adjustments to <systemitem class="daemon">chronyd</systemitem>.
Systems which are not permanently connected, or not permanently powered up, take a
relatively long time to adjust their system clocks using the <systemitem
class="protocol">NTP</systemitem> time protocol. This is because many
small corrections are made based on observations of the clocks drift and offset.
Temperature changes, which may be significant when powering up a system, affect the
stability of hardware clocks. Although adjustments begin within a few milliseconds of
booting a system, acceptable accuracy may take anything from ten seconds from a warm
restart to a number of hours depending on your requirements, operating environment and
hardware. <application>Chrony</application> is a different implementat
ion of the <systemitem class="protocol">NTP</systemitem> protocol
than <systemitem class="daemon">ntpd</systemitem>, it can adjust the
system clock more rapidly.
+ </para>
+ </section>
+
+ <section id="sect-differences_between_ntpd_and_chronyd">
+ <title>Differences between ntpd and chronyd</title>
+ <para>
+ One of the main differences between <systemitem
class="daemon">ntpd</systemitem> and <systemitem
class="daemon">chronyd</systemitem> is in the
+ algorithms used to control the computer's clock. Things <systemitem
class="daemon">chronyd</systemitem> can do better than <systemitem
class="daemon">ntpd</systemitem> are:
+ </para>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <systemitem class="daemon">chronyd</systemitem> can work well
when external time references are only intermittently accessible whereas <systemitem
class="daemon">ntpd</systemitem> needs regular polling of time
reference to work well.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <systemitem class="daemon">chronyd</systemitem> can
perform well even when the network is congested for longer periods of time.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <systemitem class="daemon">chronyd</systemitem> can usually
synchronise the clock faster and with better accuracy.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <systemitem class="daemon">chronyd</systemitem> quickly
adapts to sudden changes in the rate of the clock, for example, due to changes in the
temperature of the crystal oscillator, whereas <systemitem
class="daemon">ntpd</systemitem> may need a long time to settle down
again.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <systemitem class="daemon">chronyd</systemitem> in the
default configuration never steps the time, in order not to upset other running programs.
<systemitem class="daemon">ntpd</systemitem> can be configured to
never
+ step the time too, but it has to use a different means of adjusting the clock, which
has some disadvantages.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <systemitem class="daemon">chronyd</systemitem> can
adjust the rate of the clock on a Linux system in a larger range, which allows it to
operate even on machines with a broken or unstable clock. For example, on some virtual
machines.
+ </para>
+ </listitem>
+ </itemizedlist>
+
+<para>
+Things <systemitem class="daemon">chronyd</systemitem> can do that
<systemitem class="daemon">ntpd</systemitem> cannot do:
+</para>
+<itemizedlist>
+
+<listitem>
+ <para>
+ <systemitem class="daemon">chronyd</systemitem> provides
support for isolated networks where the only method of time correction is manual entry.
For example, by the administrator looking at a clock. <systemitem
class="daemon">chronyd</systemitem> can look at the errors corrected at
different updates to estimate the rate at which the computer gains or loses time, and use
this estimate to trim the computer clock subsequently.
+ </para>
+</listitem>
+<listitem>
+ <para>
+ <systemitem class="daemon">chronyd</systemitem> provides
support to work out the rate of gain or loss of the real-time clock, the hardware clock,
that maintains the time when the computer is turned off. It can use this data when the
system boots to set the system time using an adjusted value of the time taken from the
real-time clock. This is, at time of writing, only available in Linux.
+ </para>
+</listitem>
+</itemizedlist>
+
+<para>
+Things <systemitem class="daemon">ntpd</systemitem> can do that
<systemitem class="daemon">chronyd</systemitem> cannot do:
+</para>
+<itemizedlist>
+<listitem>
+ <para>
+ <systemitem class="daemon">ntpd</systemitem> fully supports
<systemitem class="protocol">NTP</systemitem> version 4
(<citetitle pubwork="webpage">RFC5905</citetitle>), including
broadcast, multicast, manycast clients and servers, and the orphan mode. It also supports
extra authentication schemes based on public-key cryptography (<citetitle
pubwork="webpage">RFC5906</citetitle>). <systemitem
class="daemon">chronyd</systemitem> uses <systemitem
class="protocol">NTP</systemitem> version 3 (<citetitle
pubwork="webpage">RFC1305</citetitle>), which is compatible with
version 4.
+ </para>
+</listitem>
+ <listitem>
+ <para>
+ <systemitem class="daemon">ntpd</systemitem> includes drivers
for many reference clocks whereas <systemitem
class="daemon">chronyd</systemitem> relies on other programs, for
example <application>gpsd</application>, to access the data from the reference
clocks.
+ </para>
+ </listitem>
+</itemizedlist>
+ </section>
+
+<section id="sect-Networking_Guide-Choosing_between_NTP_daemon">
+ <title>Choosing between NTP daemons</title>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <application>Chrony</application> should be considered for all systems
which are frequently suspended or otherwise intermittently disconnected and reconnected to
a network. Mobile and virtual systems for example.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ The <systemitem class="protocol">NTP</systemitem> daemon
(<systemitem class="daemon">ntpd</systemitem>) should be considered
for systems which are normally kept permanently on. Systems which are required to use
broadcast or multicast IP, or to perform authentication of packets with the Autokey
protocol, should consider using <systemitem
class="daemon">ntpd</systemitem>.
<application>Chrony</application> only supports symmetric key authentication,
such as the use of <systemitem class="protocol">MD5</systemitem>,
<systemitem class="protocol">SHA1</systemitem>, and <systemitem
class="protocol">SHA256</systemitem> hash functions, whereas
<systemitem class="daemon">ntpd</systemitem> supports the Autokey
authentication protocol which can make use of the PKI system. Autokey is described in
<citetitle pubwork="webpage">RFC5906</citetitle>.
+ </para>
+ </listitem>
+ </itemizedlist>
+ </section>
+<section id="sect-Networking_Guide-Understanding_chronyd">
+ <title>Understanding chronyd</title>
+ <para>
+ The <application>Chrony</application> daemon, <systemitem
class="daemon">chronyd</systemitem>, running in user space, makes
adjustments to the system clock which is running in the kernel. It does this by consulting
external time sources, using the <systemitem
class="protocol">NTP</systemitem> protocol, when ever network access
allows it to do so. When external references are not available, <systemitem
class="daemon">chronyd</systemitem> will use the last calculated drift
stored in the drift file. It can also be commanded manually to make corrections, by
<application>chronyc</application>.
+ </para>
+ </section>
+
+<section id="sect-Networking_Guide-Understanding_chronyc">
+ <title>Understanding chronyc</title>
+ <para>
+ The <application>chrony</application> daemon, <systemitem
class="daemon">chronyd</systemitem>, can be controlled by the command
line utility <application>chronyc</application>. This utility provides a
command prompt which allows entering of a number of commands to make changes to
<systemitem class="daemon">chronyd</systemitem>. The default
configuration is for <systemitem class="daemon">chronyd</systemitem>
to only accept commands from a local instance of
<application>chronyc</application>, but
<application>chronyc</application> can be used to alter the configuration so
that <systemitem class="daemon">chronyd</systemitem> will allow
external control. That is to say, <application>chronyc</application> can be
run remotely after first configuring <systemitem
class="daemon">chronyd</systemitem> to accept remote connections. The
IP addresses allowed to connect to <systemitem
class="daemon">chronyd</systemitem> should be tightly
controlled.</para>
+ </section>
+
+ <section
id="sect-Networking_Guide-Understanding_the_chrony_configuration_commands">
+ <title>Understanding the chrony configuration commands</title>
+ <para>
+ <systemitem class="daemon">chronyd</systemitem>'s default
config file is <filename>/etc/chrony.conf</filename>. The
<option>-f</option> option can be used to specify an alternate config file
path. Refer to the <systemitem class="daemon">chronyd</systemitem>
man page for further options. We present here a selection of configuration options. For a
complete list of the directives that can be used see <citetitle
pubwork="webpage">http://chrony.tuxfamily.org/manual.html#Co...
+ <variablelist>
+ <varlistentry>
+ <term>Comments</term>
+ <listitem>
+ <para>
+ Comments should be preceded by #, %, ; or !
+ </para>
+ </listitem>
+ </varlistentry>
+<varlistentry>
+ <term>allow</term>
+<listitem>
+ <para>
+Optionally specify a host, subnet, or network from which to allow <systemitem
class="protocol">NTP</systemitem> connections to a machine acting as
<systemitem class="protocol">NTP</systemitem> server. The default is
not to allow connections.
+ </para>
+
+ <orderedlist>
+ <title>Examples:</title>
+ <listitem>
+ <screen>allow server1.example.com</screen>
+ <para>
+ Use this form to specify a particular host, by its host name, to be allowed
access.
+ </para>
+ </listitem>
+
+ <listitem>
+ <screen>allow 192.0.2.0/24</screen>
+ <para>
+ Use this form to specify a particular network to be allowed access.
+ </para>
+ </listitem>
+
+ <listitem>
+ <screen>allow 2001:db8::/32</screen>
+ <para>
+ Use this form to specify an IPv6 address to be allowed access.
+ </para>
+ </listitem>
+ </orderedlist>
+</listitem>
+
+</varlistentry>
+
+ <varlistentry>
+ <term>cmdallow</term>
+ <listitem>
+ <para>
+ This is similar to the <command>allow</command> directive (see
section allow), except that it allows control access (rather than <systemitem
class="protocol">NTP</systemitem> client access) to a particular subnet
or host. (By ’control access’ is meant that <application>chronyc</application>
can be run on those hosts and successfully connect to <systemitem
class="daemon">chronyd</systemitem> on this computer.) The syntax is
identical. There is also a <command>cmddeny</command> all directive with
similar behaviour to the <command>cmdallow</command> all directive.
</para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>dumpdir</term>
+ <listitem>
+ <para>
+ Path to the directory to save the measurement history across restarts of
<systemitem class="daemon">chronyd</systemitem> (assuming no changes
are made to the system clock behaviour whilst it is not running). If this capability is to
be used (via the <command>dumponexit</command> command in the configuration
file, or the <command>dump</command> command in chronyc), the
<command>dumpdir</command> command should be used to define the directory
where the measurement histories are saved. </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>dumponexit</term>
+ <listitem>
+ <para>
+ If this command is present, it indicates that <systemitem
class="daemon">chronyd</systemitem> should save the measurement history
for each of its time sources recorded whenever the program exits. (See the
<command>dumpdir</command> command above)</para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>local</term>
+ <listitem>
+ <para>
+ The <command>local</command> keyword is used to allow
<systemitem class="daemon">chronyd</systemitem> to appear
synchronized to real time (from the viewpoint of clients polling it), even if it has no
current synchronization source. This option is normally used on computers in an isolated
network, where several computers are required to synchronize to one other, this being the
"master" which is kept vaguely in line with real time by manual
input.</para>
+ <para>
+An example of the command is:
+<screen>local stratum 10</screen>
+A large value of 10 indicates that the clock is so many hops away from a reference clock
that its time is fairly unreliable. Put another way, if the computer ever has access to
another computer which is ultimately synchronized to a reference clock, it will almost
certainly be at a stratum less than 10. Therefore, the choice of a high value like 10 for
the <command>local</command> command prevents the machine’s own time from ever
being confused with real time, were it ever to leak out to clients that have visibility of
real servers. </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>log</term>
+ <listitem>
+ <para>
+ The <command>log</command> command indicates that certain
information is to be logged. It accepts the following options:
+<variablelist>
+<varlistentry>
+ <term>measurements</term>
+ <listitem>
+<para>
+ This option logs the raw <systemitem
class="protocol">NTP</systemitem> measurements and related information
to a file called <filename>measurements.log</filename>.
+</para>
+</listitem>
+</varlistentry>
+<varlistentry>
+ <term>statistics</term>
+ <listitem>
+<para>
+ This option logs information about the regression processing to a file called
<filename>statistics.log</filename>.
+</para>
+</listitem>
+</varlistentry>
+<varlistentry>
+ <term>tracking</term>
+ <listitem>
+<para>
+ This option logs changes to the estimate of the system’s gain or loss rate, and any
slews made, to a file called <filename>tracking.log</filename>.
+</para>
+</listitem>
+</varlistentry>
+<varlistentry>
+ <term>rtc</term>
+ <listitem>
+<para>
+ This option logs information about the system’s real-time clock.
+</para>
+</listitem>
+</varlistentry>
+<varlistentry>
+ <term>refclocks</term>
+ <listitem>
+<para>
+ This option logs the raw and filtered reference clock measurements to a file called
<filename>refclocks.log</filename>.
+</para>
+</listitem>
+</varlistentry>
+<varlistentry>
+ <term>tempcomp</term>
+ <listitem>
+<para>
+ This option logs the temperature measurements and system rate compensations to a file
called <filename>tempcomp.log</filename>.
+</para>
+</listitem>
+</varlistentry>
+<varlistentry>
+ <term>refclocks</term>
+ <listitem>
+<para>
+ This option logs the raw and filtered reference clock measurements to a file called
<filename>refclocks.log</filename>.
+</para>
+</listitem>
+</varlistentry>
+
+<varlistentry>
+ <term>refclocks</term>
+ <listitem>
+<para>
+ This option logs the raw and filtered reference clock measurements to a file called
<filename>refclocks.log</filename>.
+</para>
+</listitem>
+</varlistentry>
+</variablelist>
+
+
+
+
+The files are written to the directory specified by the
<command>logdir</command> command.
+
+An example of the command is:
+
+<screen>log measurements statistics tracking</screen>
+
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>logdir</term>
+ <listitem>
+ <para>
+This directive allows the directory where log files are written to be specified.
+
+An example of the use of this directive is:
+<screen>logdir /var/log/chrony</screen>
+
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>makestep</term>
+ <listitem>
+ <para>
+ Normally <systemitem
class="daemon">chronyd</systemitem> will cause the system to gradually
correct any time offset, by slowing down or speeding up the clock as required. In certain
situations, the system clock may be so far adrift that this slewing process would take a
very long time to correct the system clock. This directive forces <systemitem
class="daemon">chronyd</systemitem> to step system clock if the
adjustment is larger than a threshold value, but only if there were no more clock updates
since <systemitem class="daemon">chronyd</systemitem> was started
than a specified limit (a negative value can be used to disable the limit). This is
particularly useful when using reference clocks, because the
<command>initstepslew</command> directive only works with <systemitem
class="protocol">NTP</systemitem> sources.</para>
+ <para>
+An example of the use of this directive is:
+<screen>makestep 1000 10</screen>
+This would step the system clock if the adjustment is larger than 1000 seconds, but only
in the first ten clock updates.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>maxchange</term>
+ <listitem>
+ <para>
+ This directive sets the maximum allowed offset corrected on a clock update.
The check is performed only after the specified number of updates to allow a large initial
adjustment of the system clock. When an offset larger than the specified maximum occurs,
it will be ignored for the specified number of times and then <systemitem
class="daemon">chronyd</systemitem> will give up and exit (a negative
value can be used to never exit). In both cases a message is sent to syslog.</para>
+ <para>
+An example of the use of this directive is:
+<screen>maxchange 1000 1 2</screen>
+After the first clock update, <systemitem
class="daemon">chronyd</systemitem> will check the offset on every
clock update, it will ignore two adjustments larger than 1000 seconds and exit on another
one.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>maxupdateskew</term>
+ <listitem>
+ <para>
+One of <systemitem class="daemon">chronyd</systemitem>'s tasks
is to work out how fast or slow the computer’s clock runs relative to its reference
sources. In addition, it computes an estimate of the error bounds around the estimated
value.
+
+If the range of error is too large, it probably indicates that the measurements have not
settled down yet, and that the estimated gain or loss rate is not very reliable.
+
+The <command>maxupdateskew</command> parameter allows the threshold for
determining whether an estimate may be so unreliable that it should not be used. By
default, the threshold is 1000 ppm.
+
+The format of the syntax is:
+
+<screen>maxupdateskew
<replaceable>skew-in-ppm</replaceable></screen>
+
+Typical values for <replaceable>skew-in-ppm</replaceable> might be 100 for a
dial-up connection to servers over a telephone line, and 5 or 10 for a computer on a LAN.
+
+It should be noted that this is not the only means of protection against using unreliable
estimates. At all times, <systemitem
class="daemon">chronyd</systemitem> keeps track of both the estimated
gain or loss rate, and the error bound on the estimate. When a new estimate is generated
following another measurement from one of the sources, a weighted combination algorithm is
used to update the master estimate. So if <systemitem
class="daemon">chronyd</systemitem> has an existing highly-reliable
master estimate and a new estimate is generated which has large error bounds, the existing
master estimate will dominate in the new master estimate.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>noclientlog</term>
+ <listitem>
+ <para>
+This directive, which takes no arguments, specifies that client accesses are not to be
logged. Normally they are logged, allowing statistics to be reported using the clients
command in <application>chronyc</application>.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>reselectdist</term>
+ <listitem>
+ <para>
+ When <systemitem class="daemon">chronyd</systemitem>
selects synchronisation source from available sources, it will prefer the one with minimum
synchronization distance. However, to avoid frequent reselecting when there are sources
with similar distance, a fixed distance is added to the distance for sources that are
currently not selected. This can be set with the <option>reselectdist</option>
option. By default, the distance is 100 microseconds.</para>
+ <para>
+The format of the syntax is:
+<screen>reselectdist
<replaceable>dist-in-seconds</replaceable></screen>
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>stratumweight</term>
+ <listitem>
+ <para>
+ The <command>stratumweight</command> directive sets how much
distance should be added per stratum to the synchronisation distance when <systemitem
class="daemon">chronyd</systemitem> selects the synchronisation source
from available sources.</para>
+ <para>
+The format of the syntax is:
+<screen>stratumweight
<replaceable>dist-in-seconds</replaceable></screen>
+By default, <replaceable>dist-in-seconds</replaceable> is 1 second. This
usually means that sources with lower stratum will be preferred to sources with higher
stratum even when their distance is significantly worse. Setting
<command>stratumweight</command> to 0 makes <systemitem
class="daemon">chronyd</systemitem> ignore stratum when selecting the
source.
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>rtcfile</term>
+ <listitem>
+ <para>
+The <command>rtcfile</command> directive defines the name of the file in
which <systemitem class="daemon">chronyd</systemitem> can save
parameters associated with tracking the accuracy of the system’s real-time clock (RTC).
+
+The format of the syntax is:
+
+<screen>rtcfile /etc/chrony.rtc</screen>
+
+<systemitem class="daemon">chronyd</systemitem> saves information
in this file when it exits and when the writertc command is issued in
<application>chronyc</application>. The information saved is the RTC’s error
at some epoch, that epoch (in seconds since January 1 1970), and the rate at which the RTC
gains or loses time.
+
+Not all real-time clocks are supported as their code system-specific.
+ </para>
+ </listitem>
+ </varlistentry>
+
+ </variablelist>
+</para>
+ </section>
+
+<section id="sect-Networking_Guide-Security_with_chronyc">
+ <title>Security with chronyc</title>
+ <para>
+ As access to <application>chronyc</application> allows changing
<systemitem class="daemon">chronyd</systemitem> just as editing the
configuration files would, access to <application>chronyc</application> should
be limited. Passwords or their hashes can be specified in the key file, to restrict the
use of <application>chronyc</application>. One of the entries is used to
restrict the use of operational commands and is referred to as the command key. In the
default configuration, a random command key is generated automatically on start. It should
not be necessary to specify or alter it manually.</para>
+ <para>Other entries in the key file can be used as <systemitem
class="protocol">NTP</systemitem> keys to authenticate packets received
from remote <systemitem class="protocol">NTP</systemitem> servers or
peers. The two sides need to share a key with identical ID, hash type and password in
their key file. This requires manually creating the keys and copying them over a secure
medium, such as <systemitem class="protocol">SSH</systemitem>. If
the key ID was, for example, 10 then the systems that act as clients must have a line in
their configuration files in the following format:
+ <screen>server w.x.y.z key 10
+peer w.x.y.z key 10
+ </screen>
+ </para>
+ <para>
+ The location of the key file is specified in the
<filename>/etc/chrony.conf</filename> file. The default entry in the
configuration file is:
+ <screen><command>keyfile</command>
<option>/etc/chrony.keys</option></screen>
+ </para>
+ <para>
+ The command key number is specified in
<filename>/etc/chrony.conf</filename> using the
<command>commandkey</command> directive, it is the key <systemitem
class="daemon">chronyd</systemitem> will use for authentication of user
commands. The directive in the configuration file takes the following form:
+ <screen>commandkey 1</screen>
+ </para>
+ <para>
+ An example of the format of the default entry in the key file,
<filename>/etc/chrony.keys</filename>, for the command key is:
+ <screen>1 SHA1 HEX:A6CFC50C9C93AB6E5A19754C246242FC5471BCDF</screen>
+ Where <literal>1</literal> is the key ID, SHA1 is the hash function to
use, <literal>HEX</literal> is the format of the key, and
<literal>A6CFC50C9C93AB6E5A19754C246242FC5471BCDF</literal> is the key
randomly generated when <application>chronyc</application> was started for the
first time. The key can be given in hexidecimal or ASCII format (the default).
+ </para>
+ <para>
+ A manual entry in the key file, used to authenticate packets from certain
<systemitem class="protocol">NTP</systemitem> servers or peers, can
be as simple as the following:
+ <screen>20 foobar</screen>
+ Were <literal>20</literal> is the key ID and
<literal>foobar</literal> is the secret authentication key. The default hash
is MD5, and ASCII is the default format for the key.
+ </para>
+ <para>
+ By default, <systemitem class="daemon">chronyd</systemitem>
is configured to listen for commands only from <systemitem
class="systemname">localhost</systemitem> (<systemitem
class="ipaddress">127.0.0.1</systemitem> and <systemitem
class="ipaddress">::1</systemitem>). To access <systemitem
class="daemon">chronyd</systemitem> remotely with
<application>chronyc</application>, any
<command>bindcmdaddress</command> directives in the
<filename>/etc/chrony.conf</filename> file should be removed to enable
listening on all interfaces and the <command>cmdallow</command> directive
should be used to allow commands from the remote IP address, network, or subnet. Note that
the <command>allow</command> directive is for <systemitem
class="protocol">NTP</systemitem> access whereas the
<command>cmdallow</command> directive is to enable the receiving of remote
commands. It is possible to make these changes temporarily using
<application>chronyc</application> running locally. Edit the c
onfiguration file to make persistent changes.
+ </para>
+ <para>
+ The communication between <application>chronyc</application> and
<application>chronyd</application> is done over <systemitem
class="protocol">UDP</systemitem>, so it needs to be authorized before
issuing operational commands. To authorize, use the
<command>authhash</command> and <command>password</command>
commands as follows:
+ <screen>chronyc> <command>authhash SHA1</command>
+chronyc> <command>password
HEX:A6CFC50C9C93AB6E5A19754C246242FC5471BCDF</command>
+200 OK</screen>
+ Alternatively, you can use the <application>chrony-helper</application>
wrapper, which will do that automatically. For example, to use the
<command>reselect</command> command:
+ <screen>~]# <command>/usr/libexec/chrony-helper command
reselect</command></screen>
+ </para>
+ <!--
+<note>
+ <para>
+ <remark>this note applies to Fedora 19 only, the latest chrony (1.28-pre1) is
now current in RHEL 7 . In my Fed 19 VM it still has chrony-1.27-1.fc19</remark> At
the time of writing, the upstream version of
<application>chronyc</application> now supports automatic authentication with
the new <option>-a</option> option. This will allow issuing commands on one
line, without having to specify the password, as follows:
+ <screen>~]# <command>chronyc -a reselect</command></screen>.
+ </para>
+</note>
+-->
+
+<para>
+ Only the following commands can be used without providing a password:
+ <simplelist type='inline'>
+ <member>
+ <command>activity</command>
+ </member>
+ <member>
+ <command>authhash</command>
+ </member>
+ <member>
+ <command>dns</command>
+ </member>
+ <member>
+ <command>exit</command>
+ </member>
+ <member>
+ <command>help</command>
+ </member>
+ <member>
+ <command>password</command>
+ </member>
+ <member>
+ <command>quit</command>
+ </member>
+ <member>
+ <command>rtcdata</command>
+ </member>
+ <member>
+ <command>sources</command>
+ </member>
+ <member>
+ <command>sourcestats</command>
+ </member>
+ <member>
+ <command>tracking</command>
+ </member>
+ <member>
+ <command>waitsync</command>
+ </member>
+ </simplelist>.
+</para>
+ </section>
+
+ <!--Topics, Tasks:-->
+
+<section id="sect-Networking_Guide-Checking_if_chrony_is_installed">
+ <title>Checking if chrony is installed</title>
+ <para>
+ To check if <application>chrony</application> is installed, run the
following command as root:
+ <screen>~]# yum install chrony</screen>
+ The default location for the <application>chrony</application>
daemon is <filename>/usr/local/sbin/chronyd</filename>.
+ </para>
+ </section>
+
+ <section id="sect-Networking_Guide-Installing_chrony">
+ <title>Installing chrony</title>
+ <para>
+To install <application>chrony</application>, run the following command as
root:
+ <screen>~]# yum install chrony -y</screen>
+ The default installation directory is
<filename>/usr/local/sbin/</filename>
+ </para>
+ </section>
+
+
+ <section id="sect-Checking_the_Status_of_chronyd">
+ <title>Checking the Status of chronyd</title>
+ <para>
+ To check the status of <systemitem
class="daemon">chronyd</systemitem>, issue the following command:
+ <screen>~]$ <command>systemctl status chronyd</command>
+chronyd.service - NTP client/server
+ Loaded: loaded (/usr/lib/systemd/system/chronyd.service; enabled)
+ Active: active (running) since Wed 2013-06-12 22:23:16 CEST; 11h ago</screen>
+ </para>
+ </section>
+ <section id="sect-Networking_Guide-Starting_chronyd">
+ <title>Starting chronyd</title>
+ <para>
+ To start <systemitem
class="daemon">chronyd</systemitem>, issue the following command as
root:
+ <screen>~]# <command>systemctl start
chronyd</command></screen>
+ </para>
+ <para>
+ To ensure <systemitem
class="daemon">chronyd</systemitem> starts automatically at system
start, issue the following command as root:
+ <screen>~]# <command>systemctl enable
chronyd</command></screen>
+ </para>
+ <para>
+ </para>
+ </section>
+ <section id="sect-Networking_Guide-Stopping_chronyd">
+ <title>Stopping chronyd</title>
+ <para>
+ To stop <systemitem
class="daemon">chronyd</systemitem>, issue the following command as
root:
+ <screen>~]# <command>systemctl stop
chronyd</command></screen>
+ </para>
+ <para>
+ To prevent <systemitem
class="daemon">chronyd</systemitem> from starting automatically at
system start, issue the following command as root:
+ <screen>~]# <command>systemctl disable
chronyd</command></screen>
+ </para>
+ </section>
+
+
+ <section
id="sect-Networking_Guide-Checking_if_chrony_is_synchronized">
+ <title>Checking if chrony is Synchronized</title>
+ <para>
+ To check if <application>chrony</application> is synchronized, make use
of the <command>tracking</command>, <command>sources</command>,
and <command>sourcestats</command> commands.
+ </para>
+
+ <section id="sect-Networking_Guide-Checking_chrony_tracking">
+ <title>Checking chrony tracking</title>
+
+ <para>
+ To check chrony tracking, issue the following command:
+ <screen>~]$ <command>chronyc tracking</command>
+Reference ID : 1.2.3.4 (a.b.c)
+Stratum : 3
+Ref time (UTC) : Fri Feb 3 15:00:29 2012
+System time : 0.000001501 seconds slow of NTP time
+Last offset : -0.000001632 seconds
+RMS offset : 0.000002360 seconds
+Frequency : 331.898 ppm fast
+Residual freq : 0.004 ppm
+Skew : 0.154 ppm
+Root delay : 0.373169 seconds
+Root dispersion : 0.024780 seconds
+Update interval : 64.2 seconds
+Leap status : Normal
+ </screen>
+ The fields are as follows:
+ </para>
+ <variablelist>
+ <varlistentry>
+ <term>Reference ID</term>
+ <listitem>
+ <para>
+ This is the refid and name (or IP address) if available, of the server to which the
computer is currently synchronised. If this is 127.127.1.1 it means the computer is not
synchronised to any external source and that you have the ‘local’ mode operating (via the
local command in chronyc (see section local), or the <command>local</command>
directive in the ‘/etc/chrony.conf’ file (see section local)). </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>Stratum</term>
+ <listitem>
+ <para>
+ The stratum indicates how many hops away from a computer with an attached reference
clock we are. Such a computer is a stratum-1 computer, so the computer in the example is
two hops away (i.e. a.b.c is a stratum-2 and is synchronised from a
stratum-1).</para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Ref time</term>
+ <listitem>
+ <para>
+ This is the time (UTC) at which the last measurement from the reference source was
processed.</para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>System time</term>
+ <listitem>
+ <para>
+ In normal operation, <systemitem
class="daemon">chronyd</systemitem> never steps the system clock,
because any jump in the timescale can have adverse consequences for certain application
programs. Instead, any error in the system clock is corrected by slightly speeding up or
slowing down the system clock until the error has been removed, and then returning to the
system clock’s normal speed. A consequence of this is that there will be a period when the
system clock (as read by other programs using the gettimeofday() system call, or by the
date command in the shell) will be different from chronyd's estimate of the current
true time (which it reports to <systemitem
class="protocol">NTP</systemitem> clients when it is operating in
server mode). The value reported on this line is the difference due to this
effect.</para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Last offset</term>
+ <listitem>
+ <para>
+ This is the estimated local offset on the last clock update.</para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>RMS offset</term>
+ <listitem>
+ <para>
+ This is a long-term average of the offset value.</para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Frequency</term>
+ <listitem>
+ <para>
+ The ‘frequency’ is the rate by which the system’s clock would be would be
wrong if <systemitem class="daemon">chronyd</systemitem> was not
correcting it. It is expressed in ppm (parts per million). For example, a value of 1ppm
would mean that when the system’s clock thinks it has advanced 1 second, it has actually
advanced by 1.000001 seconds relative to true time. </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Residual freq</term>
+ <listitem>
+ <para>
+ This shows the ‘residual frequency’ for the currently selected reference source. This
reflects any difference between what the measurements from the reference source indicate
the frequency should be and the frequency currently being used.
+
+ The reason this is not always zero is that a smoothing procedure is applied to the
frequency. Each time a measurement from the reference source is obtained and a new
residual frequency computed, the estimated accuracy of this residual is compared with the
estimated accuracy (see ‘skew’ next) of the existing frequency value. A weighted average
is computed for the new frequency, with weights depending on these accuracies. If the
measurements from the reference source follow a consistent trend, the residual will be
driven to zero over time.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Skew</term>
+ <listitem>
+ <para>
+ This is the estimated error bound on the frequency. </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Root delay</term>
+ <listitem>
+ <para>
+ This is the total of the network path delays to the stratum-1 computer from which the
computer is ultimately synchronised.
+
+ In certain extreme situations, this value can be negative. (This can arise in a
symmetric peer arrangement where the computers’ frequencies are not tracking each other
and the network delay is very short relative to the turn-around time at each computer.)
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Root dispersion</term>
+ <listitem>
+ <para>
+This is the total dispersion accumulated through all the computers back to the stratum-1
computer from which the computer is ultimately synchronised. Dispersion is due to system
clock resolution, statistical measurement variations etc. </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term> Leap status</term>
+ <listitem>
+ <para>
+ This is the leap status, which can be Normal, Insert second, Delete second or Not
synchronised.
+ </para>
+ </listitem>
+ </varlistentry>
+</variablelist>
+</section>
+
+ <section id="sect-Networking_Guide-Checking_chrony_sources">
+ <title>Checking chrony sources</title>
+<para>
+ The sources command displays information about the current time sources that
<systemitem class="daemon">chronyd</systemitem> is accessing.
+
+The optional argument -v can be specified, meaning verbose. In this case, extra caption
lines are shown as a reminder of the meanings of the columns.
+ <screen>~]$ <command>chronyc sources</command>
+ 210 Number of sources = 3
+MS Name/IP address Stratum Poll Reach LastRx Last sample
+===============================================================================
+#* GPS0 0 4 377 11 -479ns[ -621ns] +/- 134ns
+^? a.b.c 2 6 377 23 -923us[ -924us] +/- 43ms
+^+ d.e.f 1 6 377 21 -2629us[-2619us] +/- 86ms
+
+</screen>
+The columns are as follows:
+<variablelist>
+ <varlistentry>
+ <term>M</term>
+ <listitem>
+ <para>
+This indicates the mode of the source. ^ means a server, = means a peer and # indicates a
locally connected reference clock.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>S</term>
+ <listitem>
+ <para>
+This column indicates the state of the sources. * indicates the source to which
<systemitem class="daemon">chronyd</systemitem> is current
synchronised. + indicates other acceptable sources. ? indicates sources to which
connectivity has been lost. x indicates a clock which <systemitem
class="daemon">chronyd</systemitem> thinks is is a falseticker (i.e.
its time is inconsistent with a majority of other sources). ~ indicates a source whose
time appears to have too much variability. The ~ condition is also shown at start-up,
until at least 3 samples have been gathered from it.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Name/IP address</term>
+ <listitem>
+ <para>
+This shows the name or the IP address of the source, or refid for reference clocks.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Stratum</term>
+ <listitem>
+ <para>
+This shows the stratum of the source, as reported in its most recently received sample.
Stratum 1 indicates a computer with a locally attached reference clock. A computer that is
synchronised to a stratum 1 computer is at stratum 2. A computer that is synchronised to a
stratum 2 computer is at stratum 3, and so on.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Poll</term>
+ <listitem>
+ <para>
+ This shows the rate at which the source is being polled, as a base-2 logarithm of the
interval in seconds. Thus, a value of 6 would indicate that a measurement is being made
every 64 seconds.
+
+ <systemitem class="daemon">chronyd</systemitem> automatically
varies the polling rate in response to prevailing conditions.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Reach</term>
+ <listitem>
+ <para>
+ This shows the source’s reachability register printed as octal number. The register
has 8 bits and is updated on every received or missed packet from the source. A value of
377 indicates that a valid reply was received for all from the last eight transmissions.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>LastRx</term>
+ <listitem>
+ <para>
+ This column shows how long ago the last sample was received from the source. This is
normally in seconds. The letters m, h, d or y indicate minutes, hours, days or years. A
value of 10 years indicates there were no samples received from this source yet.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Last sample</term>
+ <listitem>
+ <para>
+ This column shows the offset between the local clock and the source at the last
measurement. The number in the square brackets shows the actual measured offset. This may
be suffixed by <literal>ns</literal> (indicating nanoseconds),
<literal>us</literal> (indicating microseconds),
<literal>ms</literal> (indicating milliseconds), or
<literal>s</literal> (indicating seconds). The number to the left of the
square brackets shows the original measurement, adjusted to allow for any slews applied to
the local clock since. The number following the <literal>+/-</literal>
indicator shows the margin of error in the measurement. Positive offsets indicate that the
local clock is fast of the source.
+ </para>
+ </listitem>
+ </varlistentry>
+
+</variablelist>
+</para>
+</section>
+
+<section id="sect-Networking_Guide-Checking_chrony_sourcestats">
+ <title>Checking chrony sourcestats</title>
+ <para>
+ The <command>sourcestats</command> command displays information about the
drift rate and offset estimation process for each of the sources currently being examined
by <systemitem class="daemon">chronyd</systemitem>.
+
+The optional argument <option>-v</option> can be specified, meaning verbose.
In this case, extra caption lines are shown as a reminder of the meanings of the columns.
+ <screen>~]$ <command>chronyc sourcestats</command>
+
+
+210 Number of sources = 1
+Name/IP Address NP NR Span Frequency Freq Skew Offset Std Dev
+===============================================================================
+abc.def.ghi
+</screen>
+
+The columns are as follows:
+<variablelist>
+
+ <varlistentry>
+ <term>Name/IP address</term>
+ <listitem>
+ <para>
+This is the name or IP address of the <systemitem
class="protocol">NTP</systemitem> server (or peer) or refid of the
refclock to which the rest of the line relates.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>NP</term>
+ <listitem>
+ <para>
+ This is the number of sample points currently being retained for the server. The
drift rate and current offset are estimated by performing a linear regression through
these points.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>NR</term>
+ <listitem>
+ <para>
+This is the number of runs of residuals having the same sign following the last
regression. If this number starts to become too small relative to the number of samples,
it indicates that a straight line is no longer a good fit to the data. If the number of
runs is too low, <systemitem class="daemon">chronyd</systemitem>
discards older samples and re-runs the regression until the number of runs becomes
acceptable.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Span</term>
+ <listitem>
+ <para>
+ This is the interval between the oldest and newest samples. If no unit is shown the
value is in seconds. In the example, the interval is 46 minutes.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Frequency</term>
+ <listitem>
+ <para>
+ This is the estimated residual frequency for the server, in parts per million. In
this case, the computer’s clock is estimated to be running 1 part in 10**9 slow relative
to the server.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Freq Skew</term>
+ <listitem>
+ <para>
+This is the estimated error bounds on Freq (again in parts per million).
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Offset</term>
+ <listitem>
+ <para>
+ This is the estimated offset of the source.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term>Std Dev</term>
+ <listitem>
+ <para>
+ This is the estimated sample standard deviation.
+ </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ </para>
+ </section>
+</section>
+
+<section id="sect-Networking_Guide-Adjusting-the-System_Clock">
+ <title>Manualy Adjusting the System Clock</title>
+ <para>
+ To update, or step, the system clock immediately, bypassing any adjustments in
progress by slewing the clock, issue the following commands as root:
+ <screen>~]# <command>chronyc</command>
+ chrony> <command>password</command>
+ 200 OK
+ chrony> <command>makestep</command>
+ 200 OK</screen>
+
+</para>
+<para>
+ In &MAJOROS;, the real-time clock should not be manually adjusted as this would
interfere with <application>chrony</application>'s need to measure the
rate at which the real-time clock drifts if it was adjusted at random intervals. By
default, <application>rtcsync</application> will inform the kernel the system
clock is synchronized and the kernel will update the real-time clock in 11 minute
intervals.
+</para>
+</section>
+
+<section
id="sect-Networking_Guide-Setting_up_chrony_for_a_system_which_is_infrequently_connected">
+ <title>Setting up chrony for a system which is infrequently
connected</title>
+ <para>
+ This example is intended for systems which use dial-on-demand connections. The normal
configuration should be sufficient for mobile and virtual devices which connect
intermittently. First, review and confirm that the default settings in the
<filename>/etc/chrony.conf</filename> are similar to the following:
+ <screen>driftfile /var/lib/chrony/drift
+commandkey 1
+keyfile /etc/chrony.keys
+</screen>
+The command key ID is generated at install time and should correspond with the
<command>commandkey</command> value in the key file,
<filename>/etc/chrony.keys</filename>.
+</para>
+
+ <para>
+ <orderedlist>
+ <listitem>
+ <para>
+ Using your editor running as root, add the addresses of four <systemitem
class="protocol">NTP</systemitem> servers as follows:
+ <screen>
+server
0.pool.ntp.org offline
+server
1.pool.ntp.org offline
+server
2.pool.ntp.org offline
+server
3.pool.ntp.org offline
+</screen>
+The <option>offline</option> option can be useful in preventing systems from
trying to activate connections. The <application>chrony</application> daemon
will wait for <application>chronyc</application> to inform it that the system
is connected to the network or Internet.
+ </para>
+ </listitem>
+ </orderedlist>
+ </para>
+
+ <section
id="sect-Networking_Guide-Configuring_chrony_to_connect_and_disconnect">
+ <title>Configuring chrony to Connect and Disconnect</title>
+<para>
+Using your editor running as root, add the following to the
<filename>/etc/ppp/ip-up</filename> file:
+ <screen>
+/usr/local/bin/chronyc
+password <replaceable>commandkey-password</replaceable>
+online
+</screen>
+</para>
+
+<para>
+Using your editor running as root, add the following to the
<filename>/etc/ppp/ip-down</filename> file:
+ <screen>
+/usr/local/bin/chronyc
+password <replaceable>commandkey-password</replaceable>
+offline
+</screen>
+
+</para>
+<para>
+ The <application>chrony</application> daemon, <systemitem
class="daemon">chronyd</systemitem>, will now only poll the
<systemitem class="protocol">NTP</systemitem> servers when the
<systemitem class="protocol">Point-To-Point</systemitem> link is
activated.
+</para>
+</section>
+
+ </section>
+
+
+ <section
id="sect-Networking_Guide-Setting_up_chrony_for_a_system_in_an_isolated_network">
+ <title>Setting up chrony for a System in an Isolated Network</title>
+ <para>
+ For a network that is never connected to the Internet, one computer is selected to
be the master timeserver. The other computers are either direct clients of the master, or
clients of clients. On the master, the drift file must be manually set with the average
rate of drift of the system clock. If the master is rebooted it will obtain the time from
surrounding systems and take an average to set its system clock. Thereafter it resumes
applying adjustments based on the drift file. The drift file will be updated automatically
when the <command>settime</command> command is used.
+ </para>
+ <para>
+ On the system selected to be the master, using a text editor running as root, edit
the <filename>/etc/chrony.conf</filename> as follows:
+ <screen>
+driftfile /var/lib/chrony/drift
+commandkey 1
+keyfile /etc/chrony.keys
+initstepslew 10 client1 client3 client6
+local stratum 8
+manual
+allow 192.0.2.0
+ </screen>
+ Where <systemitem class="ipaddress">192.0.2.0</systemitem> is
the network or subnet address from which the clients are allowed to connect.</para>
+ <para>
+ On the systems selected to be direct clients of the master, using a text editor
running as root, edit the <filename>/etc/chrony.conf</filename> as follows:
+ <screen>server master
+driftfile /var/lib/chrony/drift
+logdir /var/log/chrony
+log measurements statistics tracking
+keyfile /etc/chrony.keys
+commandkey 24
+local stratum 10
+initstepslew 20 master
+allow 192.0.2.123</screen>
+Where <systemitem class="ipaddress">192.0.2.123</systemitem> is the
address of the master, and <systemitem
class="systemname">master</systemitem> is the host name of the master.
These clinet will resynchronize the master if it restarts.
+ </para>
+
+ <para>
+ On the client systems which are not to be direct clients of the master, the
<filename>/etc/chrony.conf</filename> file should be the same except that the
<option>local</option> and <option>allow</option> directives
should be omitted.
+ </para>
+
+ </section>
+
+<section
id="sect-Networking_Guide-Using_chronyc_chronyc_to_control_cronyd">
+ <title>Using chronyc to control cronyd</title>
+ <para>
+ To make changes using the command line utility
<application>chronyc</application> in interactive mode, enter the following
command as root:
+ <screen>~]# chronyc</screen>
+ <application>chronyc</application> must run as root if some
of the restricted commands are to be used.
+ </para>
+ <para>
+ The <application>chronyc</application> command prompt will be
displayed as follows:</para>
+ <screen>/chronyc></screen>
+ <para>
+ You can type <command>help</command> to list all of the commands.
+ </para>
+
+ <para>
+ The utility can also be invoked in non-interactive command mode if called
together with an option as follows:
+ <screen>~]# <command>chronyc
<replaceable>option</replaceable></command></screen>
+ </para>
+ </section>
+
+<section
id="sect-Networking_Guide-Using_chronyc_for_remote_administration">
+<title>Using chronyc for remote administration</title>
+<para>
+To configure <application>chrony</application> to connect to a remote
instance of <systemitem class="daemon">chronyd</systemitem>, issue a
command as root in the following format:
+<screen>~]# <command>chronyc <option>-h</option>
<replaceable>hostname</replaceable></command></screen>
+Where <replaceable>hostname</replaceable> is the <systemitem
class="systemname">hostname</systemitem> of a system running
<systemitem class="daemon">chronyd</systemitem> to connect to in
order to allow remote administration from that host. The default is to connect to the
daemon on the localhost.
+</para>
+<para>
+To configure <application>chrony</application> to connect to a remote
instance of <systemitem class="daemon">chronyd</systemitem> on a
non-default port, issue a command as root in the following format:
+<screen>~]# <command>chronyc <option>-p</option>
<replaceable>port</replaceable></command></screen>
+Where <replaceable>port</replaceable> is the port in use for controlling and
monitoring by the instance of <systemitem
class="daemon">chronyd</systemitem> to be connected to.
+ </para>
+ <para>
+Note that commands issued at the <application>chrony</application> command
prompt are not persistent. Only commands in the configuration file are persistent.
+ </para>
+
+ <para>
+ From the remote systems, the system administrator can issue commands after
first using the <command>password</command> command at the
<application>chronyc</application> command prompt as follows:
+ <screen>chronyc> <command>password
secretpasswordwithnospaces</command>
+200 OK</screen>
+ Alternatively, the remote system can use the chrony-helper wrapper, which will do
that automatically. For example, to use the <command>reselect</command>
command:
+ <screen>~]# <command>/usr/libexec/chrony-helper command
reselect</command></screen>
+ </para>
+
+ <para>
+ The password or hash associated with the command key for a remote system is best
obtained by <systemitem class="protocol">SSH</systemitem>. That is
to say, an <systemitem class="protocol">SSH</systemitem> connection
should be established to the remote machine and the ID of the command key from
<filename>/etc/chrony.conf</filename> and the command key in
<filename>/etc/chrony.keys</filename> memorised or stored securly for the
duration of the session.
+ </para>
+
+ </section>
+
+<!--Topics, Reference-->
+ <section id="sect-Networking_Guide-additional_resources">
+
+ <title>Additional Resources</title>
+ <para>
+ The following sources of information provide additional resources regarding
<application>chrony</application>.
+ </para>
+<section id="s2-chrony-docs-inst">
+ <title>Installed Documentation</title>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <filename>chrony(1)</filename> man page — Introduces the
<application>chrony</application> daemon and the command-line interface tool.
+ </para>
+ </listitem>
+ </itemizedlist>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <filename>chronyc(1)</filename> man page — Describes the
<application>chronyc</application> command-line interface tool including
commands and command options.
+ </para>
+ </listitem>
+ </itemizedlist>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <filename>chronyd(1)</filename> man page — Describes the
<application>chronyd</application> daemon including commands and command
options.
+ </para>
+ </listitem>
+ </itemizedlist>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <filename>chrony.conf(5)</filename> man page — Describes the
<application>chrony</application> configuration file.
+ </para>
+ </listitem>
+<listitem>
+ <para>
+ <filename>chrony.conf(5)</filename> man page — User guide for the
<application>chrony</application> suite.
+ </para>
+ </listitem>
+<listitem>
+ <para>
+ <filename>/usr/share/doc/chrony*/chrony.txt</filename> — User guide
for the <application>chrony</application> suite.
+ </para>
+ </listitem>
+ </itemizedlist>
+ </section>
+
+<section id="s2-chrony_Useful_Websites">
+ <title>Useful Websites</title>
+<variablelist>
+ <varlistentry>
+<term><ulink
url="http://chrony.tuxfamily.org/manual.html"/></term>
+<listitem>
+<para>
+ The on-line user guide for <application>chrony</application>.
+</para>
+</listitem>
+</varlistentry>
+</variablelist>
+</section>
+
+</section>
+
+</chapter>
+
+
+
+
+