NTP time sources ignored by chrony in Ubuntu 26.04 LTS
Ubuntu 26.04 runs chrony as it’s default time sync. service. This is nice, but the way they have configured it has a gotcha.
The default sources are defined in /etc/chrony/sources.d/ubuntu-ntp-pools.sources. The default contents of this file are:
# Use NTS by default
# NTS uses an additional port to negotiate security: 4460/tcp
# The normal NTP port remains in use: 123/udp
pool 1.ntp.ubuntu.com iburst maxsources 1 nts prefer
pool 2.ntp.ubuntu.com iburst maxsources 1 nts prefer
pool 3.ntp.ubuntu.com iburst maxsources 1 nts prefer
pool 4.ntp.ubuntu.com iburst maxsources 1 nts prefer
# The bootstrap server is needed by systems without a hardware clock, or a very
# large initial clock offset. The specified certificate set is defined in
# /etc/chrony/conf.d/ubuntu-nts.conf.
pool ntp-bootstrap.ubuntu.com iburst maxsources 1 nts certset 1
# If you can't or won't use NTS, then here are the old NTP-only definitions
# This will use (up to):
# - 4 sources from ntp.ubuntu.com which some are ipv6 enabled
# - 2 sources from 2.ubuntu.pool.ntp.org which is ipv6 enabled as well
# - 1 source from [01].ubuntu.pool.ntp.org each (ipv4 only atm)
# This means by default, up to 6 dual-stack and up to 2 additional IPv4-only
# sources will be used.
# At the same time it retains some protection against one of the entries being
# down (compare to just using one of the lines). See (LP: #1754358) for the
# discussion.
#
# About using servers from the NTP Pool Project in general see (LP: #104525).
# Approved by Ubuntu Technical Board on 2011-02-08.
# See http://www.pool.ntp.org/join.html for more information.
#pool ntp.ubuntu.com iburst maxsources 4
#pool 0.ubuntu.pool.ntp.org iburst maxsources 1
#pool 1.ubuntu.pool.ntp.org iburst maxsources 1
#pool 2.ubuntu.pool.ntp.org iburst maxsources 2
We use local campus time sources, and added them in a separate .sources file. After reloading the sources and checking with
chronyc sources
our sources all came up with ^- status, which meant that they were all being contacted and monitored, but ignored. As this system cannot directly reach the outside world all the ubuntu pool sources were showing ^? (no contact). The result was that time sync was not happening.
The documentation suggests that as the ubuntu sources have prefer added to them, any non-preferred sources will be ignored. So we added prefer to our sources.
server ntp0.domain.name iburst prefer
server ntp1.domain.name iburst prefer
server ntp2.domain.name iburst prefer
After re-reading sources, then restarting the service, our sources were still ignored.
Disabling the ubuntu pool sources (change the filename to end in anything else - I use filename.sources.DISABLED to make it obvious) and rereading the sources then resulted in our sources actually being used.
I suspect even preferring our sources, the fact that they aren’t NTS sources meant they were being ignored in favour of the ubuntu sources, which are configured for NTS by default (as can be seen in the conf file above).