Chrony NTP Time Server on Ubuntu 24.04 LTS
par cloudimg
Chrony NTP time server on Ubuntu 24.04: high accuracy, secure by default, not an open amplifier
Chrony is a versatile, high accuracy implementation of the Network Time Protocol (NTP) and the modern default time daemon on most Linux systems. This cloudimg image delivers Chrony 4.5 fully installed and configured on Ubuntu 24.04 LTS as a hardened systemd service, so a working, secure NTP time server for your network is answering queries within minutes of launch.
Accurate time is foundational infrastructure. TLS certificate validation, Kerberos and Active Directory authentication, distributed databases, log correlation and audit timestamps all break in subtle ways when clocks drift. Chrony keeps this server, and every client that synchronises against it, correct to well under a millisecond, and it recovers from network interruptions and large offsets far better than the legacy ntpd it replaces. It serves NTP on UDP port 123 and is administered entirely from the command line with chronyc, so there is no database and no web console to manage.
On Azure the server also reads the Hyper V host clock, which is itself disciplined to Microsoft stratum 1 time sources, through a PTP hardware reference clock configured automatically on first boot, giving sub millisecond, network independent accuracy. The public NTP pool is configured as a resilient fallback source.
Security is built in and this image is not an open amplifier, which removes the reflection and amplification abuse risk of a naively deployed public time server. The configuration serves NTP only to the local host and the private RFC1918 network ranges, a documented and scoped allow list rather than allow all, so a query from a public internet address is dropped. The chronyc command interface is bound to the local host only, and Chrony has no legacy monlist command at all. There are no shared or default credentials of any kind, since an NTP server has no login.
Chrony is distributed under the GNU General Public License version 2, free and open source with no per CPU or per deployment fee. cloudimg is not affiliated with or endorsed by the Chrony project; Chrony is a mark of its owner. cloudimg provides packaging, the secure by default scoped configuration, the Azure PTP reference clock automation, security patching, and 24/7 support with a guaranteed 24 hour response SLA.