NTP Time Synchronization

Synopsis #

Accurate time matters for logs, cryptography, file timestamps, and systems that work together. OpenBSD’s base system includes ntpd(8) to set the clock from remote NTP servers. It can also provide time to other systems.

This chapter describes how to configure ntpd(8) for typical client use and for serving time to a local network.

Default Behavior #

OpenBSD can enable ntpd during installation. Inspect the service setting on the installed system. The shipped /etc/ntpd.conf includes NTP servers, sensors, and HTTPS constraints; preserve those protections when adapting it. A pool-only file is not equivalent to the release defaults.

At startup, ntpd may step the clock forward if it has sufficiently trusted time information. It does not step the clock backward, and the old -s option is no longer supported.

Configuration File #

The configuration file for ntpd is located at /etc/ntpd.conf. It consists of plain text directives. The most common are:

  • servers <address> — Use a pool of time servers.
  • server <address> — Use a single, specified time server.
  • listen on <interface> — Enable NTP server functionality by listening on the specified interface or address.

Example: Client-Only Configuration #

servers pool.ntp.org

This minimal illustration uses servers selected from the NTP pool. Prefer adding server or listener settings to the shipped configuration while retaining its constraints and sensors.

Example: Client and Server Configuration #

servers pool.ntp.org
listen on 192.168.1.1

This example synchronizes time from external servers and serves NTP to local clients at the example LAN address 192.168.1.1.

Enabling and Starting ntpd #

To verify that the NTP service is enabled and running:

doas rcctl check ntpd

To manually enable and start the service:

doas rcctl enable ntpd
doas rcctl start ntpd

Inspecting Synchronization Status #

Use ntpctl(8) to query the status of the daemon and its peers:

ntpctl -s status
ntpctl -s peers

These commands report information such as synchronization state, stratum level, offset, and network delay.

Diagnose Clock Synchronization #

ntpd remains a daemon; it is not a one-shot clock-setting client. Check source reachability, HTTPS constraints, and ntpctl -s status when the clock does not converge. Do not launch a second instance alongside the service.

For foreground debugging:

doas rcctl stop ntpd
doas ntpd -d

After exiting the foreground process, restart with doas rcctl start ntpd. Validate configuration changes with doas ntpd -n before restarting.

Logging and Troubleshooting #

ntpd logs activity to /var/log/messages. To monitor this output in real time:

doas tail -f /var/log/messages

Ensure that outbound UDP port 123 is permitted through any packet filtering rules. If time synchronization fails:

  • Verify that DNS resolution is working.
  • Use ntpctl -s peers to check reachability and response from peers.
  • Confirm that no other time services (such as rdate) are active simultaneously.

Serving Time to Other Systems #

To allow other systems on a local network to synchronize against the OpenBSD host, configure ntpd with a listen on directive:

listen on 192.168.1.1

Add this listener to the existing client configuration, using the actual address of the LAN interface.

This approach is useful in environments where multiple systems must synchronize with a common internal time source or where external network access is restricted.

Limitations and Behavior #

OpenBSD’s ntpd focuses on simplicity and security. It intentionally omits cryptographic authentication features found in some other NTP implementations. Support for leap seconds is automatic and does not require additional configuration.

ntpd is suitable for most client and internal server use cases, but not for highly specialized or authenticated NTP deployments.

Report a bug