#===============================================================================
# /etc/chrony.conf (CentOS)
# /etc/chrony/chrony.conf (Ubuntu)
# -rw-r--r--  root root
#
# # Change date with Step
# chronyc -a makestep
#===============================================================================

# NTP Server
# poll 4 = 2 * 2 * 2 * 2 = 16 sec
server x.x.x.x iburst minpoll 4 maxpoll 4 prefer
server x.x.x.x iburst minpoll 4 maxpoll 4

driftfile /var/lib/chrony/drift

# Step Mode Configuration
makestep 1.0 3

# Enable kernel synchronization of the real-time clock (RTC).
rtcsync

logdir /var/log/chrony

# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
server 0.centos.pool.ntp.org iburst
server 1.centos.pool.ntp.org iburst
server 2.centos.pool.ntp.org iburst
server 3.centos.pool.ntp.org iburst

# Record the rate at which the system clock gains/losses time.
driftfile /var/lib/chrony/drift

# Allow the system clock to be stepped in the first three updates
# if its offset is larger than 1 second.
makestep 1.0 3

# Enable kernel synchronization of the real-time clock (RTC).
rtcsync

# Enable hardware timestamping on all interfaces that support it.
#hwtimestamp *

# Increase the minimum number of selectable sources required to adjust
# the system clock.
#minsources 2

# Allow NTP client access from local network.
#allow 192.168.0.0/16

# Serve time even if not synchronized to a time source.
#local stratum 10

# Specify file containing keys for NTP authentication.
#keyfile /etc/chrony.keys

# Specify directory for log files.
logdir /var/log/chrony

# Select which information is logged.
#log measurements statistics tracking

# This the default chrony.conf file for the Debian chrony package.  After
# editing this file use the command 'invoke-rc.d chrony restart' to make
# your changes take effect.  John Hasler <jhasler@debian.org> 1998-2008

# See www.pool.ntp.org for an explanation of these servers.  Please
# consider joining the project if possible.  If you can't or don't want to
# use these servers I suggest that you try your ISP's nameservers.  We mark
# the servers 'offline' so that chronyd won't try to connect when the link
# is down.  Scripts in /etc/ppp/ip-up.d and /etc/ppp/ip-down.d use chronyc
# commands to switch it on when a dialup link comes up and off when it goes
# down.  Code in /etc/init.d/chrony attempts to determine whether or not
# the link is up at boot time and set the online status accordingly.  If
# you have an always-on connection such as cable omit the 'offline'
# directive and chronyd will default to online.
#
# Note that if Chrony tries to go "online" and dns lookup of the servers
# fails they will be discarded.  Thus under some circumstances it is
# better to use IP numbers than host names.

pool 2.debian.pool.ntp.org offline iburst

# Look here for the admin password needed for chronyc.  The initial
# password is generated by a random process at install time.  You may
# change it if you wish.

keyfile /etc/chrony/chrony.keys

# This directive sets the key ID used for authenticating user commands via the
# 'chronyc' program at run time.

commandkey 1

# I moved the driftfile to /var/lib/chrony to comply with the Debian
# filesystem standard.

driftfile /var/lib/chrony/chrony.drift

# Comment this line out to turn off logging.

log tracking measurements statistics
logdir /var/log/chrony

# Stop bad estimates upsetting machine clock.

maxupdateskew 100.0

# Dump measurements when daemon exits.

dumponexit

# Specify directory for dumping measurements.

dumpdir /var/lib/chrony

# This directive lets 'chronyd' to serve time even if unsynchronised to any
# NTP server.

#local stratum 10

# This directive designates subnets (or nodes) from which NTP clients are allowed
# to access to 'chronyd'.

#allow foo.example.net
#allow 10/8
#allow 0/0 (allow access by any IPv4 node)
#allow ::/0 (allow access by any IPv6 node)

# This directive forces `chronyd' to send a message to syslog if it
# makes a system clock adjustment larger than a threshold value in seconds.

logchange 0.5

# This directive defines an email address to which mail should be sent
# if chronyd applies a correction exceeding a particular threshold to the
# system clock.

# mailonchange root@localhost 0.5

# This directive tells 'chronyd' to parse the 'adjtime' file to find out if the
# real-time clock keeps local time or UTC. It overrides the 'rtconutc' directive.

hwclockfile /etc/adjtime

# This directive enables kernel synchronisation (every 11 minutes) of the
# real-time clock. Note that it can’t be used along with the 'rtcfile' directive.

rtcsync

Set Linux Configuration with Fabric (set.py)

• deamon
  • /etc/ssh/sshd_config Example Configuration
  • /etc/chrony.conf | /etc/chrony/chrony.conf Example Configuration
  • /etc/systemd/journald.conf Example Configuration
• user
  • /etc/profile.d/history.sh
  • /etc/security/limits.conf Example Configuration
• authentication
  • /etc/pam.d/su Example Configuration
  • /etc/login.defs Example Configuration
  • /etc/pam.d/system-auth Example Configuration
  • /etc/sudoers Example Configuration
• performance
  • /etc/sysconfig/sysstat
  • /etc/cron.d/sysstat Example Configuration
  • /etc/cron.d/performance
• etc
  • /etc/selinux/config | /etc/sysconfig/selinux Example Configuration
  • /etc/snmp/snmpd.conf Example Configuration
• kernel
  • /etc/sysctl.conf Example Configuration

Set Linux Configuration with Fabric (set.py)