Running chrony as an NTP server for a LAN: allow, local stratum, and firewalling UDP 123

Goal

Let chrony serve time to other hosts on a local network, decide whether it should ever claim to be authoritative when it has no external source, and confirm both from the command line.

Prerequisites

chrony installed and already synchronising from upstream sources; root access to edit /etc/chrony.conf (/etc/chrony/chrony.conf on Debian and Ubuntu) and restart the service.

Steps

1. Add an allow line for the subnet that should be served, for example allow 10.0.0.0/24. The directive designates a particular subnet from which NTP clients are allowed to access the computer as an NTP server; without it, the default is that no clients are allowed access at all.
2. Restart chronyd for the new allow directive to take effect (systemctl restart chronyd; the unit is chrony on Debian and Ubuntu); chronyd has no configuration reload. chronyc allow 10.0.0.0/24 applies the same rule at runtime without a restart but is lost at the next restart unless it is also in the file.
3. Only add a local stratum <n> directive if this server should appear synchronised even when it has no, or has lost its, upstream source — typically an isolated network. The option sets the stratum reported to clients when the local reference is active (default 10; keep it higher than any real stratum in the network). Several such servers should all use local stratum <n> orphan and poll one another, so they agree on one of them instead of confusing clients. Do not add it on a server that is otherwise expected to track real time, since it can mask a genuine upstream sync failure from downstream clients.
4. Open the firewall for UDP port 123 inbound from the served subnet; chrony's command and monitoring port is separate and should stay restricted to localhost or explicitly cmdallow-listed hosts.
5. Confirm clients are actually using the server: chronyc clients (run as root) shows a list of clients that have accessed the server through the NTP, command, or NTS-KE port, with request counts per client.
6. For clients across an untrusted network, consider Network Time Security (NTS, chrony 4.0 and later) instead of a pre-shared symmetric key per client: point ntsservercert and ntsserverkey at a PEM certificate and a key readable by chronyd, open TCP 4460 (NTS-KE) in addition to UDP 123, and add the nts option to the clients' server lines.

Expected result

chronyc clients lists the LAN hosts polling the server; a client's own tracking output shows this host as its source; requests from outside the allowed subnet receive no reply.

Limits and test basis

allow without a subnet argument, or allow all, opens the service to whatever the firewall permits — scope it explicitly. A local stratum makes the server look synchronised to downstream clients even during a real outage of upstream sources; use it only where that trade-off is intended. A restart keeps the drift file, so the clock recovers quickly, but verify with chronyc clients rather than assuming the restart alone succeeded.