### COMMENTS
# Any of the following lines are comments (you have a choice of
# comment start character):
# a comment
% a comment
! a comment
; a comment
#
# Below, the '!' form is used for lines that you might want to
# uncomment and edit to make your own chrony.conf file.
#
#######################################################################
#######################################################################
### SPECIFY YOUR NTP SERVERS
# Most computers using chrony will send measurement requests to one or
# more 'NTP servers'.  You will probably find that your Internet Service
# Provider or company have one or more NTP servers that you can specify.
# Failing that, there are a lot of public NTP servers.  There is a list
# you can access at http://support.ntp.org/bin/view/Servers/WebHome or
# you can use servers from the pool.ntp.org project.

! server foo.example.net iburst
! server bar.example.net iburst
! server baz.example.net iburst

#server 0.openindiana.pool.ntp.org iburst
#server 1.openindiana.pool.ntp.org iburst
#server 2.openindiana.pool.ntp.org iburst
#server 3.openindiana.pool.ntp.org iburst
pool 0.openindiana.pool.ntp.org iburst

#######################################################################
### AVOIDING POTENTIALLY BOGUS CHANGES TO YOUR CLOCK
#
# To avoid changes being made to your computer's gain/loss compensation
# when the measurement history is too erratic, you might want to enable
# one of the following lines.  The first seems good with servers on the
# Internet, the second seems OK for a LAN environment.

! maxupdateskew 100
! maxupdateskew 5

# If you want to increase the minimum number of selectable sources
# required to update the system clock in order to make the
# synchronisation more reliable, uncomment (and edit) the following
# line.

! minsources 2

# If your computer has a good stable clock (e.g. it is not a virtual
# machine), you might also want to reduce the maximum assumed drift
# (frequency error) of the clock (the value is specified in ppm).

! maxdrift 100

# By default, chronyd allows synchronisation to an unauthenticated NTP
# source (i.e. specified without the nts and key options) if it agrees with
# a majority of authenticated NTP sources, or if no authenticated source is
# specified.  If you don't want chronyd to ever synchronise to an
# unauthenticated NTP source, uncomment the first from the following lines.
# If you don't want to synchronise to an unauthenticated NTP source only
# when an authenticated source is specified, uncomment the second line.
# If you want chronyd to ignore authentication in the source selection,
# uncomment the third line.

! authselectmode require
! authselectmode prefer
! authselectmode ignore

#######################################################################
### FILENAMES ETC
# Chrony likes to keep information about your computer's clock in files.
# The 'driftfile' stores the computer's clock gain/loss rate in parts
# per million.  When chronyd starts, the system clock can be tuned
# immediately so that it doesn't gain or lose any more time.  You
# generally want this, so it is uncommented.

driftfile /var/lib/chrony/drift

# If you want to enable NTP authentication with symmetric keys, you will need
# to uncomment the following line and edit the file to set up the keys.

! keyfile /etc/inet/chrony.keys

# If you specify an NTP server with the nts option to enable authentication
# with the Network Time Security (NTS) mechanism, or enable server NTS with
# the ntsservercert and ntsserverkey directives below, the following line will
# allow the client/server to save the NTS keys and cookies in order to reduce
# the number of key establishments (NTS-KE sessions).

ntsdumpdir /var/lib/chrony

# If chronyd is configured to act as an NTP server and you want to enable NTS
# for its clients, you will need a TLS certificate and private key.  Uncomment
# and edit the following lines to specify the locations of the certificate and
# key.

! ntsservercert /etc/.../foo.example.net.crt
! ntsserverkey /etc/.../foo.example.net.key

# chronyd can save the measurement history for the servers to files when
# it exits.  This is useful:
#
# 1. If you stop chronyd and restart it with the '-r' option (e.g. after
# an upgrade), the old measurements will still be relevant when chronyd
# is restarted.  This will reduce the time needed to get accurate
# gain/loss measurements.
#
# Uncomment the following line to use this.

! dumpdir /var/lib/chrony

# chronyd writes its process ID to a file.  If you try to start a second
# copy of chronyd, it will detect that the process named in the file is
# still running and bail out.  If you want to change the path to the PID
# file, uncomment this line and edit it.  The default path is shown.

pidfile /var/run/chrony/chronyd.pid

# If the system timezone database is kept up to date and includes the
# right/UTC timezone, chronyd can use it to determine the current
# TAI-UTC offset and when will the next leap second occur.

! leapsectz right/UTC

# This directive specifies the location of the Samba ntp_signd socket
# when it is running as a Domain Controller (DC). If chronyd is
# compiled with this feature, responses to MS-SNTP clients will be
# signed by the smbd daemon.

! ntpsigndsocket /var/lib/samba/ntp_signd

#######################################################################
### INITIAL CLOCK CORRECTION
# This option is useful to quickly correct the clock on start if it's
# off by a large amount.  The value '1.0' means that if the error is less
# than 1 second, it will be gradually removed by speeding up or slowing
# down your computer's clock until it is correct.  If the error is above
# 1 second, an immediate time jump will be applied to correct it.  The
# value '3' means the step is allowed only in the first three updates of
# the clock.  Some software can get upset if the system clock jumps
# (especially backwards), so be careful!

! makestep 1.0 3

#######################################################################
### LEAP SECONDS
# A leap second is an occasional one-second correction of the UTC
# time scale.  By default, chronyd tells the kernel to insert/delete
# the leap second, which makes a backward/forward step to correct the
# clock for it.  As with the makestep directive, this jump can upset
# some applications.  If you prefer chronyd to make a gradual
# correction, causing the clock to be off for a longer time, uncomment
# the following line.

! leapsecmode slew

#######################################################################
### LOGGING
# If you want to log information about the time measurements chronyd has
# gathered, you might want to enable the following lines.  You probably
# only need this if you really enjoy looking at the logs, you want to
# produce some graphs of your system's timekeeping performance, or you
# need help in debugging a problem.

! logdir /var/log/chrony
! log measurements statistics tracking

# If you have real time clock support enabled (see below), you might want
# this line instead:

! log measurements statistics tracking rtc

#######################################################################
### ACTING AS AN NTP SERVER
# You might want the computer to be an NTP server for other computers.
#
# By default, chronyd does not allow any clients to access it.  You need
# to explicitly enable access using 'allow' and 'deny' directives.
#
# e.g. to enable client access from the 192.168.*.* class B subnet,

! allow 192.168/16

# .. but disallow the 192.168.100.* subnet of that,

! deny 192.168.100/24

# You can have as many allow and deny directives as you need.  The order
# is unimportant.

# If you want to present your computer's time for others to synchronise
# with, even if you don't seem to be synchronised to any NTP servers
# yourself, enable the following line.  The value 10 may be varied
# between 1 and 15.  You should avoid small values because you will look
# like a real NTP server.  The value 10 means that you appear to be 10
# NTP 'hops' away from an authoritative source (atomic clock, GPS
# receiver, radio clock etc).

! local stratum 10

# Normally, chronyd will keep track of how many times each client
# machine accesses it.  The information can be accessed by the 'clients'
# command of chronyc.  You can disable this facility by uncommenting the
# following line.  This will save a bit of memory if you have many
# clients and it will also disable support for the interleaved mode.

! noclientlog

# The clientlog size is limited to 512KB by default.  If you have many
# clients, you might want to increase the limit.

! clientloglimit 4194304

# By default, chronyd tries to respond to all valid NTP requests from
# allowed addresses.  If you want to limit the response rate for NTP
# clients that are sending requests too frequently, uncomment and edit
# the following line.

! ratelimit interval 3 burst 8

#######################################################################
### REPORTING BIG CLOCK CHANGES
# Perhaps you want to know if chronyd suddenly detects any large error
# in your computer's clock.  This might indicate a fault or a problem
# with the server(s) you are using, for example.
#
# The next option causes a message to be written to syslog when chronyd
# has to correct an error above 0.5 seconds (you can use any amount you
# like).

! logchange 0.5

# The next option will send email to the named person when chronyd has
# to correct an error above 0.5 seconds.  (If you need to send mail to
# several people, you need to set up a mailing list or sendmail alias
# for them and use the address of that.)

! mailonchange wibble@foo.example.net 0.5

#######################################################################
### COMMAND ACCESS
# The program chronyc is used to show the current operation of chronyd
# and to change parts of its configuration whilst it is running.

# By default chronyd binds to the loopback interface.  Uncomment the
# following lines to allow receiving command packets from remote hosts.

! bindcmdaddress 0.0.0.0
! bindcmdaddress ::

# Normally, chronyd will only allow connections from chronyc on the same
# machine as itself.  This is for security.  If you have a subnet
# 192.168.*.* and you want to be able to use chronyc from any machine on
# it, you could uncomment the following line.  (Edit this to your own
# situation.)

! cmdallow 192.168/16

# You can add as many 'cmdallow' and 'cmddeny' lines as you like.  The
# syntax and meaning is the same as for 'allow' and 'deny', except that
# 'cmdallow' and 'cmddeny' control access to the chronyd's command port.

# Rate limiting can be enabled also for command packets.  (Note,
# commands from localhost are never limited.)

! cmdratelimit interval -4 burst 16