FreeBSD 13 – ntpd Fails to Sync and Time Drift Breaks Auth – Time Service Recovery

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Clock drift causes certificate, Kerberos, and token validation failures across services.

Environment & Reproduction

Appears where egress to NTP sources is blocked or ntp.conf is incorrect.

service ntpd onestatus
ntpq -pn

Root Cause Analysis

NTP daemon cannot reach valid upstream peers or source selection is unstable.

Quick Triage

Check daemon status and peer reachability quickly.

sockstat -4 -6 | grep ntpd
ntpq -c rv

Step-by-Step Diagnosis

Review ntpd logs and query offsets for each configured peer.

grep -v '^#' /etc/ntp.conf
tail -n 160 /var/log/messages | grep -i ntp

Solution – Primary Fix

Correct NTP servers, restart daemon, and step large offset safely.

service ntpd stop
ntpd -gq
service ntpd start

Solution – Alternative Approaches

Use an internal stratum source for isolated networks.

Verification & Acceptance Criteria

Peers show reachable status and offset remains within policy thresholds.

ntpq -pn
date -u

Rollback Plan

Restore previous ntp.conf if new source set introduces instability.

Prevention & Hardening

Monitor offset and peer reach with alerting for drift anomalies.

Related Errors & Cross-Refs

no server suitable for synchronization, clock unsynchronized.

Related tutorial: View the step-by-step tutorial for freebsd-13.

View all freebsd-13 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

FreeBSD ntpd documentation and enterprise time synchronization practices.