Debian 11 – system clock unsynchronized and NTP reports no active peers – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Clock drift breaks TLS validation, scheduled jobs, and distributed system coordination.

Environment & Reproduction

Seen after firewall updates block UDP/123 or when NTP daemon configuration is invalid.

Root Cause Analysis

No reachable time sources or conflicting time daemons prevent synchronization lock.

Quick Triage

Confirm active NTP service and outbound network reachability to configured peers.

Step-by-Step Diagnosis

Run: timedatectl status; systemctl status systemd-timesyncd chrony; chronyc sources -v 2>/dev/null || true; sudo ss -lunp | grep :123.

Solution – Primary Fix

Enable one daemon only, then run: sudo timedatectl set-ntp true or configure /etc/chrony/chrony.conf and sudo systemctl restart chrony.

Solution – Alternative Approaches

Point clients to internal stratum servers in restricted networks with egress controls.

Verification & Acceptance Criteria

timedatectl shows synchronized yes and offset remains within operational SLA.

Rollback Plan

Restore prior NTP config and previous peer list if new source pool is unstable.

Prevention & Hardening

Monitor time offset metrics and enforce baseline NTP config via configuration management.

Related Errors & Cross-Refs

Related to certificate not yet valid and Kerberos clock skew authentication failures.

Related tutorial: View the step-by-step tutorial for Debian 11.

View all Debian 11 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

systemd-timesyncd and chrony documentation for Debian deployments.