Configure remote monitoring access

The chronyc utility can access chronyd over IPv4 or IPv6, or through a Unix domain socket that is locally accessible by the root and chrony user.

About this task

By default, the chronyc utility connects to the Unix domain socket. The default path is /var/run/chrony/chronyd.sock. If this connection fails, chronyc tries to connect to 127.0.0.1 and then ::1.

Only the following monitoring commands, which do not affect the behavior of chronyd, are allowed from the network:

  • activity
  • manual list
  • rtcdata
  • smoothing
  • sources
  • sourcestats
  • tracking
  • waitsync

By default, the commands are accepted only from localhost (127.0.0.1 or ::1).

All other commands are allowed only through the Unix domain socket. When sent over the network, chronyd responds with a Not authorised error, even if it is from localhost.

The following procedure describes how to access chronyd remotely with chronyc.

Procedure

  1. Configure chrony to listen on local interface by adding the following to the /etc/chrony.conf file: 
    bindcmdaddress 0.0.0.0

    and

    bindcmdaddress ::
  2. Add the following content to the /etc/chrony.conf file to allow commands from remote IP addresses, networks, and subnet: 
    cmdallow 192.168.1.0/24
     
    cmdallow 2001:db8::/64
  3. Open port 323 in the firewall to allow connections from remote systems: 
    # firewall-cmd --permanent --add-port=323/udp
  4. Reload the firewall configuration: 
    # firewall-cmd --reload

    For more information, see the chrony.conf(5) man page on your system.