Enough theory for now, time to install an NTP server. Every Linux distribution and FreeBSD release are shipped with binary packages of a recent version of the ntpd package. You can then simply install your vendor supplied package.
If, for whatever reason, you don't like binary packages, you can always obtain the source of the latest version at the www.ntp.org downloads page site and compile it yourself. The usual "./configure, make && make install" will do.

To configure your server, you will have to create or edit the configuration file, /etc/ntp.conf and a driftfile /etc/ntp.drift. These are just plain text files. When changes are made to the config file, the server must be killed and restarted to ensure it uses the new configuration.

We are going to build an NTP server that syncs time with several Stratum 2 servers on the Internet (that will give us a Stratum 3 server) and allows clients on our local lan to sync their time with our server. The following config file will do just that :

#--------------------------
# /etc/ntp.conf              
# ntpd daemon 4.2.0   
#--------------------------
# Last update: 27-04-2004 
#--------------------------

restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap
restrict 127.0.0.1 

# servers to query
#-------------------

server ntp.belnet.be
server ntp3.theinternetone.net
server ntp0.uk.uu.net
server time.alcanet.no


# some files to use
#-------------------

driftfile /etc/ntp.drift
logfile /var/log/ntp.log

This configuration will sync with 4 Stratum 2 servers (use at least 3). It will allow hosts on the 192.168.1.0/24 subnet to query this server, but not let them modify the state of the server and they will not be used as a source to sync with. Localhost has full access to the server. As usual, lines starting with # (comment lines) and blank lines are ignored.
You can find a list of Public Stratum 2 NTP servers here. Most likely, your ISP also provides one or more NTP servers.

Before starting ntpd, you should sync the time of the server a few times using ntpdate. This to minimize the difference in time (offset) between the local server and the server(s) to sync with :

 # ntpdate -b ntp.belnet.be 

The -b option will adjust the time immediately rather than slewing it. If you don't run ntpdate prior to starting ntpd, something like this might happen :

 14 Apr 16:36:28 ntpd[446]: time correction of 3599 seconds exceeds sanity limit (1000);
		set clock manually to the correct UTC time.

Ntpd uses a default sanity limit of 1000 seconds (configurable). If the time correction exceeds this limit, ntpd assumes something is very wrong and refuses service. In this particular example, there was a 1 hour(=3600s) difference.

To start your NTP server, you can type the following :

 # ntpd -c /etc/ntp.conf -l /var/log/ntp.log

Now check the logfile (/var/log/ntp.log) for following messages:

 17 Apr 20:56:05 ntpd[25365]: logging to file /var/log/ntp.log
 17 Apr 20:56:05 ntpd[25365]: ntpd 4.2.0@1.1161-r Wed Mar 31 00:37:20 CEST 2004 (2)
 17 Apr 20:56:05 ntpd[25365]: signal_no_reset: signal 13 had flags 4000000
 17 Apr 20:56:05 ntpd[25365]: precision = 2.000 usec
 17 Apr 20:56:05 ntpd[25365]: no IPv6 interfaces found
 17 Apr 20:56:05 ntpd[25365]: kernel time sync status 0040
 17 Apr 20:56:05 ntpd[25365]: Frequency format error in /etc/ntp.drift

The "Frequency format error" message is simply the result of an initiallly empty /etc/ntp.drift file and hence can be ignored. The server will store a value in that file after some time.

Instead of starting ntpd manually after each reboot, you would of course adapt your server to start it automatically :

• On a FreeBSD server, add xntpd_enable="YES" to /etc/rc.conf to start ntpd automatically.
• On a Linux server, if no start/stop script for ntpd is available, or you want to write one yourself, the next example may help you. You would then call this script somewhere in the chain of startup scripts.

   #!/bin/sh
   # 
   NTPD=/usr/sbin/ntpd
  
   if [ ! -d /usr/sbin ]; then
     echo "The /usr file system is not mounted."
     exit 1
   fi
  
   if [ ! -r /etc/ntp.conf ]; then
     echo "Can not read the server config file (/etc/ntp.conf)."
     exit 1
   fi
  
   killproc() {
     pid=`/bin/ps ax | grep -w $1 | grep -v grep | sed -e 's/^  *//' -e 's/ .*//'`
     echo "Stopping $1 now."
     [ "$pid" != "" ] && kill -15 $pid
     echo $pid
   }
  
   # Start/stop processes required for the ntpd server
   case "$1" in
  
    'start')
  	  echo "Starting NTPD"
  	  $NTPD -c /etc/ntp.conf -l /var/log/ntp.log
  	  echo "Done."
  		  ;;
    'stop')
  	  killproc ntpd
  	  echo "Done."
  	  ;;
    *)
  	  echo "Usage: $0 [ start | stop ]"
  	  ;;
   esac

The ntpq utility will show you the servers your synchronising with :

 # ntpq -p 
      remote           refid      st t when poll reach   delay   offset  jitter
 ==============================================================================
 +ntp1.belbone.be 192.36.143.150   2 u  500 1024  377   18.639   19.533   5.833
 *lnx-12-be1.ams- 192.53.103.104   2 u  470 1024  377   23.496   10.533   0.973
 +ntp0.pipex.net  193.79.237.14    2 u  551 1024  377   25.756   15.714   1.955
 +ns2.alcatel.no  195.220.94.163   2 u  493 1024  377   57.798   14.382  21.148

The above output looks good.

If all remote servers have jitters of 4000.0 with delay and reach values of 0, then something is wrong. It means your server is not able to get proper synchronization. Output of ntpq -p would look like this :

      remote           refid      st t when poll reach   delay   offset  jitter
 ==============================================================================
  ntp1.belbone.be     0.0.0.0     16 u   -   64    0     0.000   0.000   4000.0
  lnx-12-be1.ams-     0.0.0.0     16 u   -   64    0     0.000   0.000   4000.0
  ntp0.pipex.net      0.0.0.0     16 u   -   64    0     0.000   0.000   4000.0
  ns2.alcatel.no      0.0.0.0     16 u   -   64    0     0.000   0.000   4000.0

This can be caused by the following :

• a firewall blocking access to the Stratum 2 (and 1) servers your syncing with
• ntp.conf containing a restrict default ignore statement