Ntp

Network Time Protocol, synchronize local clock to remote.

To use ntpq the firewall should be open for traffic to the localhost.

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
ip6tables -A INPUT -i lo -j ACCEPT
ip6tables -A OUTPUT -o lo -j ACCEPT

When using an NTP-server pool like pool.ntp.org ( 0.<country>.pool.ntp.org etc.) make sure you refresh the peers every now and than. Only when ntp is started the hosts are selected, when they leave the pool ntp will not automatically select another.

Very secure setinngs in ntp.conf

restrict -4 default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery

systemd-timesyncd

systemd-timesyncd is a lightweight client-only ntp implementation.

By default configuration from DHCP is used. Additional configuration can be added to /etc/systemd/timesyncd.conf

timedatectl timesync-status

Detailed status of systemd-timesyncd