局域网ntp服务器配置

时间 2019-11-25

标签局域网 ntp 服务器配置繁體版

原文原文链接

　　1、不少分布式软件须要局域网中各节点时间同步，最粗暴的办法是在全部节点上都运行ntpdate -u 互联网服务器地址，这样人工让全部节点与外网服务器同步。若是节点重启，须要在该节点上再次运行该命令。html

　　2、此处要在局域网内搭建一个时间服务器，该服务器与外网授时中心同步时间，局域网其余机器与该服务器保持时间同步。node

1.局域网各机器安装ntp：yum install ntpcentos

2.各机器启动ntp服务：service ntpd start服务器

3.各机器ntp服务自动启动：chkconfig ntpd on网络

4.时间服务器配置。假定局域网全部机器都是120网段，本时间服务器的ip为192.168.120.201，机器名为node01。修改/etc/ntp.conf文件。红色字体为相比于原始文件的修改之处。less

# For more information about this file, see the man pages
# ntp.conf(5), ntp_acc(5), ntp_auth(5), ntp_clock(5), ntp_misc(5), ntp_mon(5).

driftfile /var/lib/ntp/drift

# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
restrict default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery

# Permit all access over the loopback interface. This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
restrict 127.0.0.1
restrict -6 ::1

# Hosts on local network are less restricted.

#restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap

#添加此处。容许内网其余机器同步。
restrict 192.168.120.0 mask 255.255.255.0 nomodify notrap

# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).

#注释如下四行
#server 0.centos.pool.ntp.org iburst
#server 1.centos.pool.ntp.org iburst
#server 2.centos.pool.ntp.org iburst
#server 3.centos.pool.ntp.org iburst

#添加此处
server 授时中心ip或域名 perfer

#broadcast 192.168.1.255 autokey # broadcast server
#broadcastclient # broadcast client
#broadcast 224.0.1.1 autokey # multicast server
#multicastclient 224.0.1.1 # multicast client
#manycastserver 239.255.254.254 # manycast server
#manycastclient 239.255.254.254 autokey # manycast client

#添加以下一行。容许上层时间服务器主动修改本机时间
restrict 授时中心ip或域名 nomodify notrap noquery

#添加以下两行。外部时间服务器不可用时，以本地时间做为时间服务
server 127.127.1.0 # local clock
fudge 127.127.1.0 stratum 10

# Enable public key cryptography.
#crypto

includefile /etc/ntp/crypto/pw

# Key file containing the keys and key identifiers used when operating
# with symmetric key cryptography.
keys /etc/ntp/keys

# Specify the key identifiers which are trusted.
#trustedkey 4 8 42

# Specify the key identifier to use with the ntpdc utility.
#requestkey 8

# Specify the key identifier to use with the ntpq utility.
#controlkey 8

# Enable writing of statistics records.
#statistics clockstats cryptostats loopstats peerstats

5.局域网客户端配置。客户端机器名为node0二、node03等。分布式

# For more information about this file, see the man pages
# ntp.conf(5), ntp_acc(5), ntp_auth(5), ntp_clock(5), ntp_misc(5), ntp_mon(5).

driftfile /var/lib/ntp/drift

# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
restrict default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery

# Permit all access over the loopback interface.  This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
restrict 127.0.0.1 
restrict -6 ::1

# Hosts on local network are less restricted.
#restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap

# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).

#注释如下四行
#server 0.centos.pool.ntp.org iburst
#server 1.centos.pool.ntp.org iburst
#server 2.centos.pool.ntp.org iburst
#server 3.centos.pool.ntp.org iburst

#添加如下一行
server 192.168.120.201

#broadcast 192.168.1.255 autokey	# broadcast server
#broadcastclient			# broadcast client
#broadcast 224.0.1.1 autokey		# multicast server
#multicastclient 224.0.1.1		# multicast client
#manycastserver 239.255.254.254		# manycast server
#manycastclient 239.255.254.254 autokey # manycast client

#添加以下一行。容许上层时间服务器主动修改本机时间
restrict 192.168.120.201 nomodify notrap noquery

# 外部时间服务器不可用时，以本地时间做为时间服务
server  127.127.1.0     # local clock
fudge   127.127.1.0 stratum 10

# Enable public key cryptography.
#crypto

includefile /etc/ntp/crypto/pw

# Key file containing the keys and key identifiers used when operating
# with symmetric key cryptography. 
keys /etc/ntp/keys

# Specify the key identifiers which are trusted.
#trustedkey 4 8 42

# Specify the key identifier to use with the ntpdc utility.
#requestkey 8

# Specify the key identifier to use with the ntpq utility.
#controlkey 8

# Enable writing of statistics records.
#statistics clockstats cryptostats loopstats peerstats

6.配置完成后，有几个命令须要使用，来检查配置是否成功，可在时间服务器和客户端上都运行这些命令来进行检查。ide

service ntpd status(start|stop|restart)，查询本地ntpd服务开启状态。修改配置文件后，需运行restart命令重启服务，要始终保持该服务运行。
netstat -tlunp | grep ntp 查看相关服务网络端口开启状况，该命令判断本地是否开启了相关端口用于时间同步，默认本地开放123端口。

[root@node01 etc]# netstat -tlunp | grep ntp
udp        0      0 192.168.120.201:123         0.0.0.0:*                               1381/ntpd           
udp        0      0 127.0.0.1:123               0.0.0.0:*                               1381/ntpd           
udp        0      0 0.0.0.0:123                 0.0.0.0:*                               1381/ntpd           
udp        0      0 fe80::20c:29ff:feea:119b:123 :::*                                    1381/ntpd           
udp        0      0 ::1:123                     :::*                                    1381/ntpd           
udp        0      0 :::123                      :::*                                    1381/ntpd

ntpq -p 判断ntp.conf文件中的互联网服务器设置是否生效，注意观察remote列值是否和配置相符。时间服务器地址在此处显示时多是倒着写的，如配置的是223.65.211.42，显示的多是42.211.65.223。服务器和客户端显示分别是：

[root@node01 etc]# ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
*42.211.65.223.s 10.1.0.0         3 u   61   64  177   35.315  -15.290   9.980
 LOCAL(0)        .LOCL.          10 l  136   64  374    0.000    0.000   0.000

[root@node02 ~]# ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
*node01          223.65.211.42    4 u   16  128  377    0.167   48.143  30.332
 LOCAL(0)        .LOCL.          10 l  916   64    0    0.000    0.000   0.000

　　remote为本机设定的时间服务器地址，refid为本机设定的时间服务器的上层服务器地址。oop

ntpstat 命令查看时间同步状态，用该命令判断是否最近与设定的时间服务器进行了同步。如，本配置中服务器和客户端的显示分别是:

[root@node01 etc]# ntpstat
synchronised to NTP server (223.65.211.42) at stratum 4 
   time correct to within 114 ms
   polling server every 256 s

[root@node02 ~]# ntpstat
synchronised to NTP server (192.168.120.201) at stratum 5 
   time correct to within 169 ms
   polling server every 256 s

7.特别注意，本地与互联网的时间同步在全部设置均完成后，须要等待5-10分钟才能正式生效，此时才能使用上述命令进行查询检测配置是否成功。字体

8.确保在授时中心有效性。