NTP服务器【Network Time Protocol（NTP）】是用来使计算机时间同步化的一种协议，它可以使计算机对其服务器或时钟源（如石英钟，GPS等等)做同步化，它可以提供高精准度的时间校正（LAN上与标准间差小于1毫秒，WAN上几十毫秒），且可介由加密确认的方式来防止恶毒的协议攻击。时间按NTP服务器的等级传播。按照离外部UTC源的远近把所有服务器归入不同的Stratum（层）中。
安装配置
[ec-a] 作为被同步时间的时间同步服务器， [ec-b] , [ec-c] 自动与 [ec-a] 进行时间同步。
# 全部节点安装ntp [root@ec-a ~]# yum -y install ntp [root@ec-b ~]# yum -y install ntp [root@ec-c ~]# yum -y install ntp
## # [ec-a] 修改配置文件 /etc/ntp.conf # [root@ec-a ~]# vim /etc/ntp.conf # For more information about this file, see the man pages # ntp.conf(5), ntp_acc(5), ntp_auth(5), ntp_clock(5), ntp_misc(5), ntp_mon(5). # 系统时间与BIOS事件的偏差记录 driftfile /var/lib/ntp/drift # Permit time synchronization with our time source, but do not # permit the source to query or modify the service on this system. restrict default nomodify notrap nopeer noquery # Permit all access over the loopback interface. This could # be tightened as well, but to do so would effect some of # the administrative functions. restrict 127.0.0.1 restrict ::1 # Hosts on local network are less restricted. #restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap # 【配置客户端的授权】 # 此时表示限制向从 172.16.0.1-172.16.0.254 这些IP段的服务器提供NTP服务。 # 参数主要有： # ignore： 拒绝所有类型的ntp连接 # nomodify：客户端不能使用ntpc与ntpq两支程式来修改服务器的时间参数 # noquery： 客户端不能使用ntpq、ntpc等指令来查询服务器时间，等于不提供ntp的网络校时 # notrap： 不提供trap这个远程时间登录的功能 # notrust： 拒绝没有认证的客户端 # nopeer： 不与其他同一层的ntp服务器进行时间同步 restrict 172.16.0.0 mask 255.255.255.0 nomodify notrap # Use public servers from the pool.ntp.org project. # Please consider joining the pool (http://www.pool.ntp.org/join.html). # 【设定NTP主机来源】 # prefer表示优先主机 server ntp1.aliyun.com prefer server ntp.fudan.edu.cn server time.nist.gov server 0.centos.pool.ntp.org iburst server 1.centos.pool.ntp.org iburst server 2.centos.pool.ntp.org iburst server 3.centos.pool.ntp.org iburst #broadcast 192.168.1.255 autokey # broadcast server #broadcastclient # broadcast client #broadcast 224.0.1.1 autokey # multicast server #multicastclient 224.0.1.1 # multicast client #manycastserver 239.255.254.254 # manycast server #manycastclient 239.255.254.254 autokey # manycast client # Enable public key cryptography. #crypto includefile /etc/ntp/crypto/pw # Key file containing the keys and key identifiers used when operating # with symmetric key cryptography. keys /etc/ntp/keys # Specify the key identifiers which are trusted. #trustedkey 4 8 42 # Specify the key identifier to use with the ntpdc utility. #requestkey 8 # Specify the key identifier to use with the ntpq utility. #controlkey 8 # Enable writing of statistics records. #statistics clockstats cryptostats loopstats peerstats # Disable the monitoring facility to prevent amplification attacks using ntpdc # monlist command when default restrict does not include the noquery flag. See # CVE-2013-5211 for more details. # Note: Monitoring will not be disabled with the limited restriction flag. disable monitor
## # [ec-b] 修改配置文件 /etc/ntp.conf # 添加 NTP 服务器地址：server 172.16.0.51 prefer # Use public servers from the pool.ntp.org project. # Please consider joining the pool (http://www.pool.ntp.org/join.html). server 172.16.0.51 prefer # 内网集群，其他 NTP 服务器，可以删掉 server 0.centos.pool.ntp.org iburst server 1.centos.pool.ntp.org iburst server 2.centos.pool.ntp.org iburst server 3.centos.pool.ntp.org iburst
## # [ec-c] 修改配置文件 /etc/ntp.conf # 添加 NTP 服务器地址：server 172.16.0.51 prefer # Use public servers from the pool.ntp.org project. # Please consider joining the pool (http://www.pool.ntp.org/join.html). server 172.16.0.51 prefer # 内网集群，其他 NTP 服务器，可以删掉 server 0.centos.pool.ntp.org iburst server 1.centos.pool.ntp.org iburst server 2.centos.pool.ntp.org iburst server 3.centos.pool.ntp.org iburst
启动 ntpd 服务
## # [ec-a]启动 ntpd 服务，开机自启动 [root@ec-a ~]# systemctl start ntpd.service && systemctl enable ntpd.service Created symlink from /etc/systemd/system/multi-user.target.wants/ntpd.service to /usr/lib/systemd/system/ntpd.service.
## # [ec-b]启动 ntpd 服务，开机自启动 [root@ec-b ~]# systemctl start ntpd.service && systemctl enable ntpd.service Created symlink from /etc/systemd/system/multi-user.target.wants/ntpd.service to /usr/lib/systemd/system/ntpd.service.
## # [ec-c]启动 ntpd 服务，开机自启动 [root@ec-c ~]# systemctl start ntpd.service && systemctl enable ntpd.service Created symlink from /etc/systemd/system/multi-user.target.wants/ntpd.service to /usr/lib/systemd/system/ntpd.service.
时间偏差
## # 查看与时间同步服务器的时间偏差 [root@ec-b ~]# ntpdc -c loopinfo offset: 0.053439 s frequency: 0.561 ppm poll adjust: 6 watchdog timer: 152 s
当前时间服务器
##
# 查看当前同步的时间服务器
[root@ec-b ~]# ntpq -p
remote refid st t when poll reach delay offset jitter
==============================================================================
ec-a 202.108.6.95 3 u 52 64 17 0.135 90.565 10.453
ntp8.flashdance 194.58.202.20 2 u 41 64 11 237.380 100.140 21.662
*b.sin.pobot.net 17.253.82.125 2 u 175 64 14 235.598 43.565 10.775
85.199.214.101 .GPS. 1 u 44 64 7 246.159 103.295 22.804
+uk.cluster.ntp. 185.134.196.169 2 u 38 64 17 208.644 79.655 14.344
