NTP服务器【Network Time Protocol(NTP)】是用来使计算机时间同步化的一种协议,它可以使计算机对其服务器或时钟源(如石英钟,GPS等等)做同步化,它可以提供高精准度的时间校正(LAN上与标准间差小于1毫秒,WAN上几十毫秒),且可介由加密确认的方式来防止恶毒的协议攻击。时间按NTP服务器的等级传播。按照离外部UTC源的远近把所有服务器归入不同的Stratum(层)中。

安装配置

[ec-a] 作为被同步时间的时间同步服务器, [ec-b] , [ec-c] 自动与 [ec-a] 进行时间同步。

# 全部节点安装ntp

[root@ec-a ~]# yum -y install ntp

[root@ec-b ~]# yum -y install ntp

[root@ec-c ~]# yum -y install ntp
##
#  [ec-a] 修改配置文件 /etc/ntp.conf
#  
[root@ec-a ~]# vim /etc/ntp.conf

# For more information about this file, see the man pages
# ntp.conf(5), ntp_acc(5), ntp_auth(5), ntp_clock(5), ntp_misc(5), ntp_mon(5).

# 系统时间与BIOS事件的偏差记录
driftfile /var/lib/ntp/drift

# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
restrict default nomodify notrap nopeer noquery

# Permit all access over the loopback interface.  This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
restrict 127.0.0.1 
restrict ::1

# Hosts on local network are less restricted.
#restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap
# 【配置客户端的授权】
#  此时表示限制向从 172.16.0.1-172.16.0.254 这些IP段的服务器提供NTP服务。
#  参数主要有:
#    ignore:  拒绝所有类型的ntp连接
#    nomodify:客户端不能使用ntpc与ntpq两支程式来修改服务器的时间参数
#    noquery: 客户端不能使用ntpq、ntpc等指令来查询服务器时间,等于不提供ntp的网络校时
#    notrap:  不提供trap这个远程时间登录的功能
#    notrust: 拒绝没有认证的客户端
#    nopeer:  不与其他同一层的ntp服务器进行时间同步
restrict 172.16.0.0 mask 255.255.255.0 nomodify notrap


# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
# 【设定NTP主机来源】
#  prefer表示优先主机
server ntp1.aliyun.com prefer
server ntp.fudan.edu.cn 
server time.nist.gov 
server 0.centos.pool.ntp.org iburst
server 1.centos.pool.ntp.org iburst
server 2.centos.pool.ntp.org iburst
server 3.centos.pool.ntp.org iburst

#broadcast 192.168.1.255 autokey	# broadcast server
#broadcastclient			# broadcast client
#broadcast 224.0.1.1 autokey		# multicast server
#multicastclient 224.0.1.1		# multicast client
#manycastserver 239.255.254.254		# manycast server
#manycastclient 239.255.254.254 autokey # manycast client

# Enable public key cryptography.
#crypto

includefile /etc/ntp/crypto/pw

# Key file containing the keys and key identifiers used when operating
# with symmetric key cryptography. 
keys /etc/ntp/keys

# Specify the key identifiers which are trusted.
#trustedkey 4 8 42

# Specify the key identifier to use with the ntpdc utility.
#requestkey 8

# Specify the key identifier to use with the ntpq utility.
#controlkey 8

# Enable writing of statistics records.
#statistics clockstats cryptostats loopstats peerstats

# Disable the monitoring facility to prevent amplification attacks using ntpdc
# monlist command when default restrict does not include the noquery flag. See
# CVE-2013-5211 for more details.
# Note: Monitoring will not be disabled with the limited restriction flag.
disable monitor
##
#  [ec-b] 修改配置文件 /etc/ntp.conf
#  添加 NTP 服务器地址:server 172.16.0.51 prefer

# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
server 172.16.0.51 prefer
# 内网集群,其他 NTP 服务器,可以删掉
server 0.centos.pool.ntp.org iburst
server 1.centos.pool.ntp.org iburst
server 2.centos.pool.ntp.org iburst
server 3.centos.pool.ntp.org iburst
##
#  [ec-c] 修改配置文件 /etc/ntp.conf
#  添加 NTP 服务器地址:server 172.16.0.51 prefer

# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
server 172.16.0.51 prefer
# 内网集群,其他 NTP 服务器,可以删掉
server 0.centos.pool.ntp.org iburst
server 1.centos.pool.ntp.org iburst
server 2.centos.pool.ntp.org iburst
server 3.centos.pool.ntp.org iburst

启动 ntpd 服务

##
#  [ec-a]启动 ntpd 服务,开机自启动

[root@ec-a ~]# systemctl start ntpd.service && systemctl enable ntpd.service
Created symlink from /etc/systemd/system/multi-user.target.wants/ntpd.service to /usr/lib/systemd/system/ntpd.service.

##
#  [ec-b]启动 ntpd 服务,开机自启动

[root@ec-b ~]# systemctl start ntpd.service && systemctl enable ntpd.service
Created symlink from /etc/systemd/system/multi-user.target.wants/ntpd.service to /usr/lib/systemd/system/ntpd.service.
##
#  [ec-c]启动 ntpd 服务,开机自启动

[root@ec-c ~]# systemctl start ntpd.service && systemctl enable ntpd.service
Created symlink from /etc/systemd/system/multi-user.target.wants/ntpd.service to /usr/lib/systemd/system/ntpd.service.

时间偏差

##
#  查看与时间同步服务器的时间偏差

[root@ec-b ~]# ntpdc -c loopinfo
offset:               0.053439 s
frequency:            0.561 ppm
poll adjust:          6
watchdog timer:       152 s

当前时间服务器

##
#   查看当前同步的时间服务器
[root@ec-b ~]# ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 ec-a            202.108.6.95     3 u   52   64   17    0.135   90.565  10.453
 ntp8.flashdance 194.58.202.20    2 u   41   64   11  237.380  100.140  21.662
*b.sin.pobot.net 17.253.82.125    2 u  175   64   14  235.598   43.565  10.775
 85.199.214.101  .GPS.            1 u   44   64    7  246.159  103.295  22.804
+uk.cluster.ntp. 185.134.196.169  2 u   38   64   17  208.644   79.655  14.344