RHEL7学习之NTP配置

一，安装NTP

[root@localhost ~]# yum install ntp
Loaded plugins: product-id, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
cdrom                                                                 | 4.1 kB  ::
Resolving Dependencies
--> Running transaction check
---> Package ntp.x86_64 :4.2.6p5-.el7 will be installed
--> Processing Dependency: ntpdate = 4.2.6p5-.el7 for package: ntp-4.2.6p5-.el7.x86_64
--> Processing Dependency: libopts.so.()(64bit) for package: ntp-4.2.6p5-.el7.x86_64
--> Running transaction check
---> Package autogen-libopts.x86_64 :5.18-.el7 will be installed
---> Package ntpdate.x86_64 :4.2.6p5-.el7 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

=============================================================================================
 Package                   Arch             Version                    Repository       Size
=============================================================================================
Installing:
 ntp                       x86_64           4.2.6p5-.el7             cdrom            k
Installing for dependencies:
 autogen-libopts           x86_64           5.18-.el7                 cdrom             k
 ntpdate                   x86_64           4.2.6p5-.el7             cdrom             k

Transaction Summary
=============================================================================================
Install   Package (+ Dependent packages)

Total download size:  k
Installed size: 1.6 M
Is this ok [y/d/N]: y
Downloading packages:
---------------------------------------------------------------------------------------------
Total                                                          MB/s |  kB  ::
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : autogen-libopts-5.18-.el7.x86_64                                         /
  Installing : ntpdate-4.2.6p5-.el7.x86_64                                             /
  Installing : ntp-4.2.6p5-.el7.x86_64                                                 /
  Verifying  : ntpdate-4.2.6p5-.el7.x86_64                                             /
  Verifying  : autogen-libopts-5.18-.el7.x86_64                                         /
  Verifying  : ntp-4.2.6p5-.el7.x86_64                                                 / 

Installed:
  ntp.x86_64 :4.2.6p5-.el7                                                                

Dependency Installed:
  autogen-libopts.x86_64 :5.18-.el7             ntpdate.x86_64 :4.2.6p5-.el7            

Complete!

二，编辑NTP配置文件"/etc/ntp.conf"

[root@localhost ~]# vim /etc/ntp.conf 

# For more information about this file, see the man pages
# ntp.conf(), ntp_acc(), ntp_auth(), ntp_clock(), ntp_misc(), ntp_mon().

driftfile /var/lib/ntp/drift

# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
restrict default nomodify notrap nopeer noquery  

# Permit all access over the loopback interface.  This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
restrict 127.0.0.1
restrict ::

# Hosts on local network are less restricted.
restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap  //允许"192.168.1.0"使用NTP服务，nomodify notrap 不允许客户端配置服务器或者作为同步时间的节点。

# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
#server .rhel.pool.ntp.org iburst
#server .rhel.pool.ntp.org iburst
#server .rhel.pool.ntp.org iburst
#server .rhel.pool.ntp.org iburst
server 0.asia.pool.ntp.org   //NTP官方服务器池：http://www.pool.ntp.org/zone/asia
server 1.asia.pool.ntp.org
server 2.asia.pool.ntp.org
server 3.asia.pool.ntp.org

server 127.127.1.0        
  fudge 127.127.1.0 stratum 8  //当NTP服务不可用时，使用NTP服务器当前时间同步给客户机

#broadcast 192.168.1.255 autokey        # broadcast server
#broadcastclient                        # broadcast client
#broadcast 224.0.1.1 autokey            # multicast server
#multicastclient 224.0.1.1              # multicast client
#manycastserver 239.255.254.254         # manycast server
#manycastclient 239.255.254.254 autokey # manycast client

# Enable public key cryptography.
#crypto

includefile /etc/ntp/crypto/pw

# Key file containing the keys and key identifiers used when operating
# with symmetric key cryptography.
keys /etc/ntp/keys

# Specify the key identifiers which are trusted.
#trustedkey   

# Specify the key identifier to use with the ntpdc utility.
#requestkey 

# Specify the key identifier to use with the ntpq utility.
#controlkey 

# Enable writing of statistics records.
#statistics clockstats cryptostats loopstats peerstats

# Disable the monitoring facility to prevent amplification attacks using ntpdc
# monlist command when default restrict does not include the noquery flag. See
# CVE-- for more details.
# Note: Monitoring will not be disabled with the limited restriction flag.
disable monitor

logfile /var/log/ntp.log

三，验证NTP服务

1，验证NTP服务器从官方NTP服务器同步时间

[root@localhost ~]# ntpstat  //查看这台服务器是否连接到NTP官方服务器
synchronised to NTP server (160.16.201.66) at stratum
   time correct to within  ms
   polling server every  s

更改下时间，改为“错误”的时间。然后等待NTP服务自动同步准确的时间。

[root@localhost ~]# date
Wed Jan  :: CST 

使用命令"watch ntpq -p"查看NTP详细信息

Every .0s: ntpq -p                                                                                                                                Sat Jan  :: 

     remote           refid     st t when poll reach   delay   offset  jitter
==============================================================================
 y.ns.gin.ntt.ne 249.224.99.213    u           110.259
 time1.maxonline .GPS.             u            330.752
 send.mx.cdnetwo 133.100.8.2       u            87.927
*LOCAL()        .LOCL.            l             0.000    0.000   0.000

大约10分钟，同步成功。下面是同步成功的时间。时间同步成功后，并不会同步给硬件时间。系统重启后还会读取硬件时间同步给系统时间，所以需要重启前"clock -w"或者写入crontab。

Every .0s: ntpq -p                                                                                                                                Fri Feb  :: 

     remote           refid     st t when poll reach   delay   offset  jitter
==============================================================================
 LOCAL()        .LOCL.            l              0.000    0.000   0.000
+218.189.210.4   118.143.17.82     u             80.928    4.568   0.000
*x.ns.gin.ntt.ne 249.224.99.213    u             84.978   -9.332   0.000
+31.193.144.2.ar 131.107.13.100    u            311.808  -52.737   0.000
----. 218.100.41.254    u            464.010  114.567   0.000

2，验证Linux客户端从NTP服务器（192.168.10.10）同步时间

手动同步时间成功，说明NTP服务没问题。可以在Linux客户机上建立crontab任务或者配置NTP服务来同步时间。

[root@localhost ~]# ntpdate -u 192.168.1.10
 Feb :: ntpdate[]: adjust time server 192.168.1.10 offset -0.000051 sec
[root@localhost ~]# date
Thu Feb  :: CST 

四，配置Linux客户机自动同步时间的两种方法

1，使用crontab从NTP服务器同步时间

[root@localhost ~]# crontab -e

30 3 * * *  /usr/sbin/ntpdate -u  192.168.10.10; /usr/sbin/clock -w  //每天3:30从NTP服务器同步时间，并把系统时间同步给硬件时间。

2，使用NTP服务同步时间

安装NTP服务

[root@localhost ~]# yum install ntp
Loaded plugins: product-id, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Resolving Dependencies
--> Running transaction check
---> Package ntp.x86_64 :4.2.6p5-.el7 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

===========================================================================================================================================================================
 Package                              Arch                                    Version                                         Repository                              Size
===========================================================================================================================================================================
Installing:
 ntp                                  x86_64                                  4.2.6p5-.el7                                  cdrom                                   k

Transaction Summary
===========================================================================================================================================================================
Install   Package

Total download size:  k
Installed size: 1.4 M
Is this ok [y/d/N]: y
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : ntp-4.2.6p5-.el7.x86_64                                                                                                                               /
  Verifying  : ntp-4.2.6p5-.el7.x86_64                                                                                                                               / 

Installed:
  ntp.x86_64 :4.2.6p5-.el7      

更改"/etc/ntp.conf"，注释掉原有NTP服务器地址，加入"server 192.168.10.10"

# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
#server .rhel.pool.ntp.org iburst
#server .rhel.pool.ntp.org iburst
#server .rhel.pool.ntp.org iburst
#server .rhel.pool.ntp.org iburst
server 192.168.10.10

将当前时间修改成“错误时间”，通过NTP服务来验证是否能够同步时间。

[root@localhost ~]# date
Sat Feb  :: CST
[root@localhost ~]# date -s 20130123
Wed Jan  :: CST 

[root@localhost ~]# watch ntpq -p
Every .0s: ntpq -p                                                                                                                                Wed Jan  :: 

     remote           refid     st t when poll reach   delay   offset  jitter
==============================================================================
 192.168.10.10   211.233.84.186    u              0.707   

Every .0s: ntpq -p                                                                                                                                Sat Feb  :: 

     remote           refid     st t when poll reach   delay   offset  jitter
==============================================================================
*192.168.10.10   194.225.150.25    u             0.746   98.114  70.556