NTP clock synchronization configuration

There are two ways NTP clock synchronization in Linux:

Direct synchronization (also known as jump synchronous) and smooth synchronization (also known as the Fine Sync).

Direct synchronization

Use ntpdate command to synchronize the time change directly.

If there are tasks that run on a 12-point server, the current server time is 13:00, but 11:00 standard time, use this command may cause duplication of tasks to perform. Using ntpdate synchronization could lead to the risk, so the command is also used for the first time using a synchronization clock when configuring the synchronization service.

Note: If the NTP Client NTP Server time and too much deviation may cause ntpd process Client exit.

Smooth synchronization

And ntpd clock synchronization, ensures that time is not subjected to a two, which offset each synchronization time will not be too steep, it is slowly, which is why, ntpd smooth synchronization may take relatively long time. The beginning may not synchronize the clock, waiting time and more slowly after the synchronization.

If synchronization is configured to smooth, vi / etc / sysconfig / ntpd , increasing the "-x" OPTIONS parameter options:
SYNC_HWCLOCK = Yes
OPTIONS = "- the -X-G"

Quick Sync / smoothing setting synchronization
in Linux ntpd -x option description

offset value	0~128ms	128ms~600s	600s~1000s	1000s more
There -x parameters	Fine tuning	Trimming (0.5ms / s, 600s in 14 days)	jump	Exit (plus -g parameter is ignored)
No argument -x	Fine tuning	jump	jump	Exit (plus -g parameter is ignored)

Linux ntpd access and adjust the time interval of no contact, standard ntp service not step mode adjustment, calculated after filtering the conclusion that offset deviation after each visit, before adjustment policies.

Standard clock synchronization server

http://www.pool.ntp.org/zone/cn site contains the world's standard time synchronization service, including time synchronization China, the corresponding URL is cn.pool.ntp.org, recommended ntp configuration file format:

server 3.cn.pool.ntp.org

server 1.asia.pool.ntp.org

server 3.asia.pool.ntp.org

NTP related to commonly used commands:

Restart ntpd service

# systemctl restart ntpd

Time synchronization directly change

ntpdate command to adjust the local date and time. It some sample obtained from each of the specified server, and filters using standard NTP clock and selection algorithm to select the best sample.

* If it determines that the clock than 0.5 seconds, it sets the clock time by calling the subroutine settimeofday. At boot time, which is a preferred method.
* If it is less than 0.5 second clock bias is determined, it is time to adjust the clock by calling the subroutine adjtime and offset. This approach tends to use sacrifice some stability to keep the clock drift is more accurate. When a command cron daemon but from regular ntpdate command is not run by running every hour or two hours to perform one can guarantee a sufficient accuracy of travel, thus avoiding adjust the clock.

Use multiple NTP Server can greatly improve the reliability and accuracy of the ntpdate command. Despite allowing the use of a single NTP Server, we recommend that you configure at least three to four NTP Server for better performance.

If a run on the same host is similar to the NTP daemon xntpd server daemon, a command will refuse to ntpdate to set the date.

语法：
ntpdate [-46bBdqsuv] [-a key#] [-e delay] [-k file] [-p samples] [-o version#] [-t timeo] [-U username] server ...
-a keyid: 使用keyid来认证全部数据包。
-b: 通过调用settimeofday子例程来增加时钟的时间。
-d: 指定调试方式。判断ntpdate命令会产生什么结果（不产生实际的结果）。结果再现在屏幕上。这个标志使用无特权的端口。
-e delay: 指定延迟认证处理的时间秒数。
-k keyfile: 当不使用缺省值/etc/ntp.keys文件时，为包含密钥的文件指定一个不同的名称。
-o version: 当轮询它的发出数据包时，指定使用的NTP版本实现。 Version的值可以是1，2，3。缺省值是3。
-p samples: 指定从每个服务器获取的样本的数目。 Samples的值：1~8，它的缺省值是4。
-s: 指定日志操作syslog设施的使用，而不是使用标准输出。当运行ntpdate命令和cron命令时，它是很有用的。
-t timeout: 指定等待响应的时间。给定timeout的值四舍五入为0.2秒的倍数。缺省值是1秒。
-u: 指定使用无特权的端口发送数据包。当在一个对特权端口的输入流量进行阻拦的防火墙后是很有益的，并希望在防火墙之外和主机同步。防火墙是一个系统或者计算机，它控制从外网对专用网的访问。

查看网络中的NTP服务器

# ntpq -p
[root@abc ~]# ntpq -p

remote refid st t when poll reach delay offset jitter
==============================================================================
ntpsrv01 .XFAC. 16 u - 1024 0 0.000 0.000 0.000
*LOCAL(0) .LOCL. 10 l 46 64 377 0.000 0.000 0.000
[root@abc ~]#
配置了LOCAL作为Server。这个说明当前使用了本地时钟作为服务端同步。这样时钟可能和ntpsrv01的不一致。

[root@abc ~]# ntpq -p
remote refid st t when poll reach delay offset jitter
==============================================================================
*ntpsrv01 101.201.72.121 4 u 32 64 17 0.161 0.119 0.093
[root@abc ~]#
未配置LOCAL作为Server。这个说明使用ntpsrv01作为服务端同步。时钟和ntpsrv01的保持一致。

状态说明：
*表示目前使用的NTP Server，这里选择的本机；
st：即stratum阶层，值越小表示ntp serve的精准度越高；
when：单位秒，几秒前曾做过时间同步更新的操作；
poll表示，每隔多少毫秒与ntp server同步一次；
reach：已经向上层NTP服务器要求更新的次数；
delay：网络传输过程钟延迟的时间；
offset：时间补偿的结果；
jitter：Linux系统时间与BIOS硬件时间的差异时间
注意：
1)NTP Server端重启后，Client端需要等5分钟再与其进行时间同步，否则会提示“no server suitable for synchronization found”错误。等待的时间可以通过命令 watch ntpq -p来监控。
2)注意reach这个值，在启动NTP Server服务后，这个值就从0开始不断增加，当增加到17的时候，从0到17是5次的变更，每一次是poll的值的秒数，是64秒*5=320秒的时间。如果之后从NTP Client同步NTP Server还失败的话，用ntpdate –d来查询详细错误信息，再做判断。

ntpdate -d排查错误信息：

1)Server dropped: no data
检查ntp的版本(ntpq -c version)，如果ntp版本>=4.2，在restrict的定义中使用了notrust的话，会导致以上错误。需要删除notrust。
2)检查NTP Server的防火墙，是否屏蔽了UDP 123端口。

查看同步状态

如果是内网，一般ntpstat很快就可以同步上

# ntpstat

ntpstat 命令查看时间同步状态，这个一般需要5-10分钟后才能成功连接和同步。所以，服务器启动后需要稍等下。

[root@abc ~]# ntpstat
synchronised to NTP server (192.168.111.254) at stratum 5
time correct to within 54 ms
polling server every 64 s
[root@abc ~]#

如果ntp客户端和服务端同步有问题，可使用下面命令查看详细信息：

# ntpdate –d serverIP

-d参数只是用于调试，显示效果而已，不会真实的改变系统的时间

restrict控制相关权限

语法为： restrict IP地址 mask 子网掩码参数

其中IP地址也可以是default ，default就是指所有的IP

参数有以下几个：

ignore ：关闭所有的 NTP 联机服务

nomodify：客户端不能更改服务端的时间参数，但是客户端可以通过服务端进行网络校时。

notrust ：客户端除非通过认证，否则该客户端来源将被视为不信任子网

noquery ：不提供客户端的时间查询：用户端不能使用ntpq，ntpc等命令来查询ntp服务器

notrap ：不提供trap远端登陆：拒绝为匹配的主机提供模式 6 控制消息陷阱服务。陷阱服务是 ntpdq 控制消息协议的子系统，用于远程事件日志记录程序。

nopeer ：用于阻止主机尝试与服务器对等，并允许欺诈性服务器控制时钟

kod ：访问违规时发送 KoD 包。

restrict -6 表示IPV6地址的权限设置。

局域网内的NTP同步配置

局域网内1台服务器作为NTP Server，2台服务器作为NTP Client与服务器进行时钟同步：

IP 描述

192.168.111.254 ntpd Server，用于和外部公共ntpd同步标准时间，同时作为内网的Server

192.168.111.129 ntpd Client，用于与ntpd Server同步时间

192.168.111.130 ntpd Client，用于与ntpd Server同步时间

1.检查ntp包是否已经安装

# rpm -q ntp

ntp-4.2.6p5-19.el7.centos.x86_64

如果没有安装，则需要先安装并设置开机自动启动ntpd服务

# yum -y install ntp

# systemctl enable ntpd

# systemctl start ntpd

2.防火墙配置

由于NTP服务需要使用到UDP端口号123，所以当系统的防火墙（Iptables）启动的情况下，必须开放UDP端口号123。

3.配置内网ntpd Server:192.168.111.254

1)配置前先使用命令同步时间,本机与外部时间服务器时间差距太大，让ntpd不能正常同步：

ntpdate -u cn.pool.ntp.org

2)修改/etc/ntp.conf文件，红色字体是修改的内容

# For more information about this file, see the man pages

# ntp.conf(5), ntp_acc(5), ntp_auth(5), ntp_clock(5), ntp_misc(5), ntp_mon(5).

driftfile /var/lib/ntp/drift

# Permit time synchronization with our time source, but do not

# permit the source to query or modify the service on this system.

restrict default nomodify notrap nopeer noquery

# Permit all access over the loopback interface. This could

# be tightened as well, but to do so would effect some of

# the administrative functions.

restrict 127.0.0.1

restrict ::1

# Hosts on local network are less restricted.

#restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap

# 允许内网其他机器同步时间，如果不添加该约束默认允许所有IP访问本机同步服务

restrict 192.168.111.0 mask 255.255.255.0 nomodify notrap

# Use public servers from the pool.ntp.org project.

# Please consider joining the pool (http://www.pool.ntp.org/join.html).

#server 0.centos.pool.ntp.org iburst

#server 1.centos.pool.ntp.org iburst

#server 2.centos.pool.ntp.org iburst

#server 3.centos.pool.ntp.org iburst

# 配置和上游标准时间同步

server 101.201.72.121 # 中国国家授时中心

server 133.100.11.8 #日本[福冈大学]

server 3.cn.pool.ntp.org

server 1.asia.pool.ntp.org

server 3.asia.pool.ntp.org

# 配置允许上游时间服务器主动修改本机(内网ntp Server)的时间

restrict 101.201.72.121 nomodify notrap noquery

restrict 133.100.11.8 nomodify notrap noquery

restrict 3.cn.pool.ntp.org nomodify notrap noquery

restrict 1.asia.pool.ntp.org nomodify notrap noquery

restrict 3.asia.pool.ntp.org nomodify notrap noquery

# 确保localhost有足够权限，使用没有任何限制关键词的语法。

# 外部时间服务器不可用时，以本地时间作为时间服务。

# 注意：这里不能改，必须使用127.127.1.0，否则会导致无法

#在ntp客户端运行ntpdate serverIP，出现no server suitable for synchronization found的错误。

#在ntp客户端用ntpdate –d serverIP查看，发现有“Server dropped: strata too high”的错误，并且显示“stratum 16”。而正常情况下stratum这个值得范围是“0~15”。

#这是因为NTP server还没有和其自身或者它的server同步上。

#以下的定义是让NTP Server和其自身保持同步，如果在ntp.conf中定义的server都不可用时，将使用local时间作为ntp服务提供给ntp客户端。

#下面这个配置，建议NTP Client关闭，建议NTP Server打开。因为Client如果打开，可能导致NTP自动选择合适的最近的NTP Server、也就有可能选择了LOCAL作为Server进行同步，而不与远程Server进行同步。

server 127.127.1.0 # local clock

fudge 127.127.1.0 stratum 10

#broadcast 192.168.1.255 autokey # broadcast server

#broadcastclient # broadcast client

#broadcast 224.0.1.1 autokey # multicast server

#multicastclient 224.0.1.1 # multicast client

#manycastserver 239.255.254.254 # manycast server

#manycastclient 239.255.254.254 autokey # manycast client

# Enable public key cryptography.

#crypto

includefile /etc/ntp/crypto/pw

# Key file containing the keys and key identifiers used when operating

# with symmetric key cryptography.

keys /etc/ntp/keys

# Specify the key identifiers which are trusted.

#trustedkey 4 8 42

# Specify the key identifier to use with the ntpdc utility.

#requestkey 8

# Specify the key identifier to use with the ntpq utility.

#controlkey 8

# Enable writing of statistics records.

#statistics clockstats cryptostats loopstats peerstats

# Disable the monitoring facility to prevent amplification attacks using ntpdc

# monlist command when default restrict does not include the noquery flag. See

# CVE-2013-5211 for more details.

# Note: Monitoring will not be disabled with the limited restriction flag.

disable monitor

修改完成后重启ntpd服务:

systemctl restart ntpd

查看网络中的NTP服务器，同时显示客户端和每个服务器的关系:

# ntpq -p

查看时间同步状态

# ntpstat

synchronised to local net at stratum 11

time correct to within 7948 ms

polling server every 64 s

这个一般需要5-10分钟后才能成功连接和同步。所以，服务器启动后需要稍等下。

刚启动的时候，执行ntpstat，会显示unsynchronised：

# ntpstat

unsynchronised

time server re-starting

polling server every 64 s

同步成功以后，会显示:

# ntpstat

synchronised to NTP server (202.112.10.36) at stratum 3

time correct to within 275 ms

polling server every 256 s

配置内网ntpd Client:192.168.111.129、130

1)检查ntp是否安装，以及是否设置了自启动，参考ntpd Server的ntp安装检查。

2)修改/etc/ntp.conf文件，红色字体是修改的内容:

# For more information about this file, see the man pages

# ntp.conf(5), ntp_acc(5), ntp_auth(5), ntp_clock(5), ntp_misc(5), ntp_mon(5).

driftfile /var/lib/ntp/drift

# Permit time synchronization with our time source, but do not

# permit the source to query or modify the service on this system.

restrict default nomodify notrap nopeer noquery

# Permit all access over the loopback interface. This could

# be tightened as well, but to do so would effect some of

# the administrative functions.

restrict 127.0.0.1

restrict ::1

# Hosts on local network are less restricted.

#restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap

# Use public servers from the pool.ntp.org project.

# Please consider joining the pool (http://www.pool.ntp.org/join.html).

#server 0.centos.pool.ntp.org iburst

#server 1.centos.pool.ntp.org iburst

#server 2.centos.pool.ntp.org iburst

#server 3.centos.pool.ntp.org iburst

#配置上游时间服务器为本地的ntpd Server服务器

server 192.168.111.254

# 配置允许上游时间服务器主动修改本机的时间

restrict 192.168.111.254 nomodify notrap noquery

#server 127.127.1.0 # local clock

#fudge 127.127.1.0 stratum 10

#broadcast 192.168.1.255 autokey # broadcast server

#broadcastclient # broadcast client

#broadcast 224.0.1.1 autokey # multicast server

#multicastclient 224.0.1.1 # multicast client

#manycastserver 239.255.254.254 # manycast server

#manycastclient 239.255.254.254 autokey # manycast client

# Enable public key cryptography.

#crypto

includefile /etc/ntp/crypto/pw

# Key file containing the keys and key identifiers used when operating

# with symmetric key cryptography.

keys /etc/ntp/keys

# Specify the key identifiers which are trusted.

#trustedkey 4 8 42

# Specify the key identifier to use with the ntpdc utility.

#requestkey 8

# Specify the key identifier to use with the ntpq utility.

#controlkey 8

# Enable writing of statistics records.

#statistics clockstats cryptostats loopstats peerstats

# Disable the monitoring facility to prevent amplification attacks using ntpdc

# monlist command when default restrict does not include the noquery flag. See

# CVE-2013-5211 for more details.

# Note: Monitoring will not be disabled with the limited restriction flag.

disable monitor

先和本地ntpd Server同步一下

# ntpdate -u 192.168.111.254

重启ntpd服务

# systemctl restart ntpd

查看状态

# ntpq -p

remote refid st t when poll reach delay offset jitter

==============================================================================

*192.168.111.254 LOCAL(0) 11 u 24 64 1 1.626 5182468 0.000