Create an NTP environment in Centos

Create an NTP environment in Centos

Recently, an Openstack and Ceph cluster were built. Because multiple nodes exist in the cluster and time synchronization is required between nodes, NTP is required. In addition, in some cases, the network environment is closed, therefore, you need to build an NTP server.

Server IP Address

Role

Description

Synchronization mode

192.168.100.203

NTPD service

1. synchronizes the standard time with the external public NTPD service

2. Serve as an NTPD service for internal and external networks

Smooth synchronization of NTPD services

192.168.40.xxx

Internal and external NTP clients

Synchronization time between Intranet devices and 192.168.100.203

Smooth synchronization of NTPD services

NTP time synchronization mode selection

There are two NTP Synchronization Methods in linux: Use the ntpdate command to synchronize directly and use the NTPD service for smooth synchronization. What is the difference? To put it simply, the concept will not be blurred after a long time.

The current system time of an existing device is. The actual current time (in the air, maybe on a satellite, here is assumed to be at the upper-level target NTP server for synchronization) is. If we use ntpdate synchronization (ntpdate-u destination NTP server IP address), the operating system time will be updated to immediately. If our system has a scheduled application that runs at every day, now that the task has run (the current time is) and is changed to 12: 30 by ntpdate, the task will be executed again after 10 minutes, this is terrible. This task can only be executed once !! I think you (actually me) have understood the hidden risks of ntpdate time synchronization. Of course, this example is extreme, but it is indeed risky. I don't plan to do this in the production environment, so it is better to be secure. Therefore, the solution to this problem is to smoothly change the time without having a time point experienced twice in a day. This is the smooth synchronization time of the NTPD service, the offset of each synchronization time will not be too steep, but it will take a long time (Q: How can this problem be solved? I only know one synchronization at a time, but it takes a long time to complete synchronization, therefore, you must manually synchronize ntpdate before enabling NTPD service synchronization ).

Install configurations

The CentOS 6.3 system already comes with the NTPD service, which is usually followed by default. If it is not installed, check it first, configure the yum repository, and install it in the yum mode. The details are as follows:

[Plain] view plaincopyprint?

1. # Rpm-qntp

If not, follow the steps below

[Plain] view plaincopyprint?

1. # Yuminstallntp

Install the NTP software package on each server on the Intranet according to the above installation method.

After that, you must configure the NTP service to start automatically.

[Plain] view plaincopyprint?

1. # Chkconfigntpdon
3. # Chkconfig -- listntpd

Before configuration, use ntpdate to manually synchronize the time, so that the time difference between the local machine and the external time server is too large, so that ntpd cannot be synchronized normally.

[Plain] view plaincopyprint?

1. # Ntpdate-u202.112.10.36
3. 22Dec16: 52: 38 ntpdate [6400]: adjusttimeserver202.112.10.36offset0.012135se

Configure Intranet NTP-Server (192.168.100.203)

The following describes how to configure the Intranet NPTD server (192.168.100.203). The core of the NTPD service configuration is in the/etc/ntp. conf file. The articles on the Internet, especially for foreigners, are very simple. I am fooled. Mom, the basic environment is different. We have to have Chinese characteristics. First, go to the configuration file. Later, the red part is my modification, and the others are the default ones.

[Plain] view plaincopyprint?

1. # Formoreinformationaboutthisfile, seethemanpages
3. # Ntp. conf (5), ntp_acc (5), ntp_auth (5), ntp_clock (5), ntp_misc (5), ntp_mon (5 ).
5. Driftfile/var/lib/ntp/drift
7. # Permittimesynchronizationwithourtimesource, butdonot
9. # Permitthesourcetoqueryormodifytheserviceonthissystem.
11. Restrictdefaultkodnomodifynotrapnopeernoquery
13. Restrict-6defaultkodnomodifynotrapnopeernoquery
15. # Permitallaccessovertheloopbackinterface. thiscocould
17. # Betightenedaswell, buttodosowouldeffectsomeof
19. # Theadministrativefunctions.
21. Restrict127.0.0.1
23. Restrict-6: 1
25. # Hostsonlocalnetworkarelessrestricted.
27. # Allow synchronization time of other machines on the Intranet
29. Restrict192.168.401_mask1_255.255.0nomodifynotrap
31. # Usepublicserversfromthepool. ntp. orgproject.
33. # Pleaseconsiderjoiningthepool (http://www.pool.ntp.org/join.html ).
35. # China's most active time server: http://www.pool.ntp.org/zone/cn
37. Server210.72.145.44perfer # China National Time Center
39. Server202.112.10.36 # 1.cn.pool.ntp.org
41. Server59.124.196.83 # 0.asia.pool.ntp.org
43. # Broadcast192.168.40.255autokey # broadcastserver
45. # Broadcastclient
47. # Broadcast224.0.1.1autokey # multicastserver
49. # Multicastclient224.0.1.1 # multicastclient
51. # Manycastserver239.425254.254 # manycastserver
53. # Manycastclient239.415254.254autokey # manycastclient
55. # Allowupdatetimebytheupperserver
57. # Allow the upper-layer time server to actively modify the local time
59. Restrict210.72.145.44nomodifynotrapnoquery
61. Restrict202.112.10.36nomodifynotrapnoquery
63. Restrict59.124.196.83nomodifynotrapnoquery
65. # UndisciplinedLocalClock. Thisisafakedriverintendedforbackup
67. # Andwhennooutsidesourceofsynchronizedtimeisavailable.
69. # When the external time server is unavailable, use the local time as the time service
71. Server127.127.1.0 # localclock
73. Fudge127.127.1.0stratum10
75. # Enablepublickeycryptography.
77. # Crypto
79. Includefile/etc/ntp/crypto/pw
81. # Keyfilecontainingthekeysandkeyidentifiersusedwhenoperating
83. # Withsf-rickeycryptography.
85. Keys/etc/ntp/keys
87. # Specifythekeyidentifierswhicharetrusted.
89. # Trustedkey4842
91. # Specifythekeyidentifiertousewiththentpdcutility.
93. # Requestkey8
95. # Specifythekeyidentifiertousewiththentpqutility.
97. # Controlkey8
99. # Enablewritingofstatisticsrecords.
101. # Statisticsclockstatscryptostatsloopstatspeerstats

For a simple description of configuration parameters and commands, see: http://linux.vbird.org/linux_server/0440ntp.php#server_ntp.conf

The configuration file is modified, saved and exited, and the service is started.

[Plain] view plaincopyprint?

1. # Servicentpdstart

After startup, it usually takes about 5-10 minutes to start synchronization with the external time server. You can run a command to query the NTPD service status.

View service connections and listeners

[Plain] view plaincopyprint?

1. # Netstat-tlunp | grepntp
3. Udp00192.168.100.203: 1230.0.0.0: * 23103/ntpd
5. Udp00127.0.0.1: 1230.0.0.0: * 23103/ntpd
7. Udp000.0.0.0: FIG: * 23103/ntpd
9. Udp00fe80: 6cae: 8bff: fe3d: f65: 123: * 23103/ntpd
11. Udp00fe80: 6family: 8bff: fe3d: f65: 123: * 23103/ntpd
13. Udp00: 1: 123: * 23103/ntpd
15. Udp00: 123: * 23103/ntpd

Ntpq-p: view the NTP server in the network and display the relationship between the client and each server.

[Plain] view plaincopyprint?

1. # Ntpq-p
3. # Ntpq-p
5. Remoterefidsttwhenpollreachdelayoffsetjitter
7. ========================================================== ==============================================
9. * 202.112.10.36202.112.10.602u277128314201.5539.1931721368
11. + 59.124.196.83129.6.15.282u8812837771.153-25.11114.004
13. LOCAL (0). locl.10l15643770.20..0000.000

Location

Flag

Description

Symbol

*

Response NTP server and the most accurate Server

+

NTP server responding to this query request

Blank (Space)

NTP server with No Response

Title

Remote

Name of the NTP server responding to this request

Refid

Name of the higher-level server used by the NTP server

St

Level of the NTP server that is responding to the request

When

Number of seconds since the last successful request

Poll

How often does the local server and remote server synchronize data? Unit: seconds. When NTP is started, the poll value is relatively small and the server synchronization frequency is high, you can adjust it to the correct time range as soon as possible. Then, the poll value will gradually increase and the synchronization frequency will decrease accordingly.

Reach

It is an octal value to test whether a connection can be established with the server. The value of each successful connection increases.

Delay

The round-trip time required to send synchronization requests from the local machine to the ntp server

Offset

The Time offset between the host and the synchronization time source through the NTP clock, in milliseconds. The closer the offset is to 0, the closer the time between the host and the ntp server is.

Jitter

Calculates the distribution of offset in a specific continuous number of connections. Simply put, the smaller the absolute value, the more accurate the host time.

The ntpstat command is used to check the time synchronization status. It usually takes 5 to 10 minutes to connect to and synchronize data. Therefore, wait a moment after the server is started.

When starting, it is generally:

[Plain] view plaincopyprint?

1. # Ntpstat
3. Unsynchronised
5. Timeserverre-starting
7. Pollingserverevery64s

After connection and synchronization:

[Plain] view plaincopyprint?

1. SynchronisedtoNTPserver (202.112.10.36) atstratum3
3. Timecorrecttowithin275ms
5. Pollingserverevery256s

OK. The intranet NTPD service has been configured. If all devices are normal, configure other devices in the intranet and use this server as the time synchronization service.

Configure Intranet NTP-Clients

Other devices on the Intranet are configured as NTP clients, which are relatively simple and the configurations of all devices are the same.

Install the NTPD service and configure it to self-start (exactly the same as NTP-Server ). Find one of the configuration files/etc/ntp. conf. After the configuration is verified, copy the file to another client and use it directly.

[Plain] view plaincopyprint?

1. # Yuminstallntp
3. # Chkconfigntpon
5. # Vim/etc/ntp. conf

[Plain] view plaincopyprint?

1. Driftfile/var/lib/ntp/drift
3. Restrict127.0.0.1
5. Restrict-6: 1
7. # Set the time server to a local time server
9. Server192.168.100.203
11. Restrict192.168.100.203nomodifynotrapnoquery
13. Server127.127.1.0 # localclock
15. Fudge127.127.1.0stratum10
17. Includefile/etc/ntp/crypto/pw
19. Keys/etc/ntp/keys

Save and exit. Use ntpdate to manually synchronize the time before requesting the server

[Plain] view plaincopyprint?

1. # Ntpdate-u192.168.0.135
3. 22Dec17: 09: 57 ntpdate [6439]: adjusttimeserver192.168.100.203offset0.004882sec

Synchronization may fail. Generally, the reason is that the local NTPD server is not properly started. It usually takes several minutes to start synchronization.

For error determination, refer to the subsequent error handling.

[Plain] view plaincopyprint?

1. # Servicentpdstart

View synchronization status after startup

[Plain] view plaincopyprint?

1. # Ntpq-p
3. # Ntpstat

! To perform daily time correction, you can write cron

[Root @ test root] # vi/etc/crontab
# Add this line: 10 5 * root/usr/sbin/ntpdate192.168.100.203;/sbin/hwclock-w
After cron is used, the Linux system automatically performs network Calibration at every day.

Troubleshooting

Used to collect installation, configuration, and Application Problems

Error 1: ntpdate-u ip-<no server suitable for synchronization found

Judgment: the ntp client uses ntpdate-d serverIP to view the error "Server dropped: strata too high" and displays "stratum 16 ". Normally, the value range of stratum is "0 ~ 15 ".

Cause: the NTP server is not synchronized with itself or its server. After you restart the ntp service on the ntp server, it may take five minutes for the ntp server to synchronize itself or with its server, during this time, when the client runs the ntpdate command, the no server suitable for synchronization found error is generated.

Processing: Wait a few minutes and try again.

You can also run the ntpq-p command to view the situation.