CURRENT_TIMESTAMP差8小时

转载

新新人类 2024-10-22 20:11:38

文章标签 linux ntpd 时间服务器服务器 Time 文章分类 架构后端开发

Time Server 时间服务器，我们经常会发现服务器上的时间不正确，这样会影响到我们的应用，有时甚至会带来一些不良后果。比如影响我们的备份，影响我们的数据库的更新等。比较常见的解决方行了，后面的195.13.1法是与公网上的时间服务器同步（只用使用crontab执行00 02 * * * /usr/sbin/ntpdate 195.13.1.153就.153就是公网上可以用的时间服务器之一），但这样做计算机必须能连接公网，这样也许会有一些安全问题。并且如果你的计算机在内网不能直接连接公网的时间服务器的话，那就…… 今天我们就来讲一讲搭建我们自己的时间服务器的做法。

方法一：时间服务器与公网上的时间服务器同步，其它机器与自己的时间服务器同步。

缺点：时间服务器还要暴露在公网上；步骤如下：

1. 检查是否有相应的包:
# rpm -qa |grep ntp
cyrus-imapd-nntp-2.2.3-11
chkfontpath-1.10.0-1
ntp-4.2.0-7

如果没有ntp这个包，则从光盘上装上，执行下面命令安装NTP的RPM包：# rpm -ivh ntp-4.2.0-7.i386.rpm；

2. 修改配置文件
/etc/ntp.conf 是ntp的主要配置文件，里面设置了你用来同步时间的时间服务器的域名或者IP地址，下面是到互联网同步时间的最基本的配置：
首先我们来定义自己喜欢的时间服务器：（可用的时间服务器，参看http://chinaunix.net/jh/5/100591.html，或者参看：http://www.eecis.udel.edu/~mills/ntp/servers.html）
server 195.13.1.153
server 210.72.145.44
接下来，我们设置上面两台服务器的访问权限，在这个例子中我们不允许它们修改或者查询我们配置在Linux上的NTP服务器。
restrict 195.13.1.153 mask 255.255.255.255 nomodify notrap noquery
restrict 210.72.145.44 mask 255.255.255.255 nomodify notrap noquery
说明：掩码255.255.255.255 是用来限制远程NTP服务器的掩码地址。然后设置允许访问的内网机器。请注意，配置中noquery已经去掉了：
restrict 192.168.1.0 mask 255.255.255.0 notrust nomodify notrap
在此例中，掩码地址扩展为255，因此从192.168.1.1-192.168.1.254 的计算机都可以使用我们的NTP服务器来同步时间。如果你想限制的更严格一点，你可以修改你的掩码。
最后，也是最重要的是默认的限制配置要从你配置文件中删除，否则它将覆盖你所有的配置选项，你会发现如果不删除该配置，你的时间服务器将只能和自己通讯。如果ntp.conf 中有以下一行，请将它注释：# restrict default ignore

/etc/ntp.conf 范例:
# Prohibit general access to this service.
# restrict default ignore

# Permit all access over the loopback interface. This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
# restrict 127.0.0.1

# -- CLIENT NETWORK -------
# Permit systems on this network to synchronize with this
# time service. Do not permit those systems to modify the
# configuration of this service. Also, do not use those
# systems as peers for synchronization.
restrict 192.168.1.0 mask 255.255.255.0 notrust nomodify notrap

# --- OUR TIMESERVERS -----
# or remove the default restrict line
# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.

# restrict mytrustedtimeserverip mask 255.255.255.255 nomodify notrap noque
restrict 210.72.145.44 mask 255.255.255.255 nomodify notrap noquery
restrict 195.13.1.153 mask 255.255.255.255 nomodify notrap noquery
# server mytrustedtimeserverip
server 210.72.145.44
server 195.13.1.153

# --- NTP MULTICASTCLIENT ---
#multicastclient # listen on default 224.0.1.1
# restrict 224.0.1.1 mask 255.255.255.255 notrust nomodify notrap
# restrict 192.168.1.0 mask 255.255.255.0 notrust nomodify notrap
# --- GENERAL CONFIGURATION ---
#
# Undisciplined Local Clock. This is a fake driver intended for backup
# and when no outside source of synchronized time is available. The
# default stratum is usually 3, but in this case we elect to use stratum
# 0. Since the server line does not have the prefer keyword, this driver
# is never used for synchronization, unless no other other
# synchronization source is available. In case the local host is
# controlled by some external source, such as an external oscillator or
# another protocol, the prefer keyword would cause the local host to
# disregard all other synchronization sources, unless the kernel
# modifications are in use and declare an unsynchronized condition.
#
# server 127.127.1.0 # local clock
# fudge 127.127.1.0 stratum 10

# Drift file. Put this in a directory which the daemon can write to.
# No symbolic links allowed, either, since the daemon updates the file
# by creating a temporary in the same directory and then rename()'ing
# it to the file.
#
driftfile /var/lib/ntp/drift
broadcastdelay 0.008

#
# Authentication delay. If you use, or plan to use someday, the
# authentication facility you should make the programs in the auth_stuff
# directory and figure out what this number should be on your machine.
#
authenticate yes

#
# Keys file. If you want to diddle your server at run time, make a
# keys file (mode 600 for sure) and define the key number to be
# used for making requests.
#
# PLEASE DO NOT USE THE DEFAULT VALUES HERE. Pick your own, or remote
# systems might be able to reset your clock at will. Note also that
# ntpd is started with a -A flag, disabling authentication, that
# will have to be removed as well.
#
keys /etc/ntp/keys

3. 检查可用性

a.保存你的配置文件，然后对每个你在ntp.conf里配置的时间服务器执一下查询命令，确保这些上游时间服务器可用。
# ntpdate 195.13.1.153
27 Jun 10:12:01 ntpdate[25475]: adjust time server 133.100.11.8 offset -0.127154 sec

b.执行下列命令
# ntpq -p
…… ……输出略
一个可以证明同步问题的证据是所有远程服务器的jitter值是4000并且delay和reach的值是0；
     remote refid st t when poll reach   delay offset jitter
===================================================================
*210.72.145.44 .ACTS. 1 u   40 16 377   55.211 9.172 16.620
xntp2.belbone.be 195.13.23.6      2 u 106 128 367 384.904 -63.946   6.518

4. 设置自启动

为了使NTP服务可以在系统引导的时候自动启动，执行：
# chkconfig ntpd on
启动/关闭/重启NTP的命令是：
# /etc/init.d/ntpd start
# /etc/init.d/ntpd stop
# /etc/init.d/ntpd restart

5. 客户端的设置
a. linux 客户端
以root身份登录，执行crontab -e 输入00 02 * * * /usr/sbin/ntpdate 192.168.1.1(换成你的Time Server的ip)
这样就会在每天的凌晨两点自动与Time Server同步时间。
b. windows Xp 客户端
双击右下角的时间，出现“日期和时间属性”的窗口，选择Internet 时间,在服务器一栏中输入你的Time Server的ip，点击＂立即更新＂，过几秒钟将能看到更新成功的提示。然后勾选“自动与Internet时间服务器同步”。点击确定。

方法二：时间服务器与自己的硬件时钟同步，其它机器与时间服务器同步。

缺点：如果Time Server的硬件时钟不准确，则所有的时间将不准确。优点：更安全，没有暴露在公网上的机器。

unix 类系统的时钟都有两种，一种是硬件时钟，一种是系统时钟。在此不在详述。步骤如下：
1.校准Time server的硬件时钟（可以直接在bios中设置），或者用hwclock 命令来校对，例如： hwclock --set --date="6/16/04 11:14:05"

2.设置系统时间和硬件时钟同步：# hwclock --hctosys.

3.修改配置文件
vi /etc/ntp.conf，我的ntp.conf如下

# Prohibit general access to this service.
# restrict default ignore
# Permit all access over the loopback interface. This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
restrict 127.0.0.1

# -- CLIENT NETWORK -------
# Permit systems on this network to synchronize with this
# time service. Do not permit those systems to modify the
# configuration of this service. Also, do not use those
# systems as peers for synchronization.
# restrict 192.168.1.0 mask 255.255.255.0 notrust nomodify notrap

# --- OUR TIMESERVERS -----
# or remove the default restrict line
# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
# restrict mytrustedtimeserverip mask 255.255.255.255 nomodify notrap noquery

# --- GENERAL CONFIGURATION ---
#
# Undisciplined Local Clock. This is a fake driver intended for backup
# and when no outside source of synchronized time is available. The
# default stratum is usually 3, but in this case we elect to use stratum
# 0. Since the server line does not have the prefer keyword, this driver
# is never used for synchronization, unless no other other
# synchronization source is available. In case the local host is
# controlled by some external source, such as an external oscillator or
# another protocol, the prefer keyword would cause the local host to
# disregard all other synchronization sources, unless the kernel
# modifications are in use and declare an unsynchronized condition
#
#server 127.127.1.0 # local clock
server 127.127.1.0 prefer
fudge 127.127.1.0 stratum 10
#
# Drift file. Put this in a directory which the daemon can write to.
# No symbolic links allowed, either, since the daemon updates the file
# by creating a temporary in the same directory and then rename()'ing
# it to the file.
#
driftfile /etc/ntp/drift
broadcastdelay 0.008
#
# Authentication delay. If you use, or plan to use someday, the
# authentication facility you should make the programs in the auth_stuff
# directory and figure out what this number should be on your machine.
#
authenticate yes
#
# Keys file. If you want to diddle your server at run time, make a
# keys file (mode 600 for sure) and define the key number to be
# used for making requests.
#
# PLEASE DO NOT USE THE DEFAULT VALUES HERE. Pick your own, or remote
# systems might be able to reset your clock at will. Note also that
# ntpd is started with a -A flag, disabling authentication, that
# will have to be removed as well.
#
keys /etc/ntp/keys