Linux服务器ntp时间同步离线安装配置

写在前面：在大多数实际生产环境集群模式中，需要进行配置集群中所有服务器时间同步，避免因时间不同步导致集群异常问题；但是大多数公司生产环境都为内网环境不能连接互联网进行在线安装ntp服务，本文基于内网环境进行ntp服务安装配置，做到内网集群时间自动同步。

1.环境准备

准备三台（或三台以上）物理机或虚拟机，选择其中一台作为NTP服务端，其他作为NTP客户端。

IP	主机名	角色
192.168.86.201	esnode1	NTP服务端
192.168.86.202	esnode2	NTP客户端
192.168.86.203	esnode3	NTP客户端

2.下载安装包

确认操作系统版本，可执行以下命令确认自己系统的版本信息（我的Linux系统为CentOS7.4 x86_64版本）

cat /etc/redhat-release
uname -a
cat /proc/version

确认系统是否已安装NTP服务

rpm -qa | grep ntp

注：我的系统通过在线安装已经安装过，这里为了演示离线安装我进行卸载。

如果系统自带或已安装版本不符合个人需求，可进行卸载，命令如下：

rpm -e --nodeps ntpdate-4.2.6p5-29.el7.centos.2.x86_64
rpm -e --nodeps ntp-4.2.6p5-29.el7.centos.2.x86_64

离线安装NTP需要下载NTP相关rpm安装包
可以通过https://pkgs.org/download/ntp查找所需对应操作系统的安装包
需要下载ntp与ntpdate两个安装包

也可以直接通过以下链接进行下载：

http://mirror.centos.org/centos/7/updates/x86_64/Packages/ntp-4.2.6p5-29.el7.centos.2.x86_64.rpm
http://mirror.centos.org/centos/7/updates/x86_64/Packages/ntpdate-4.2.6p5-29.el7.centos.2.x86_64.rpm

3.安装NTP服务

下载完成所需安装包，接下来就进行NTP服务的安装
安装ntpdate

rpm -ivh ntpdate-4.2.6p5-29.el7.centos.2.x86_64.rpm

安装ntp

rpm -ivh ntp-4.2.6p5-29.el7.centos.2.x86_64.rpm

温馨提示：其他节点参考此步骤进行安装。

4.配置NTP

NTP服务器端配置

vim /etc/ntp.conf

# For more information about this file, see the man pages
# ntp.conf(5), ntp_acc(5), ntp_auth(5), ntp_clock(5), ntp_misc(5), ntp_mon(5).

driftfile /var/lib/ntp/drift

# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
restrict default nomodify notrap nopeer noquery

# Permit all access over the loopback interface.  This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
restrict 127.0.0.1 
restrict ::1

# Hosts on local network are less restricted.
#restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap
# 允许192.168.86.0网段内所有机器从esnode1同步时间
restrict 192.168.86.0 mask 255.255.255.0 nomodify notrap

# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
#server 0.centos.pool.ntp.org iburst
#server 1.centos.pool.ntp.org iburst
#server 2.centos.pool.ntp.org iburst
#server 3.centos.pool.ntp.org iburst
# 中国国家授时中心服务器地址
server 0.cn.pool.ntp.org
server 1.cn.pool.ntp.org
server 2.cn.pool.ntp.org
server 3.cn.pool.ntp.org

# 允许上层时间服务器主动修改本机时间
restrict 0.cn.pool.ntp.org nomodify notrap noquery
restrict 1.cn.pool.ntp.org nomodify notrap noquery
restrict 2.cn.pool.ntp.org nomodify notrap noquery
restrict 3.cn.pool.ntp.org nomodify notrap noquery

# 外部时间服务器不可用时，以本地时间作为时间服务
server 127.127.1.0
fudge 127.127.1.0 stratum 10

#broadcast 192.168.1.255 autokey	# broadcast server
#broadcastclient			# broadcast client
#broadcast 224.0.1.1 autokey		# multicast server
#multicastclient 224.0.1.1		# multicast client
#manycastserver 239.255.254.254		# manycast server
#manycastclient 239.255.254.254 autokey # manycast client

# Enable public key cryptography.
#crypto

includefile /etc/ntp/crypto/pw

# Key file containing the keys and key identifiers used when operating
# with symmetric key cryptography. 
keys /etc/ntp/keys

# Specify the key identifiers which are trusted.
#trustedkey 4 8 42

# Specify the key identifier to use with the ntpdc utility.
#requestkey 8

# Specify the key identifier to use with the ntpq utility.
#controlkey 8

# Enable writing of statistics records.
#statistics clockstats cryptostats loopstats peerstats

# Disable the monitoring facility to prevent amplification attacks using ntpdc
# monlist command when default restrict does not include the noquery flag. See
# CVE-2013-5211 for more details.
# Note: Monitoring will not be disabled with the limited restriction flag.
SYNC_HWCLOCK=yes
disable monitor

NTP客户端配置

# For more information about this file, see the man pages
# ntp.conf(5), ntp_acc(5), ntp_auth(5), ntp_clock(5), ntp_misc(5), ntp_mon(5).

driftfile /var/lib/ntp/drift

# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
restrict default nomodify notrap nopeer noquery

# Permit all access over the loopback interface.  This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
restrict 127.0.0.1 
restrict ::1

# Hosts on local network are less restricted.
#restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap

# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
#server 0.centos.pool.ntp.org iburst
#server 1.centos.pool.ntp.org iburst
#server 2.centos.pool.ntp.org iburst
#server 3.centos.pool.ntp.org iburst

# 从esnode1中同步时间
server 192.168.86.201

# 允许esnode1修改本地时间
restrict 192.168.86.201 nomodify notrap noquery

# 如果esnode1不可用，用本地的时间服务
server 127.127.1.0
fudge 127.127.1.0 stratum 10

#broadcast 192.168.1.255 autokey	# broadcast server
#broadcastclient			# broadcast client
#broadcast 224.0.1.1 autokey		# multicast server
#multicastclient 224.0.1.1		# multicast client
#manycastserver 239.255.254.254		# manycast server
#manycastclient 239.255.254.254 autokey # manycast client

# Enable public key cryptography.
#crypto

includefile /etc/ntp/crypto/pw

# Key file containing the keys and key identifiers used when operating
# with symmetric key cryptography. 
keys /etc/ntp/keys

# Specify the key identifiers which are trusted.
#trustedkey 4 8 42

# Specify the key identifier to use with the ntpdc utility.
#requestkey 8

# Specify the key identifier to use with the ntpq utility.
#controlkey 8

# Enable writing of statistics records.
#statistics clockstats cryptostats loopstats peerstats

# Disable the monitoring facility to prevent amplification attacks using ntpdc
# monlist command when default restrict does not include the noquery flag. See
# CVE-2013-5211 for more details.
# Note: Monitoring will not be disabled with the limited restriction flag.
SYNC_HWCLOCK=yes
disable monitor

5.验证时间同步

启动ntp服务器需要在各节点先手动同步一下时间
如果能连接互联网且在ntp服务端配置了上层服务端为中国国家授时中心服务器地址，应先手动同步一下国家授时中心时间，命令如下：

ntpdate cn.pool.ntp.org

其他客户端节点都进行手动同步ntp服务端时间，命令如下：

ntpdate 192.168.86.201

启动ntp

systemctl start ntpd.service

查看启动运行状态

systemctl status ntpd.service

ntpstat

每个节点开启开机自启动

systemctl enable ntpdate.service
或
chkconfig ntpd on

同时执性date命令

[root@esnode1 ~]# date
Thu Sep 10 11:00:55 CST 2020
[root@esnode2 ~]# date
Thu Sep 10 11:00:55 CST 2020
[root@esnode3 ~]# date
Thu Sep 10 11:00:55 CST 2020

结语：如若文章有何不妥之处欢迎指正，谢谢！