目录
一、Linux关闭防火墙
1、关闭防火墙查看状态
[root@CentOS7-0001 /]# systemctl stop firewalld
[root@CentOS7-0001 /]# systemctl status firewalld
2、关闭SElinux
[root@CentOS7-0001 /]# sed -i "7s/enforcing/disabled/" /etc/selinux/config
[root@CentOS7-0001 /]# setenforce 0
二、ntp时间同步配置
1、检查是否安装
[root@CentOS7-0001 init.d]# rpm -qa | grep ntp
2、安装ntp服务(需要yum源或者下载rpm包安装)
[root@CentOS7-0001 ]# rpm -qa | grep ntp
若没有找到,则说明没有安装ntp包,从光盘上找到ntp包,使用
[root@CentOS7-0001 ]# rpm -Uvh ntp***.rpm
或者使用yum install ntp 进行安装
[root@CentOS7-0001 ]# yum install ntp
3、验证ntp服务
[root@CentOS7-0001 ~]# ntpdate -u ntp1.aliyun.com
3 Mar 14:28:33 ntpdate[2513]: adjust time server 120.25.115.20 offset -0.026821 sec
[root@CentOS7-0001 ~]#
说明:ntp1.aliyun.com为公网的阿里云的时间服务器,实际项目中让客户提供时间服务器
ntp1.aliyun.com (阿里云)
202.120.2.101 (上海交通大学网络中心NTP服务器地址)
202.112.0.38 清华大学
4、创建同步脚本
创建时间同步脚本/srv/ntp_time.sh 内容如下
#!/bin/sh
/usr/sbin/ntpdate -u ntp1.aliyun.com >> /srv/ntp.log 2>&1; hwclock -w
给同步脚本授权
[root@CentOS7-0001 ~]# chmod u+x /srv/ntp_time.sh
5、加入定时同步任务
crontab -e 加入如下
30 6 * * * /srv/ntp_time.sh
30 18 * * * /srv/ntp_time.sh
每天早上6:30 晚上 18:30 做次时间检验同步
6、修改ntp.conf配置文件
vi /etc/ntp.conf
①、第一种配置:允许任何IP的客户机都可以进行时间同步
将“restrict default nomodify notrap noquery”这行修改成:restrict default nomodify notrap
②、第二种配置:只允许192.168.3.***网段的客户机进行时间同步在
restrict default kod nomodify notrap nopeer noquery之后增加一行:
restrict 192.168.3.0 mask 255.255.255.0 nomodify notrap
7、 启动ntp服务
[root@CentOS7-0001 etc]# systemctl start ntpd
[root@CentOS7-0001 etc]# systemctl enable ntpd
注:确保该端口以udp方式开放
[root@CentOS7-0001 etc]# netstat -an |grep 123
udp 0 0 192.168.65.56:123 0.0.0.0:*
二、chrony配置时间同步
centos/redhat 7新增了chrony,可使用chrony配置时间同步,ntp和chrony不能同时使用,二选一
1、服务端配置(192.168.65.188)
1.安装chrony软件
[root@CentOS7-0003 ~]# yum install chrony -y
2.修改配置文件
[root@CentOS7-0003 ~]# vim /etc/chrony.conf
server time1.aliyun.com iburst
server time2.aliyun.com iburst
server time3.aliyun.com iburst
server time4.aliyun.com iburst
server time5.aliyun.com iburst
server time6.aliyun.com iburst
server time7.aliyun.com iburst
allow 172.20.10.0/24 允许内网172.20.10这些访问
3.启动、开机自启动、查看状态、查看同步源
[root@CentOS7-0003 ~]# systemctl start chronyd ##启动chrony
[root@CentOS7-0003 ~]# systemctl enable chronyd ##设置开机自启动
[root@CentOS7-0003 ~]# systemctl status chronyd ##查看状态
● chronyd.service - NTP client/server
Loaded: loaded (/usr/lib/systemd/system/chronyd.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2021-04-29 09:00:32 CST; 6h left
Docs: man:chronyd(8)
man:chrony.conf(5)
CGroup: /system.slice/chronyd.service
└─20585 /usr/sbin/chronyd
Apr 29 09:00:32 tkkx-uat-jc-20.200 systemd[1]: Starting NTP client/server...
Apr 29 09:00:32 tkkx-uat-jc-20.200 chronyd[20585]: chronyd version 3.4 starting (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP +SCFIL...DEBUG)
Apr 29 09:00:32 tkkx-uat-jc-20.200 systemd[1]: Permission denied while opening PID file or unsafe symlink chain: /var/run/chr...yd.pid
Apr 29 09:00:32 tkkx-uat-jc-20.200 systemd[1]: Started NTP client/server.
Apr 29 09:00:38 tkkx-uat-jc-20.200 chronyd[20585]: Selected source 162.159.200.123
Apr 29 09:00:38 tkkx-uat-jc-20.200 chronyd[20585]: System clock wrong by -26880.264100 seconds, adjustment started
Apr 29 01:32:38 tkkx-uat-jc-20.200 chronyd[20585]: System clock was stepped by -26880.264100 seconds
Apr 29 01:32:40 tkkx-uat-jc-20.200 chronyd[20585]: Selected source 203.107.6.88
Hint: Some lines were ellipsized, use -l to show in full.
[root@CentOS7-0003 ~]# chronyc sources
210 Number of sources = 5
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^* 203.107.6.88 2 10 377 433 +415us[ +542us] +/- 29ms
^- electrode.felixc.at 3 10 377 424 +1160us[+1160us] +/- 134ms^- ntp1.ams1.nl.leaseweb.net 3 10 257 423 +27ms[ +27ms] +/- 246ms
^- 200-89-75-198-LIBRE.uchi> 2 9 377 425 +6911us[+6911us] +/- 206ms
^- time.cloudflare.com 3 10 377 364 -1461us[-1461us] +/- 109ms
2、客户端配置(192.168.65.166)
1. 安装chrony
[root@CentOS7-0001 ~]# yum install chrony -y
2. 修改配置文件
[root@CentOS7-0001 ~]# vim /etc/chrony.conf
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
#server 0.centos.pool.ntp.org iburst #注释此处
#server 1.centos.pool.ntp.org iburst
#server 2.centos.pool.ntp.org iburst
#server 3.centos.pool.ntp.org iburst
server 172.68.65.188 iburst #添加server
3.启动、开机自启动、查看状态、查看同步源
[root@CentOS7-0001 ~]# systemctl start chronyd
[root@CentOS7-0001 ~]# systemctl enable chronyd
[root@CentOS7-0001 ~]# systemctl status chronyd
● chronyd.service - NTP client/server
Loaded: loaded (/usr/lib/systemd/system/chronyd.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2021-04-29 02:37:40 CST; 3min 49s ago
Docs: man:chronyd(8)
man:chrony.conf(5)
CGroup: /system.slice/chronyd.service
└─15638 /usr/sbin/chronyd
Apr 29 02:37:40 TKKX-Uat-Dept-Temp251 systemd[1]: Starting NTP client/server...
Apr 29 02:37:40 TKKX-Uat-Dept-Temp251 chronyd[15638]: chronyd version 3.4 starting (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP +SCF...EBUG)
Apr 29 02:37:40 TKKX-Uat-Dept-Temp251 chronyd[15638]: Frequency 0.000 +/- 1000000.000 ppm read from /var/lib/chrony/drift
Apr 29 02:37:40 TKKX-Uat-Dept-Temp251 systemd[1]: Permission denied while opening PID file or unsafe symlink chain: /var/run/...yd.pid
Apr 29 02:37:40 TKKX-Uat-Dept-Temp251 systemd[1]: Started NTP client/server.
Apr 29 02:37:44 TKKX-Uat-Dept-Temp251 chronyd[15638]: Selected source 172.20.10.200
Apr 29 02:37:44 TKKX-Uat-Dept-Temp251 chronyd[15638]: System clock wrong by 213.638997 seconds, adjustment started
Apr 29 02:41:18 TKKX-Uat-Dept-Temp251 chronyd[15638]: System clock was stepped by 213.638997 seconds
[root@CentOS7-0001 ~]# chronyc sources
210 Number of sources = 1
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^* 192.168.65.188 3 6 377 22 -44us[ -58us] +/- 29ms
###最后一条有*号表示同步成
三、windows时间同步服务端搭建
以Windows(2003)下配置NTP时间服务器为例,因为默认情况下,WINDOWS SERVER 2003 是作为NTP客户端工作的 ,所以必须通过修改注册表,以使系统作为NTP服务器运行。注意,工作之前请先备份注册表文件。
1、通过开始菜单,输入regedit命令后打开注册表设定画面,此时请一定备份注册表文件。
2、修改以下选项的键值
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\
NtpServer内的「Enabled」设定为1,打开NTP服务器功能
3、修改以下键值
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\
AnnounceFlags设定为5,该设定强制主机将它自身宣布为可靠的时间源,从而使用内置的互补金属氧化物半导体(CMOS) 时钟。
4、在dos命令行执行以下命令,确保以上修改起作用
net stop w32time
net start w32time
四、windows时间同步客户端配置
调整日期和时间里面,选择Internet时间,配置自定义服务器地址或者网络上的地址
设置windows下的时间同步间隔操作步骤如下:
1、打开注册表
在“开始”菜单→“运行”项下(或按Win+R)输入“Regedit”进入注册表编辑器。
2、修改默认时间服务器地址
展开HKEY_LOCAL_MACHINE->SYSTEM->CurrentControlSet->Services->W32Time->Parameters分支,双击NtpServer将键值修改为阿里云公网域名地址:ntp1.aliyun.com ,然后点击“确定”按钮保存。
3.、修改校时周期为一天
展开HKEY_LOCAL_MACHINE->SYSTEM->CurrentControlSet->Services->W32Time->TimeProviders->NtpClient分支,并双击SpecialPollInterval键值,将对话框中的“基数栏”选择到“十进制”上,输入框中显示的数字正是自动对时的间隔(以秒为单位),比如默认的604800就是由7(天)×24(时)×60(分)×60(秒)计算来的。设定时间同步周期为一天,即24小时(86400秒),填入对话框,选十进制就填86400,选十六进制就填15180,点击确定保存关闭对话框。(可设置成900=15分钟或3600=1小时等周期值)