29.10 ͨ¹ý NTP ½øÐÐʱÖÓͬ²½

Contributed by Tom Hukins.

29.10.1 ×ÝÀÀ

¡¡¡¡Ëæ×Åʱ¼äµÄÍÆÒÆ£¬ ¼ÆËã»úµÄʱÖÓ»áÇãÏòÓÚÆ¯ÒÆ¡£ ÍøÂçʱ¼äЭÒé (NTP) ÊÇÒ»ÖÖÈ·±£ÄúµÄʱÖÓ±£³Ö׼ȷµÄ·½·¨¡£

¡¡¡¡Ðí¶à Internet ·þÎñÒÀÀµ¡¢ »ò¼«´óµØÊÜÒæÓÚ±¾µØ¼ÆËã»úʱÖÓµÄ׼ȷÐÔ¡£ ÀýÈ磬 web ·þÎñÆ÷¿ÉÄÜ»á½ÓÊÕµ½Ò»¸öÇëÇó£¬ ÒªÇóÈç¹ûÎļþÔÚijһʱ¿ÌÖ®ºóÐ޸Ĺý²Å·¢ËÍËü¡£ ÔÚ¾ÖÓòÍø»·¾³ÖУ¬ ¹²ÏíÎļþµÄ¼ÆËã»úÖ®¼äµÄʱÖÓÊÇ·ñͬ²½ÖÁ¹ØÖØÒª£¬ ÒòΪÕâÑù²ÅÄÜʹʱ¼ä´Á±£³ÖÒ»Ö¡£ ÀàËÆ cron(8) ÕâÑùµÄ³ÌÐò£¬ Ò²ÒÀÀµÓÚÕýÈ·µÄϵͳʱÖÓ£¬ ²ÅÄܹ»×¼È·µØÖ´ÐвÙ×÷¡£

¡¡¡¡FreeBSD ¸½´øÁË ntpd(8) NTP ·þÎñÆ÷£¬ Ëü¿ÉÒÔÓÃÓÚ²éѯÆäËüµÄ NTP ·þÎñÆ÷£¬ ²¢ÅäÖñ¾µØ¼ÆËã»úµÄʱÖÓ£¬ »òÕßΪÆäËü»úÆ÷Ìṩ·þÎñ¡£

29.10.2 Ñ¡ÔñºÏÊ浀 NTP ·þÎñÆ÷

¡¡¡¡ÎªÁËͬ²½ÄúµÄϵͳʱÖÓ£¬ ÐèÒªÊ×ÏÈÕÒµ½ÖÁÉÙÒ»¸ö NTP ·þÎñÆ÷ÒÔ¹©Ê¹Óá£ ÍøÂç¹ÜÀíÔ±£¬ »ò ISP ¶¼¿ÉÄÜ»áÌṩÓÃÓÚÕâÑùÄ¿µÄµÄ NTP ·þÎñÆ÷©¤©¤Çë²é¿´ËûÃǵÄÎĵµÒÔÁ˽âÊÇ·ñÊÇÕâÑù¡£ ÁíÍ⣬ Ò²ÓÐÒ»¸öÔÚÏßµÄ ¹«¿ªµÄ NTP ·þÎñÆ÷ÁÐ±í£¬ Äú¿ÉÒÔ´ÓÖÐѡһ¸ö½Ï½üµÄ NTP ·þÎñÆ÷¡£ ÇëÈ·ÈÏÄúÑ¡ÔñµÄ·þÎñÆ÷µÄ·ÃÎʲßÂÔ£¬ Èç¹ûÐèÒªµÄ»°£¬ ÉêÇëÒ»ÏÂËùÐèµÄÐí¿É¡£

¡¡¡¡Ñ¡Ôñ¶à¸öÏ໥²»Á¬½ÓµÄ NTP ·þÎñÆ÷ÊÇÒ»¸öºÃÖ÷Ò⣬ ÕâÑùÔÚij¸ö·þÎñÆ÷²»¿É´ï£¬ »òÕßʱÖÓ²»¿É¿¿Ê±¾Í¿ÉÒÔÓбðµÄÑ¡Ôñ¡£ ÕâÊÇÒòΪ£¬ ntpd(8) »áÖÇÄܵØÑ¡ÔñËüÊÕµ½µÄÏìÓ¦©¤©¤Ëü»á¸üÇãÏòÓÚʹÓÿɿ¿µÄ·þÎñÆ÷¡£

29.10.3 ÅäÖÃÄúµÄ»úÆ÷

29.10.3.1 »ù±¾ÅäÖÃ

¡¡¡¡Èç¹ûÖ»ÏëÔÚϵͳÆô¶¯Ê±Í¬²½Ê±ÖÓ£¬ Ôò¿ÉÒÔʹÓà ntpdate(8)¡£ ¶ÔÓÚ¾­³£ÖØÐÂÆô¶¯£¬ ²¢ÇÒ²»ÐèÒª¾­³£Í¬²½µÄ×ÀÃæÏµÍ³À´ËµÕâ±È½ÏÊʺϣ¬ µ«¾ø´ó¶àÊý»úÆ÷¶¼Ó¦¸ÃÔËÐÐ ntpd(8)¡£

¡¡¡¡ÔÚÒýµ¼Ê±Ê¹Óà ntpdate(8) À´ÅäºÏÔËÐÐ ntpd(8) Ò²ÊÇÒ»¸öºÃÖ÷Òâ¡£ ntpd(8) ½¥½øµØÐÞÕýʱÖÓ£¬ ¶ø ntpdate(8) ÔòÖ±½ÓÉèÖÃʱÖÓ£¬ ÎÞÂÛ»úÆ÷µÄµ±Ç°Ê±¼äºÍÕýȷʱ¼äÓжà´óµÄÆ«²î¡£

¡¡¡¡ÒªÆôÓÃÒýµ¼Ê±µÄ ntpdate(8)£¬ ÐèÒª°Ñ ntpdate_enable="YES" ¼Óµ½ /etc/rc.conf ÖС£ ´ËÍ⣬ »¹ÐèҪͨ¹ý ntpdate_flags À´ÉèÖÃͬ²½µÄ·þÎñÆ÷ºÍÑ¡Ï ËüÃǽ«´«µÝ¸ø ntpdate(8)¡£

29.10.3.2 Ò»°ãÅäÖÃ

¡¡¡¡NTP ÊÇͨ¹ý /etc/ntp.conf ÎļþÀ´½øÐÐÅäÖõģ¬ Æä¸ñʽÔÚ ntp.conf(5) ÖнøÐÐÁËÃèÊö¡£ ÏÂÃæÊÇÒ»¸öÀý×Ó£º

server ntplocal.example.com prefer
server timeserver.example.org
server ntp2a.example.net

driftfile /var/db/ntp.drift

¡¡¡¡ÕâÀ server Ñ¡ÏîÖ¸¶¨ÁËʹÓÃÄÄÒ»¸ö·þÎñÆ÷£¬ ÿһ¸ö·þÎñÆ÷¶¼¶ÀÁ¢Ò»ÐС£ Èç¹ûijһ̨·þÎñÆ÷ÉÏÖ¸¶¨ÁË prefer (Æ«ºÃ) ²ÎÊý£¬ ÈçÉÏÃæµÄ ntplocal.example.com£¬ Ôò»áÓÅÏÈÑ¡ÔñÕâ¸ö·þÎñÆ÷¡£ Èç¹ûÆ«ºÃµÄ·þÎñÆ÷ºÍÆäËû·þÎñÆ÷µÄÏìÓ¦´æÔÚÏÔÖøµÄ²î±ð£¬ Ôò¶ªÆúËüµÄÏìÓ¦£¬ ·ñÔò½«Ê¹ÓÃÀ´×ÔËüµÄÏìÓ¦£¬ ¶ø²»Àí»áÆäËû·þÎñÆ÷¡£ Ò»°ãÀ´Ëµ£¬ prefer ²ÎÊýÓ¦¸Ã±ê×¢Ôڷdz£¾«È·µÄ NTP ʱԴ£¬ ÀýÈçÄÇЩ°üº¬ÌØÊâµÄʱ¼ä¼à¿ØÓ²¼þµÄ·þÎñÆ÷ÉÏ¡£

¡¡¡¡¶ø driftfile Ñ¡Ï ÔòÖ¸¶¨ÁËÓÃÀ´±£´æÏµÍ³Ê±ÖÓÆµÂÊÆ«²îµÄÎļþ¡£ ntpd(8) ³ÌÐòʹÓÃËüÀ´×Ô¶¯µØ²¹³¥Ê±ÖÓµÄ×ÔÈ»Æ¯ÒÆ£¬ ´Ó¶øÊ¹Ê±ÖÓ¼´Ê¹ÔÚÇжÏÁËÍâÀ´Ê±Ô´µÄÇé¿öÏ£¬ ÈÔÄܱ£³ÖÏ൱µÄ׼ȷ¶È¡£

¡¡¡¡ÁíÍ⣬ driftfile Ñ¡ÏîÒ²±£´æÉÏÒ»´ÎÏìÓ¦ËùʹÓÃµÄ NTP ·þÎñÆ÷µÄÐÅÏ¢¡£ Õâ¸öÎļþ°üº¬ÁË NTP µÄÄÚ²¿ÐÅÏ¢£¬ Ëü²»Ó¦±»ÈÎºÎÆäËû½ø³ÌÐ޸ġ£

29.10.3.3 ¿ØÖÆÄúµÄ·þÎñÆ÷µÄ·ÃÎÊ

¡¡¡¡Ä¬ÈÏÇé¿öÏ£¬ NTP ·þÎñÆ÷¿ÉÒÔ±»Õû¸ö Internet ÉϵÄÖ÷»ú·ÃÎÊ¡£ Èç¹ûÔÚ /etc/ntp.conf ÖÐÖ¸¶¨ restrict ²ÎÊý£¬ Ôò¿ÉÒÔ¿ØÖÆÔÊÐíÄÄЩ»úÆ÷·ÃÎÊÄúµÄ·þÎñÆ÷¡£

¡¡¡¡Èç¹ûÏ£Íû¾Ü¾øËùÓеĻúÆ÷·ÃÎÊÄúµÄ NTP ·þÎñÆ÷£¬ Ö»ÐèÔÚ /etc/ntp.conf ÖмÓÈ룺

restrict default ignore

×¢Òâ: ÕâÑù×ö»á½ûÖ¹ÄúµÄ·þÎñÆ÷·ÃÎÊÔÚ±¾µØÅäÖÃÖÐÁгöµÄ·þÎñÆ÷¡£ Èç¹ûÄúÐèÒªÁî NTP ·þÎñÆ÷ÓëÍâ½çµÄ NTP ·þÎñÆ÷ͬ²½Ê±¼ä£¬ ÔòÓ¦ÔÊÐíÖ¸¶¨·þÎñÆ÷¡£ Çë²Î¼ûÁª»úÊÖ²á ntp.conf(5) ÒÔÁË½â½øÒ»²½µÄϸ½Ú¡£

¡¡¡¡Èç¹ûֻϣÍû×ÓÍøÄڵĻúÆ÷ͨ¹ýÄúµÄ·þÎñÆ÷ͬ²½Ê±ÖÓ£¬ ¶ø²»ÔÊÐíËüÃÇÅäÖÃΪ·þÎñÆ÷£¬ »ò×÷Ϊͬ²½Ê±ÖӵĽڵãÀ´Ê±Ó㬠Ôò¼ÓÈë

restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap

¡¡¡¡ÕâÀ ÐèÒª°Ñ 192.168.1.0 ¸ÄΪÄúÍøÂçÉ쵀 IP µØÖ·£¬ ²¢°Ñ 255.255.255.0 ¸ÄΪÄúµÄ×ÓÍøÑÚÂë¡£

¡¡¡¡/etc/ntp.conf ¿ÉÄܰüº¬¶à¸ö restrict Ñ¡Ïî¡£ ÒªÁË½â½øÒ»²½µÄϸ½Ú£¬ Çë²Î¼û ntp.conf(5) µÄ Access Control Support(·ÃÎÊ¿ØÖÆÖ§³Ö) С½Ú¡£

29.10.4 ÔËÐÐ NTP ·þÎñÆ÷

¡¡¡¡ÒªÈà NTP ·þÎñÆ÷ÔÚϵͳÆô¶¯Ê±ËæÖ®¿ªÆô£¬ ÐèÒª°Ñ ntpd_enable="YES" ¼ÓÈëµ½ /etc/rc.conf ÖС£ Èç¹ûÏ£ÍûÏò ntpd(8) ´«µÝ¸ü¶à²ÎÊý£¬ ÐèÒª±à¼­ /etc/rc.conf ÖÐµÄ ntpd_flags¡£

¡¡¡¡ÒªÔÚ²»ÖØÐÂÆô¶¯»úÆ÷µÄǰÌáÏÂÆô¶¯·þÎñÆ÷£¬ ÐèÒªÊÖ¹¤ÔËÐÐ ntpd£¬ ²¢´øÉÏ /etc/rc.conf ÖÐµÄ ntpd_flags ËùÖ¸¶¨µÄ²ÎÊý¡£ ÀýÈ磺

# ntpd -p /var/run/ntpd.pid

29.10.5 ÔÚÁÙʱÐ﵀ Internet Á¬½ÓÉÏʹÓà ntpd

¡¡¡¡ntpd(8) ³ÌÐòµÄÕý³£¹¤×÷²¢²»ÐèÒªÓÀ¾ÃÐ﵀ Internet Á¬½Ó¡£ È»¶ø£¬ Èç¹ûÄúµÄÁÙʱÐÔÁ¬½ÓÊÇÅäÖÃΪ°´Ð貦ºÅµÄ£¬ ÄÇô·ÀÖ¹ NTP ͨѶƵ·±´¥·¢²¦ºÅ£¬ »ò±£³ÖÁ¬½Ó¾ÍÓбØÒªÁË¡£ Èç¹ûÄúʹÓÃÓû§¼¶ PPP£¬ ¿ÉÒÔʹÓà filter Óï¾ä£¬ ÔÚ /etc/ppp/ppp.conf ÖнøÐбØÒªµÄÉèÖᣠÀýÈ磺

 set filter dial 0 deny udp src eq 123
 # Prevent NTP traffic from initiating dial out
 set filter dial 1 permit 0 0
 set filter alive 0 deny udp src eq 123
 # Prevent incoming NTP traffic from keeping the connection open
 set filter alive 1 deny udp dst eq 123
 # Prevent outgoing NTP traffic from keeping the connection open
 set filter alive 2 permit 0/0 0/0

¡¡¡¡ÒªÁË½â½øÒ»²½µÄÐÅÏ¢£¬ Çë²Î¿¼ ppp(8) µÄ PACKET FILTERING(°ü¹ýÂË) С½Ú£¬ ÒÔ¼° /usr/share/examples/ppp/ ÖеÄÀý×Ó¡£

×¢Òâ: ijЩ Internet ·ÃÎÊÌṩÉÌ»á×èÖ¹µÍ±àºÅµÄ¶Ë¿Ú£¬ Õâ»áµ¼Ö NTP ÎÞ·¨Õý³£¹¤×÷£¬ ÒòΪÏìÓ¦ÎÞ·¨µ½´ïÄúµÄ»úÆ÷¡£

29.10.6 ½øÒ»²½µÄÐÅÏ¢

¡¡¡¡¹ØÓÚ NTP ·þÎñÆ÷µÄÎĵµ£¬ ¿ÉÒÔÔÚ /usr/share/doc/ntp/ ÕÒµ½ HTML ¸ñʽµÄ°æ±¾¡£

±¾ÎĵµºÍÆäËüÎĵµ¿É´ÓÕâÀïÏÂÔØ£ºftp://ftp.FreeBSD.org/pub/FreeBSD/doc/.

Èç¹û¶ÔÓÚFreeBSDÓÐÎÊÌ⣬ÇëÏÈÔĶÁÎĵµ£¬Èç²»Äܽâ¾öÔÙÁªÏµ<questions@FreeBSD.org>.
¹ØÓÚ±¾ÎĵµµÄÎÊÌâÇë·¢ÐÅÁªÏµ <doc@FreeBSD.org>.