CentOS NTP server installation and configuration

Introduction to NTP:
NTP (Network Time Protocol) is a protocol used to synchronize computer time. It can synchronize a computer to its server or clock source, and it can provide high-precision time correction. This example explains how to configure the NTP server and NTP client on CentOS6.3, so that the time of multiple clients can be consistent with the time of the specified NTP server. So as to ensure the time synchronization of multiple servers.

Server environment
Operating system: CentOS 6.5 x86_x64
Server ip: 192.168.17.253

One, install NTP server

yum install ntp

Two, configure NTP
NTP configuration file path: /etc/ntp.conf

# For more information about this file, see the man pages
# ntp.conf(5),ntp_acc(5),ntp_auth(5),ntp_clock(5),ntp_misc(5),ntp_mon(5).
 
driftfile /var/lib/ntp/drift
 
# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
restrict default kod nomodify notrap nopeer noquery
restrict -6default kod nomodify notrap nopeer noquery
restrict 210.72.145.44
 
# Permit all access over the loopback interface.  This could
# be tightened as well, but to do so would effect some of
# the administrative functions.//Limit which hosts can synchronize time from this NTP server
restrict 127.0.0.1 
restrict -6::1
 
# Hosts on local network are less restricted.
# restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap
 
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool(http://www.pool.ntp.org/join.html).//The address of the remote time server (the following NTP server address is recommended)
server 210.72.145.44 perfer   #China National Time Service Center
server ntp.sjtu.edu.cn        #NTP server of Shanghai Jiaotong University
server 202.112.10.36             # 1.cn.pool.ntp.org
server 59.124.196.83             # 0.asia.pool.ntp.org
 
# broadcast 192.168.1.255 autokey	# broadcast server
# broadcastclient			# broadcast client
# broadcast 224.0.1.1 autokey		# multicast server
# multicastclient 224.0.1.1		# multicast client
# manycastserver 239.255.254.254		# manycast server
# manycastclient 239.255.254.254 autokey # manycast client
 
# Enable public key cryptography.
# crypto
 
includefile /etc/ntp/crypto/pw
 
# Key file containing the keys and key identifiers used when operating
# with symmetric key cryptography. 
keys /etc/ntp/keys
 
# Specify the key identifiers which are trusted.
# trustedkey 4842
 
# Specify the key identifier to use with the ntpdc utility.
# requestkey 8
 
# Specify the key identifier to use with the ntpq utility.
# controlkey 8
 
# Enable writing of statistics records.
# statistics clockstats cryptostats loopstats peerstats

Three, firewall
The NTP service uses the UPD protocol by default and uses port 123. If you enable the firewall, you need to configure the firewall.

vim /etc/sysconfig/iptables

Open the firewall configuration file. Add the following configuration items:

# open port for NTP server
- A  INPUT -m state --state NEW -m udp -p udp --dport 123-j ACCEPT

Restart the firewall server:

service iptables restart

Four, test configuration
After the NTP service is started, it takes about 3 to 5 minutes to synchronize time. I waited about 10 minutes when I configured it. We can check the synchronization by command ntpstat.

Note: The NTP client can synchronize the time only after the NTP server is successfully synchronized. If you need to synchronize the time from the specified time server immediately, you can use the "ntpdate" command. When using the "ntpdate" command, you need to close the ntp service first:

 service ntpd stop

Then execute "ntpdate NTPSERVERIP" to complete the time synchronization immediately.
Five, related commands
ntpdate //Manually update the NTP server time
ntpq -p //Query the NTP server in the network, and display the relationship between the client and each server
watch ntpq -p //Monitor ntpq -p command

Relevant literature
NTP official website: http://ntp.org
Bird brother NTP configuration: http://vbird.dic.ksu.edu.tw/linux_server/0440ntp_2.php

[ box style=”warning”]

Thanks to adamfei for reminding that port 123 is vulnerable to file upload attacks. Hope everyone pays attention!

[ /box]