chrony与ntpd时间同步

chrony配置参考 >>

本文中ceph1为服务端其他为客户端

Ceph中会自动校验存储节点之间的时间，若不同节点之间时差较大，会有告警，因此
执行如下步骤：

服务端

步骤1 安装NTP服务。

  1. 在所有集群和客户端节点安装NTP。
    yum install ntp ntpdate -y
    apt install ntp ntpdate -y
  2. 在所有集群和客户端节点备份旧配置。
    cd /etc && mv ntp.conf ntp.conf.bak
1
2
3
4
5
6
7
8
9
10
# 以ceph1为NTP服务端节点，在ceph1新建NTP文件。 
vi /etc/ntp.conf 
# 并新增如下内容作为NTP服务端： 
restrict 127.0.0.1 
restrict ::1 
restrict 192.168.3.0 mask 255.255.255.0 
server 127.127.1.0 
fudge 127.127.1.0 stratum 8


说明: 其中，“restrict 192.168.3.0 mask 255.255.255.0”是ceph1的网段与掩码。

服务端完整配置文件【/etc/ntp.conf】：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help

driftfile /var/lib/ntp/ntp.drift

# Leap seconds definition provided by tzdata
leapfile /usr/share/zoneinfo/leap-seconds.list

# Enable this if you want statistics to be logged.
#statsdir /var/log/ntpstats/

statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable

# Specify one or more NTP servers.

# Use servers from the NTP Pool Project. Approved by Ubuntu Technical Board
# on 2011-02-08 (LP: #104525). See http://www.pool.ntp.org/join.html for
# more information.
pool 0.ubuntu.pool.ntp.org iburst
pool 1.ubuntu.pool.ntp.org iburst
pool 2.ubuntu.pool.ntp.org iburst
pool 3.ubuntu.pool.ntp.org iburst

# Use Ubuntu's ntp server as a fallback.
pool ntp.ubuntu.com

# Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html for
# details.  The web page <http://support.ntp.org/bin/view/Support/AccessRestrictions>
# might also be helpful.
#
# Note that "restrict" applies to both servers and clients, so a configuration
# that might be intended to block requests from certain clients could also end
# up blocking replies from your own upstream servers.

# By default, exchange time with everybody, but don't allow configuration.
restrict -4 default kod notrap nomodify nopeer noquery limited
restrict -6 default kod notrap nomodify nopeer noquery limited

# Local users may interrogate the ntp server more closely.
restrict 127.0.0.1 
restrict ::1 
restrict 10.0.0.10 mask 255.255.255.0 
server 127.127.1.0 
fudge 127.127.1.0 stratum 8 

# Needed for adding pool entries
restrict source notrap nomodify noquery

# Clients from this (example!) subnet have unlimited access, but only if
# cryptographically authenticated.
#restrict 192.168.123.0 mask 255.255.255.0 notrust


# If you want to provide time to your local subnet, change the next line.
# (Again, the address is an example only.)
#broadcast 192.168.123.255

# If you want to listen to time broadcasts on your local subnet, de-comment the
# next lines.  Please do this only if you trust everybody on the network!
#disable auth
#broadcastclient

客户端同步服务端时间

方法1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
# 在除ceph1的所有节点强制同步server（ceph1）时间。

ntpdate ceph1

# 在除ceph1的所有节点写入硬件时钟，避免重启后失效。

hwclock -w

# 在除ceph1的所有节点安装并启动crontab工具。

# yum install -y crontabs

chkconfig crond on

systemctl start crond

crontab -e

# 添加以下内容，每隔10分钟自动与ceph1同步时间。

*/10 * * * * /usr/sbin/ntpdate 192.168.3.166

方法2

1
2
3
4
5
6
7
8
9
# 在ceph2、ceph3及所有客户机节点新建NTP文件。
vi /etc/ntp.conf
# 并新增如下内容作为客户端：
server 192.168.3.166
# 保存并退出。
# 步骤2 启动NTP服务。
# 在ceph1节点启动NTP服务，并检查状态。
systemctl start ntpd
systemctl enable ntpd

扩展-chrony/ntpd服务端防火墙设置

chrony

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
服务端
vim /etc/chrony.conf

firewall-cmd –zone=public –add-port=323/udp –permanent
firewall-cmd –zone=public –add-port=123/udp –permanent
systemctl restart firewalld
systemctl restart chronyd
firewall-cmd –list-all

firewall-cmd –zone=public –remove-port=323/udp –permanent
firewall-cmd –zone=public –remove-port=123/udp –permanent
systemctl restart firewalld
systemctl restart chronyd
firewall-cmd –list-all

服务端修改后客户端也需要重启 即两者都需要重启

ntp

1
2
3
ufw allow 123/udp
ufw allow 123/tcp
ufw reload