NTP局域网时间同步实操验证

文档信息

• 系统版本：CentOS 7.x
• 测试组件：ntpd、ntpdate
• 测试节点：3 台物理机
• 测试环境：不能访问公网，集群内实现多台服务器时间同步
• 测试目标：验证主节点时间变更后从节点同步行为；验证从节点手动改时后自动校正逻辑

分布式集群中时间一致性至关重要。若各节点时间不同步，会引发日志时序错乱、分布式任务计算异常、分布式锁 / 事务失效等问题，K8s、Hadoop、数据库集群等业务环境均对节点时间偏差高度敏感。因此服务器完成网络初始化后，应第一时间部署统一时间同步服务。

一、测试环境说明

1. 节点规划

核心三步骤：安装—修改配置文件—查看状态

2.环境前置配置

• 1 在线安装包

yum -y install ntpdate

• 2 离线安装包

rpm -ivh autogen-libopts-5.18-5.el7.x86_64.rpm rpm -ivh ntpdate-4.2.6p5-29.el7.centos.2.x86_64.rpm rpm -ivh ntp-4.2.6p5-29.el7.centos.2.x86_64.rpm

以上服务端和客户端都需要进行安装，通过配置文件区分服务端还是客户端

本案例是使用离线的方式进行安装的

二、配置文件修改

2.1 服务端master-01配置

配置文件位置-/etc/ntp.conf

加入内容

vi /etc/ntp.conf

# 【改】填写本机NTP服务端真实IP restrict 192.168.3.101 nomodify notrap nopeer noquery # 【改】填写内网网段+子网掩码，允许该网段所有客户端同步 restrict 192.168.3.1 mask 255.255.255.0 nomodify notrap #注释掉server 0 ~ n # 固定无需修改 server 127.127.1.0 fudge 127.127.1.0 stratum 10

完整的服务端配置文件为：

# For more information about this file, see the man pages # ntp.conf(5), ntp_acc(5), ntp_auth(5), ntp_clock(5), ntp_misc(5), ntp_mon(5). driftfile /var/lib/ntp/drift # Permit time synchronization with our time source, but do not # permit the source to query or modify the service on this system. restrict default nomodify notrap nopeer noquery # Permit all access over the loopback interface. This could # be tightened as well, but to do so would effect some of # the administrative functions. restrict 127.0.0.1 restrict ::1 # Hosts on local network are less restricted. #restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap # 【改】填写本机NTP服务端真实IP restrict 192.168.3.101 nomodify notrap nopeer noquery # 【改】填写内网网段+子网掩码，允许该网段所有客户端同步 restrict 192.168.3.1 mask 255.255.255.0 nomodify notrap # 注释公网NTP # Use public servers from the pool.ntp.org project. # Please consider joining the pool (http://www.pool.ntp.org/join.html). #server 0.centos.pool.ntp.org iburst #server 1.centos.pool.ntp.org iburst #server 2.centos.pool.ntp.org iburst #server 3.centos.pool.ntp.org iburst # 固定无需修改 server 127.127.1.0 fudge 127.127.1.0 stratum 10 #broadcast 192.168.1.255 autokey # broadcast server #broadcastclient # broadcast client #broadcast 224.0.1.1 autokey # multicast server #multicastclient 224.0.1.1 # multicast client #manycastserver 239.255.254.254 # manycast server #manycastclient 239.255.254.254 autokey # manycast client # Enable public key cryptography. #crypto includefile /etc/ntp/crypto/pw # Key file containing the keys and key identifiers used when operating # with symmetric key cryptography. keys /etc/ntp/keys # Specify the key identifiers which are trusted. #trustedkey 4 8 42 # Specify the key identifier to use with the ntpdc utility. #requestkey 8 # Specify the key identifier to use with the ntpq utility. #controlkey 8 # Enable writing of statistics records. #statistics clockstats cryptostats loopstats peerstats # Disable the monitoring facility to prevent amplification attacks using ntpdc # monlist command when default restrict does not include the noquery flag. See # CVE-2013-5211 for more details. # Note: Monitoring will not be disabled with the limited restriction flag. disable monitor

服务端端口123加入防火墙【若有】

firewall-cmd--permanent--add-port=123/udp

设置成开机启动

[root@master-01 software]# chkconfig ntpd on注意：正在将请求转发到“systemctlenablentpd.service”。 Created symlink from /etc/systemd/system/multi-user.target.wants/ntpd.service to /usr/lib/systemd/system/ntpd.service.[root@master-01 software]# systemctl start ntpd.service[root@master-01 software]# systemctl status ntpd.service● ntpd.service - Network Time Service Loaded: loaded(/usr/lib/systemd/system/ntpd.service;enabled;vendor preset: disabled)Active: active(running)since 日2012-01-01 03:13:38 CST;5s ago Process:26562ExecStart=/usr/sbin/ntpd-untp:ntp$OPTIONS(code=exited,status=0/SUCCESS)Main PID:26563(ntpd)

可以看到由于系统是新装的，所以需要修改系统时间

[root@master-01 software]# timedatectl set-time "2026-07-05 23:26:00"Failed tosettime: Automatictimesynchronization is enabled[root@master-01 software]# date -s "2026-07-05 23:26:00"2026年 07月 05日 星期日23:26:00 CST[root@master-01 software]# hwclock -w

2.2 客户端node-01、node-02配置文件修改

以node-01为例子，node-02自行修改

配置文件位置-/etc/ntp.conf

加入内容

# 【改】内网网段+掩码，放开内网访问权限 restrict 192.168.3.0 mask 255.255.255.0 nomodify notrap #注释掉server 0 ~ n # 【改】填写NTP服务端IP，增加iburst加速初次同步 server 192.168.3.101 iburst prefer # 离线备用本地时钟（master不可达时兜底） server 127.127.1.0 fudge 127.127.1.0 stratum 10 # 关键测试参数：关闭panic阈值，手动改时超大偏差也能自动校正 tinker panic 0

完整的客户端配置文件为：

# For more information about this file, see the man pages # ntp.conf(5), ntp_acc(5), ntp_auth(5), ntp_clock(5), ntp_misc(5), ntp_mon(5). driftfile /var/lib/ntp/drift # Permit time synchronization with our time source, but do not # permit the source to query or modify the service on this system. restrict default nomodify notrap nopeer noquery # Permit all access over the loopback interface. This could # be tightened as well, but to do so would effect some of # the administrative functions. restrict 127.0.0.1 restrict ::1 # Hosts on local network are less restricted. #restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap # 【改】内网网段+掩码，放开内网访问权限 restrict 192.168.3.0 mask 255.255.255.0 nomodify notrap # 【改】填写NTP服务端IP，增加iburst加速初次同步 server 192.168.3.101 iburst prefer # 离线备用本地时钟（master不可达时兜底） server 127.127.1.0 fudge 127.127.1.0 stratum 10 # 关键测试参数：关闭panic阈值，手动改时超大偏差也能自动校正 tinker panic 0 # 注释公网NTP # Use public servers from the pool.ntp.org project. # Please consider joining the pool (http://www.pool.ntp.org/join.html). #server 0.centos.pool.ntp.org iburst #server 1.centos.pool.ntp.org iburst #server 2.centos.pool.ntp.org iburst #server 3.centos.pool.ntp.org iburst #broadcast 192.168.1.255 autokey # broadcast server #broadcastclient # broadcast client #broadcast 224.0.1.1 autokey # multicast server #multicastclient 224.0.1.1 # multicast client #manycastserver 239.255.254.254 # manycast server #manycastclient 239.255.254.254 autokey # manycast client # Enable public key cryptography. #crypto includefile /etc/ntp/crypto/pw # Key file containing the keys and key identifiers used when operating # with symmetric key cryptography. keys /etc/ntp/keys # Specify the key identifiers which are trusted. #trustedkey 4 8 42 # Specify the key identifier to use with the ntpdc utility. #requestkey 8 # Specify the key identifier to use with the ntpq utility. #controlkey 8 # Enable writing of statistics records. #statistics clockstats cryptostats loopstats peerstats # Disable the monitoring facility to prevent amplification attacks using ntpdc # monlist command when default restrict does not include the noquery flag. See # CVE-2013-5211 for more details. # Note: Monitoring will not be disabled with the limited restriction flag. disable monitor

设置成开机启动

[root@node-01 software]# chkconfig ntpd on注意：正在将请求转发到“systemctlenablentpd.service”。 Created symlink from /etc/systemd/system/multi-user.target.wants/ntpd.service to /usr/lib/systemd/system/ntpd.service.[root@node-01 software]# systemctl start ntpd.service[root@node-01 software]# systemctl status ntpd.service● ntpd.service - Network Time Service Loaded: loaded(/usr/lib/systemd/system/ntpd.service;enabled;vendor preset: disabled)Active: active(running)since 日2026-07-0523:34:20 CST;8s ago Process:20190ExecStart=/usr/sbin/ntpd-untp:ntp$OPTIONS(code=exited,status=0/SUCCESS)Main PID:20194(ntpd)CGroup: /system.slice/ntpd.service └─20194 /usr/sbin/ntpd-untp:ntp-g

三、运行效果验证

3.1 检查是否连接成功

#实时同步时间，一般使用此命令在同步前先实时同步一次ntpdate-u服务端IP

如果master-01打开了防火墙，但是没有开放123端口，查询就会返回以下信息

[root@node-01 software]# ntpdate -u 192.168.3.101 5 Jul 23:44:53 ntpdate[29576]: no server suitable for synchronization found

如果关闭防火墙或者开放了123端口，则

[root@node-01 software]# ntpdate -u 192.168.3.1015Jul23:57:33 ntpdate[9310]: steptimeserver192.168.3.101 offset-44.352542sec

3.2 查看同步状态

• 服务端同步状态

[root@master-01 ~]# ntpq -pnremote refid st t when poll reach delay offset jitter==============================================================================*127.127.1.0 .LOCL.10l226410.0000.0000.000

• 客户端同步状态

#非正常状态[root@node-01 software]# ntpq -pnremote refid st t when poll reach delay offset jitter==============================================================================192.168.3.101 .INIT.16u -102400.0000.0000.000[root@node-01 software]# ntpstatunsynchronisedtimeserver re-starting polling server every8s

以上关键信息为 refid 为 INIT，则表示同步正在初始化，遇到这个情况，需要停止nptd，重新启动，如下所示

[root@node-01 software]# ntpdate -u 192.168.3.101 6 Jul 00:05:00 ntpdate[16106]: adjust time server 192.168.3.101 offset -0.005249 sec [root@node-01 software]# systemctl start ntpd

然后重新查询状态

#正常状态 [root@node-01 ~]# ntpq -pn remote refid st t when poll reach delay offset jitter ============================================================================== *192.168.3.101 LOCAL(0) 11 u 19 64 17 0.324 0.233 0.922 127.127.1.0 .LOCL. 10 l 156 64 14 0.000 0.000 0.000

跑到 master 那一行，代表当前同步源是内网 master；

执行 ntpstat 会输出 synchronised to NTP server (192.168.3.101)

四、测试场景

4.1 主节点掉线之后再重启，从节点什么时候继续同步

• 步骤1，关机master-01
• 步骤2，查询node-01节点，发现目前是跟本地同步

[root@node-01 ~]# ntpq -pn remote refid st t when poll reach delay offset jitter ============================================================================== 192.168.3.101 LOCAL(0) 11 u 13 64 77 0.462 -457992 1731047 *127.127.1.0 .LOCL. 10 l 32 64 77 0.000 0.000 0.000

• 步骤3：启动master-01
• 步骤4：查看node-01什么时候继续跟master-01同步

###大概需要半个小时左右#### [root@node-01 ~]# ntpq -pn remote refid st t when poll reach delay offset jitter ============================================================================== *192.168.3.101 LOCAL(0) 11 u 205 256 377 0.467 0.288 0.082 127.127.1.0 .LOCL. 10 l 139m 64 0 0.000 0.000 0.000

4.2 验证主节点时间变更后从节点同步行为

查看当前时间

[root@master-01 ~]# date2026年 07月 06日 星期一23:07:17 CST

master-01时间减少8个小时，既把23点修改为20点

[root@master-01 ~]# date -s "2026-07-06 20:00:00" 2026年 07月 06日 星期一 20:00:00 CST [root@master-01 ~]# date 2026年 07月 06日 星期一 20:00:01 CST

观察node-01 和 node-02 的同步状态

# 不跟master进行同步，因为8个小时被判定为异常状态 [root@node-01 ~]# ntpq -pn remote refid st t when poll reach delay offset jitter ============================================================================== 192.168.3.101 LOCAL(0) 11 u 10 64 377 0.445 -112810 0.058 *127.127.1.0 .LOCL. 10 l 6 64 377 0.000 0.000 0.000

因为一次调整8小时，导致ntpd自动切换到本地的同步，不跟master-01进行同步。

我们重新进行测试：

node-01、node-02手动同步服务器时间

[root@node-01 ~]# ntpdate -u 192.168.3.1016Jul20:12:11 ntpdate[18302]: steptimeserver192.168.3.101 offset-11281.067120sec

master-01时间减少1分钟

[root@master-01 ~]# date 2026年 07月 06日 星期一 20:23:38 CST [root@master-01 ~]# date -s "2026-07-06 20:23:00" 2026年 07月 06日 星期一 20:23:00 CST

观察node-01、node-02一段时间(大概5~10分钟)：

[root@node-01 ~]# ntpq -pn remote refid st t when poll reach delay offset jitter ============================================================================== *192.168.3.101 LOCAL(0) 11 u 26 64 377 0.473 -54907. 0.018 127.127.1.0 .LOCL. 10 l 75 64 36 0.000 0.000 0.000

发现node-01同步成功

4.3 验证从节点手动改时后自动校正逻辑

node-02查看当前时间，并修改少一分钟

[root@node-02 ~]# date 2026年 07月 06日 星期一 20:48:59 CST [root@node-02 ~]# date -s "2026-07-06 20:48:00" 2026年 07月 06日 星期一 20:48:00 CST

观察node-02时间的变化，稍等一会则同步成功

[root@node-02 ~]# ntpq -pn remote refid st t when poll reach delay offset jitter ============================================================================== 192.168.3.101 LOCAL(0) 11 u 50 64 7 0.472 90501.6 90501.6 *127.127.1.0 .LOCL. 10 l 19 64 21 0.000 0.000 0.000

五、问题

设置了ntpd开机自启动，重启服务器ntpd没有自启动

1.需要禁掉chronyd.service：

systemctl disable chronyd.service

2.手动启动ntpd：

systemctl start ntpd

3.再次设置开机自启动：

systemctl enable ntpd