# For more information about this file, see the man pages # ntp.conf(5), ntp_acc(5), ntp_auth(5), ntp_clock(5), ntp_misc(5), ntp_mon(5). driftfile /var/lib/ntp/drift #默认即可。driftfile用来指定记录本机与上层NTP server之间的频率误差。单位是百万分之一秒。
# Permit time synchronization with our time source, but do not # permit the source to query or modify the service on this system. restrict default nomodify notrap nopeer noquery #restrict用来管理权限控制。 #格式为 restrict [单个ip|网络|default] parameter #parameter: # ignore:拒绝所有的ntp连接 # nomodify:客户端不能使用ntpc和ntpq这两个程序来更改服务器的时间参数,但客户端可以通过此主机来进行网络校时。 # noquery:客户端不能使用ntpc和ntpq等命令来查询时间服务器,等于不提供网络校时服务。 # notrap:不提供trap这个网络时间登陆的功能 # notrust:拒绝没有认证的客户端 # 示例:restrict 156.0.26.7 nomodify 9
# Permit all access over the loopback interface. This could # be tightened as well, but to do so would effect some of # the administrative functions. restrict 127.0.0.1#以下两条默认,放行本机来源 restrict ::1 # Hosts on local network are less restricted. restrict 10.0.0.0 mask 255.0.0.0 nomodify notrap restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap
# Use public servers from the pool.ntp.org project. # Please consider joining the pool (http://www.pool.ntp.org/join.html). #server 0.centos.pool.ntp.org iburst #以下四条为默认,注释掉即可 #server 1.centos.pool.ntp.org iburst #server 2.centos.pool.ntp.org iburst #server 3.centos.pool.ntp.org iburst #server:用来设置上层NTP服务器,说白了就是client向谁请求NTP时间同步。 #特别注意,在内网环境中由于无法连接到内网,所以没有办法向例如国家授时服务中心210.72.145.44同步时间 #只能将内网中的某台主机设置为server,用以向其他内网服务器提供NTP服务。
server 127.127.1.0 prefer #以本机时间作为时间服务。内网中这个配置一定要加上,否则会导致NTP服务不可用 #prefer代表这台主机优先级最高。 #broadcast 192.168.1.255 autokey # broadcast server #broadcastclient # broadcast client #broadcast 224.0.1.1 autokey # multicast server #multicastclient 224.0.1.1 # multicast client #manycastserver 239.255.254.254 # manycast server #manycastclient 239.255.254.254 autokey # manycast client
# Enable public key cryptography. #crypto
includefile /etc/ntp/crypto/pw
# Key file containing the keys and key identifiers used when operating # with symmetric key cryptography. keys /etc/ntp/keys ##除了restrict来限制客户端连接外,还可以通过秘钥方式来给客户端认证。 # Specify the key identifiers which are trusted. #trustedkey 4 8 42
#Specify the key identifier to use with the ntpdc utility. #requestkey 8
# Specify the key identifier to use with the ntpq utility. #controlkey 8 # Enable writing of statistics records. #statistics clockstats cryptostats loopstats peerstats
# Disable the monitoring facility to prevent amplification attacks using ntpdc # monlist command when default restrict does not include the noquery flag. See # CVE-2013-5211 for more details. # Note: Monitoring will not be disabled with the limited restriction flag. disable monitor