vi /etc/chrony.conf 同步时间[rootlocalhost ~]# date %Y-%m-%d %H:%M:%S 2026-08-10 09:52:31 [rootlocalhost ~]# [rootlocalhost ~]# vi /etc/chrony.conf # Use public servers from the pool.ntp.org project. # Please consider joining the pool (http://www.pool.ntp.org/join.html). #pool pool.ntp.org iburst server ntp.ntsc.ac.cn iburst server ntp1.aliyun.com iburst #server cn.pool.ntp.org iburst # Record the rate at which the system clock gains/losses time. driftfile /var/lib/chrony/drift # Allow the system clock to be stepped in the first three updates # if its offset is larger than 1 second. makestep 1.0 3 # Enable kernel synchronization of the real-time clock (RTC). rtcsync # Enable hardware timestamping on all interfaces that support it. #hwtimestamp * # Increase the minimum number of selectable sources required to adjust # the system clock. #minsources 2 # Allow NTP client access from local network. #allow 192.168.0.0/16 # Serve time even if not synchronized to a time source. #local stratum 10 # Specify file containing keys for NTP authentication. #keyfile /etc/chrony.keys # Get TAI-UTC offset and leap seconds from the system tz database. #leapsectz right/UTC # Specify directory for log files. logdir /var/log/chrony # Select which information is logged. #log measurements statistics tracking ~ ~ ~ ~ /etc/chrony.conf 41L, 1169B1[rootlocalhost ~]# cp /etc/chrony.conf /etc/chrony.conf.bak.$(date %Y%m%d) [rootlocalhost ~]# [rootlocalhost ~]# ls /etc adjtime dconf gss locales.conf nsswitch.conf rc.local sysctl.d aliases default gssproxy localtime nsswitch.conf.bak request-key.conf systemd alternatives depmod.d gtk-2.0 localtime_tmp ntp request-key.d system-release anaconda dhcp gtk-3.0 login.defs ntp.conf resolv.conf system-release-cpe anacrontab DIR_COLORS ha.d logrotate.conf odbc.ini resolv.conf.save systemtap asound.conf DIR_COLORS.256color host.conf logrotate.d odbcinst.ini rhashrc target at.allow DIR_COLORS.lightbgcolor hostname lsb-release OpenCL rmt tcsd.conf audit dnf hosts lsm openldap rpc terminfo authselect dnsmasq.conf idmapd.conf lvm opt rpm texlive bash_completion.d dnsmasq.d init lynx.cfg os-release rsyncd.conf titanagent bashrc dracut.conf init.d lynx.lss ostree rsyslog.conf tmpfiles.d bindresvport.blacklist dracut.conf.d initial-setup lynx-site.cfg PackageKit rsyslog.d tomcat binfmt.d dumpdates inittab machine-id pam.d rwtab.d tpm2-tss bluetooth e2scrub.conf inputrc magic papersize samba Trolltech.conf cgconfig.conf egl ipmi mailcap passwd sangfor trusted-key.key cgrules.conf environment iproute2 makedumpfile.conf.sample passwd- sanlock tuned cgsnapshot_blacklist.conf ethertypes ipset man_db.conf pinforc sasl2 udev chkconfig.d exports issue mate pipewire security udisks2 chkuid_state exports.d issue.d mate-settings-daemon pkcs11 selinux uid_list chrony.conf fcoe issue.net mcelog pki sensors3.conf unbound chrony.conf.bak.20260810 filesystems java mime.types plymouth sensors.d updatedb.conf chrony.keys firebird jvm mke2fs.conf pm services UPower cifs-utils firefox jvm-commmon modprobe.d polkit-1 sestatus.conf uptimed.conf cni firewalld kdump.conf modules-load.d pool.conf setroubleshoot vconsole.conf cockpit fonts kernel motd popt.d sgml vimrc comsuit freetds.conf keyutils motd.d ppp shadow virc containers fstab krb5.conf mtab prelink.conf.d shadow- vulkan cron.allow fuse.conf krb5.conf.d multipath printcap shells warnquota.conf cron.d gamin kylin-release my.cnf profile skel watchdog.conf cron.daily gconf kylin_security my.cnf.d profile.d slsh.rc watchdog.d cron.hourly gcrypt ld.so.cache named protocols smartmontools wdmd.d cron.monthly gdbinit ld.so.conf named.conf pulse sos.conf wgetrc crontab gdbinit.d ld.so.conf.d named.rfc1912.zones quotagrpadmins ssh wpa_supplicant cron.weekly genwqe_vpd.csv libaudit.conf named.root.key quotatab ssl X11 crypto-policies geoclue libblockdev nanorc ras sssd xattr.conf crypttab glvnd libnl ndctl rc0.d statetab.d xdg csh.cshrc gnupg libpaper.d netconfig rc1.d subgid xml csh.login group libreport NetworkManager rc2.d subuid xrdb csh.precmd group- libuser.conf networks rc3.d sudo.conf yum csmicro grub2.cfg libvirt nfs.conf rc4.d sudoers yum.conf cups grub.d LICENSE nfsmount.conf rc5.d sudoers.d yum.repos.d cupshelpers gshadow lightdm nftables rc6.d sysconfig zabbix dbus-1 gshadow- locale.conf nginx rc.d sysctl.conf [rootlocalhost ~]#vi /etc/chrony.conf # 注释所有公网NTP服务器内网无法访问外网 #pool pool.ntp.org iburst #server ntp.ntsc.ac.cn iburst #server ntp1.aliyun.com iburst #server cn.pool.ntp.org iburst driftfile /var/lib/chrony/drift makestep 1.0 3 rtcsync # 允许所有10.x.x.x网段机器来同步时间覆盖10.3.1、10.3.2、10.3.4 allow 10.0.0.0/8 # 断网环境使用本机硬件时钟对外提供时间源 local stratum 10 #hwtimestamp * #minsources 2 #keyfile /etc/chrony.keys #leapsectz right/UTC logdir /var/log/chrony #log measurements statistics trackingdate %Y-%m-%d %H:%M:%S #时间不对再执行date -s 正确时间 hwclock -w [rootlocalhost ~]# [rootlocalhost ~]# [rootlocalhost ~]# date %Y-%m-%d %H:%M:%S 2026-08-10 10:17:57 [rootlocalhost ~]# #时间不对再执行date -s 正确时间 [rootlocalhost ~]# hwclock -w [rootlocalhost ~]# [rootlocalhost ~]# [rootlocalhost ~]# [rootlocalhost ~]#systemctl restart chronyd systemctl enable chronyd [rootlocalhost ~]# [rootlocalhost ~]# [rootlocalhost ~]# [rootlocalhost ~]# systemctl restart chronyd [rootlocalhost ~]# systemctl enable chronyd [rootlocalhost ~]# [rootlocalhost ~]# [rootlocalhost ~]# [rootlocalhost ~]# [rootlocalhost ~]#firewall-cmd --add-servicentp --permanent firewall-cmd --reload firewall-cmd --list-services [rootlocalhost ~]# [rootlocalhost ~]# firewall-cmd --add-servicentp --permanent FirewallD is not running [rootlocalhost ~]# firewall-cmd --reload FirewallD is not running [rootlocalhost ~]# firewall-cmd --list-services FirewallD is not running [rootlocalhost ~]# [rootlocalhost ~]# [rootlocalhost ~]##启动firewalld systemctl start firewalld #设置开机自启 systemctl enable firewalld #放行ntp服务 firewall-cmd --add-servicentp --permanent firewall-cmd --reload #验证放行 firewall-cmd --list-services [rootlocalhost ~]# [rootlocalhost ~]# #启动firewalld [rootlocalhost ~]# systemctl start firewalld [rootlocalhost ~]# #设置开机自启 [rootlocalhost ~]# systemctl enable firewalld Created symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service → /usr/lib/systemd/system/firewalld.service. Created symlink /etc/systemd/system/multi-user.target.wants/firewalld.service → /usr/lib/systemd/system/firewalld.service. [rootlocalhost ~]# [rootlocalhost ~]# #放行ntp服务 [rootlocalhost ~]# firewall-cmd --add-servicentp --permanent success [rootlocalhost ~]# firewall-cmd --reload success [rootlocalhost ~]# [rootlocalhost ~]# #验证放行 [rootlocalhost ~]# firewall-cmd --list-services cockpit dhcpv6-client mdns ntp ssh [rootlocalhost ~]# [rootlocalhost ~]# [rootlocalhost ~]# [rootlocalhost ~]#chronyc sources chronyc tracking [rootlocalhost ~]# [rootlocalhost ~]# chronyc sources 210 Number of sources 0 MS Name/IP address Stratum Poll Reach LastRx Last sample [rootlocalhost ~]# chronyc tracking Reference ID : 7F7F0101 () Stratum : 10 Ref time (UTC) : Mon Aug 10 02:21:09 2026 System time : 0.000000000 seconds fast of NTP time Last offset : 0.000000000 seconds RMS offset : 0.000000000 seconds Frequency : 0.000 ppm slow Residual freq : 0.000 ppm Skew : 0.000 ppm Root delay : 0.000000000 seconds Root dispersion : 0.000000000 seconds Update interval : 0.0 seconds Leap status : Normal [rootlocalhost ~]# [rootlocalhost ~]# [rootlocalhost ~]# [rootlocalhost ~]# [rootlocalhost ~]#2cp /etc/chrony.conf /etc/chrony.conf.bak.$(date %Y%m%d) [rootlocalhost ~]# cp /etc/chrony.conf /etc/chrony.conf.bak.$(date %Y%m%d) cp: overwrite /etc/chrony.conf.bak.20260810? yes [rootlocalhost ~]# [rootlocalhost ~]# ls /etc adjtime crontab firewalld ipmi logrotate.d nfs.conf protocols services tmpfiles.d aliases cron.weekly fonts iproute2 lsb-release nfsmount.conf pulse sestatus.conf tomcat alternatives crypto-policies freetds.conf ipset lsm nftables quotagrpadmins setroubleshoot tpm2-tss anaconda crypttab fstab issue lvm nginx quotatab sgml Trolltech.conf anacrontab csh.cshrc fuse.conf issue.d lynx.cfg nsswitch.conf ras shadow trusted-key.key asar csh.login gamin issue.net lynx.lss nsswitch.conf.bak rc0.d shadow- tuned asound.conf csh.precmd gconf java lynx-site.cfg ntp rc1.d shells udev at.allow csmicro gcrypt jvm machine-id ntp.conf rc2.d skel udisks2 audit cups gdbinit jvm-commmon magic odbc.ini rc3.d slsh.rc uid_list authselect cupshelpers gdbinit.d kdump.conf mailcap odbcinst.ini rc4.d smartmontools unbound bash_completion.d dbus-1 genwqe_vpd.csv kernel makedumpfile.conf.sample OpenCL rc5.d sos.conf updatedb.conf bashrc dconf geoclue keyutils man_db.conf openldap rc6.d ssh UPower bindresvport.blacklist default glvnd krb5.conf mate opt rc.d ssl uptimed.conf binfmt.d depmod.d gnupg krb5.conf.d mate-settings-daemon os-release rc.local sssd vconsole.conf bluetooth dhcp group kylin-release mcelog ostree request-key.conf statetab.d vimrc cgconfig.conf DIR_COLORS group- kylin_security mime.types PackageKit request-key.d subgid virc cgrules.conf DIR_COLORS.256color grub2.cfg ld.so.cache mke2fs.conf pam.d resolv.conf subgid- vulkan cgsnapshot_blacklist.conf DIR_COLORS.lightbgcolor grub.d ld.so.conf modprobe.d papersize resolv.conf.save subuid warnquota.conf chkconfig.d dnf gshadow ld.so.conf.d modules-load.d passwd rhashrc subuid- watchdog.conf chkuid_state dnsmasq.conf gshadow- libaudit.conf motd passwd- rmt sudo.conf watchdog.d chrony.conf dnsmasq.d gss libblockdev motd.d pinforc rpc sudoers wdmd.d chrony.conf.bak.20260810 dracut.conf gssproxy libnl mtab pipewire rpm sudoers.d wgetrc chrony.conf.old dracut.conf.d gtk-2.0 libpaper.d multipath pkcs11 rsyncd.conf sysconfig wpa_supplicant chrony.keys dumpdates gtk-3.0 libreport my.cnf pki rsyslog.conf sysctl.conf X11 cifs-utils e2scrub.conf ha.d libuser.conf my.cnf.d plymouth rsyslog.d sysctl.d xattr.conf cni egl host.conf libvirt named pm rwtab.d systemd xdg cockpit environment hostname LICENSE named.conf polkit-1 samba system-release xml comsuit ethertypes hosts lightdm named.rfc1912.zones pool.conf sangfor system-release-cpe xrdb containers exports idmapd.conf locale.conf named.root.key popt.d sanlock systemtap yum cron.allow exports.d init locales.conf nanorc ppp sasl2 target yum.conf cron.d fcoe init.d localtime ndctl prelink.conf.d security tcsd.conf yum.repos.d cron.daily filesystems initial-setup localtime_tmp netconfig printcap selinux terminfo cron.hourly firebird inittab login.defs NetworkManager profile sensors3.conf texlive cron.monthly firefox inputrc logrotate.conf networks profile.d sensors.d titanagent [rootlocalhost ~]#vi /etc/chrony.conf #pool pool.ntp.org iburst #server ntp.ntsc.ac.cn iburst #server ntp1.aliyun.com iburst #指向内网时间母机 server 10.3.1.17 iburst driftfile /var/lib/chrony/drift makestep 1.0 3 rtcsync #客户端不要写allow、不要写local stratum 10 logdir /var/log/chronysystemctl restart chronyd systemctl enable chronydchronyc sourceshwclock -wchronyc -h 10.3.1.17 tracking3上面没有成功同步主机检查主机 [rootlocalhost ~]# systemctl status chronyd ● chronyd.service - NTP client/server Loaded: loaded (/usr/lib/systemd/system/chronyd.service; enabled; vendor preset: enabled) Active: active (running) since Mon 2026-08-10 10:18:37 CST; 8min ago Docs: man:chronyd(8) man:chrony.conf(5) Main PID: 170514 (chronyd) Tasks: 1 Memory: 184.0K CGroup: /system.slice/chronyd.service └─170514 /usr/sbin/chronyd 8月 10 10:18:37 localhost.localdomain systemd[1]: Starting NTP client/server... 8月 10 10:18:37 localhost.localdomain chronyd[170514]: chronyd version 3.5 starting (CMDMON NTP REFCLOCK RTC PRIVDROP SCFILTER SIGND ASYNCDNS SECHASH IPV6 DEBUG) 8月 10 10:18:37 localhost.localdomain chronyd[170514]: Frequency 0.000 /- 1000000.000 ppm read from /var/lib/chrony/drift 8月 10 10:18:37 localhost.localdomain systemd[1]: Started NTP client/server. [rootlocalhost ~]# [rootlocalhost ~]# [rootlocalhost ~]# systemctl restart chronyd [rootlocalhost ~]# systemctl enable chronyd [rootlocalhost ~]# [rootlocalhost ~]# ss -ulnp | grep chronyd UNCONN 0 0 0.0.0.0:123 0.0.0.0:* users:((chronyd,pid184705,fd8)) UNCONN 0 0 127.0.0.1:323 0.0.0.0:* users:((chronyd,pid184705,fd6)) UNCONN 0 0 [::1]:323 [::]:* users:((chronyd,pid184705,fd7)) [rootlocalhost ~]# [rootlocalhost ~]# [rootlocalhost ~]# cat /etc/chrony.conf | grep -E ^allow|^local stratum allow 10.0.0.0/8 local stratum 10 [rootlocalhost ~]# [rootlocalhost ~]# [rootlocalhost ~]# chronyc -h 127.0.0.1 tracking Reference ID : 7F7F0101 () Stratum : 10 Ref time (UTC) : Mon Aug 10 02:29:03 2026 System time : 0.000000000 seconds fast of NTP time Last offset : 0.000000000 seconds RMS offset : 0.000000000 seconds Frequency : 0.000 ppm slow Residual freq : 0.000 ppm Skew : 0.000 ppm Root delay : 0.000000000 seconds Root dispersion : 0.000000000 seconds Update interval : 0.0 seconds Leap status : Normal [rootlocalhost ~]# [rootlocalhost ~]# [rootlocalhost ~]# [rootlocalhost ~]#打开监听报文 tcpdump -nn udp port 1234打开监听报文客户机打开 tcpdump -nn udp port 123