Linux时间同步服务chronyd实战和NFS 服务
·
1. 时间服务同步（NTP）
chronyd，这个服务在现有的 Linux 中是已经自带安装好的。由于时间服务都是主从模式，因此我们需要克隆两台服务器来进行演示。
1.1 准备工作
我们克隆一台叫 2303-server，另一台叫 2303-client。并设置它们的主机名和 IP 地址。
[root@localhost ~]# hostnamectl set-hostname 2303-server
[root@localhost ~]# hostnamectl hostname
2303-server
#重新连接shell就可以看见设置的hostname，并设置IP地址
[root@2303-server ~]# nmcli connection modify ens160 ipv4.method manual ipv4.addresses 192.168.183.142/24 ipv4.gateway 192.168.183.2 ipv4.dns 223.5.5.5 connection.autoconnect yes
[root@2303-server ~]# nmcli connection up ens160
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)
#同理2303-client主机的配置过程
[root@localhost ~]# hostnamectl set-hostname 2303-client
[root@localhost ~]# hostnamectl hostname
2303-client
# 设置IP地址
[root@2303-client ~]# nmcli connection modify ens160 ipv4.method manual ipv4.addresses 192.168.72.128/24 ipv4.gateway 192.168.72.2 ipv4.dns "223.5.5.5 223.6.6.6 8.8.8.8" connection.autoconnect yes
[root@2303-client ~]# nmcli c up ens160
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)
1.2 查看时间服务
我们可以执行如下的命令来查看软件是否已经安装。（由开题所讲chrony是Linux自带的）
[root@2303-client ~]# rpm -ql chrony
/etc/chrony.conf
/etc/chrony.keys
/etc/dhcp/dhclient.d/chrony.sh
/etc/logrotate.d/chrony
/etc/sysconfig/chronyd
/usr/bin/chronyc
/usr/lib/.build-id
/usr/lib/.build-id/2f
/usr/lib/.build-id/2f/95b227fb143c436a3cef3de800d02db71a905b
/usr/lib/.build-id/d1
/usr/lib/.build-id/d1/e273d21bb4982bc02179ea1d9e5034feefd178
/usr/lib/NetworkManager
/usr/lib/NetworkManager/dispatcher.d
/usr/lib/NetworkManager/dispatcher.d/20-chrony-dhcp
/usr/lib/NetworkManager/dispatcher.d/20-chrony-onoffline
/usr/lib/systemd/ntp-units.d/50-chronyd.list
/usr/lib/systemd/system/chrony-wait.service
/usr/lib/systemd/system/chronyd-restricted.service
/usr/lib/systemd/system/chronyd.service
/usr/lib/sysusers.d/chrony.conf
/usr/sbin/chronyd
/usr/share/doc/chrony
/usr/share/doc/chrony/FAQ
/usr/share/doc/chrony/NEWS
/usr/share/doc/chrony/README
/usr/share/licenses/chrony
/usr/share/licenses/chrony/COPYING
/usr/share/man/man1/chronyc.1.gz
/usr/share/man/man5/chrony.conf.5.gz
/usr/share/man/man8/chronyd.8.gz
/var/lib/chrony
/var/lib/chrony/drift
/var/lib/chrony/rtc
/var/log/chrony
或是这个命令查看服务的配置信息文件：
[root@2303-client ~]# rpm -qc chrony
/etc/chrony.conf
/etc/chrony.keys
/etc/logrotate.d/chrony
/etc/sysconfig/chronyd
1.3 查看服务的状态
可以通过如下的命令来查看服务运行的状态
[root@2303-server ~]# systemctl status chronyd
● chronyd.service - NTP client/server
Loaded: loaded (/usr/lib/systemd/system/chronyd.service; enabled; preset: enabled)
Active: active (running) since Sat 2025-12-20 16:41:19 CST; 28min ago
Docs: man:chronyd(8)
man:chrony.conf(5)
Process: 894 ExecStart=/usr/sbin/chronyd $OPTIONS (code=exited, status=0/SUCCESS)
Main PID: 906 (chronyd)
Tasks: 1 (limit: 24536)
Memory: 4.7M
CPU: 93ms
CGroup: /system.slice/chronyd.service
└─906 /usr/sbin/chronyd -F 2
Dec 20 16:41:19 localhost chronyd[906]: Loaded seccomp filter (level 2)
Dec 20 16:41:19 localhost systemd[1]: Started NTP client/server.
Dec 20 16:41:25 localhost.localdomain chronyd[906]: Selected source 203.107.6.88 (ntp.ali>
Dec 20 16:41:25 localhost.localdomain chronyd[906]: System clock wrong by 1.857542 seconds
Dec 20 16:41:27 localhost.localdomain chronyd[906]: System clock was stepped by 1.857542 >
Dec 20 16:41:27 localhost.localdomain chronyd[906]: System clock TAI offset set to 37 sec>
Dec 20 17:03:32 2303-server chronyd[906]: Can't synchronise: no selectable sources
Dec 20 17:03:32 2303-server chronyd[906]: Source 203.107.6.88 offline
Dec 20 17:03:32 2303-server chronyd[906]: Source 203.107.6.88 online
Dec 20 17:03:33 2303-server chronyd[906]: Selected source 203.107.6.88 (ntp.aliyun.com)
从上面的命令运行结果可以看到，chronyd 服务已经成功运行并且是开机自动运行的。这个服务的文件是：/usr/lib/systemd/system/chronyd.service
[root@2303-client ~]# vim /usr/lib/systemd/system/chronyd.service
[Unit]
Description=NTP client/server
Documentation=man:chronyd(8) man:chrony.conf(5)
After=ntpdate.service sntp.service ntpd.service
Conflicts=ntpd.service systemd-timesyncd.service
ConditionCapability=CAP_SYS_TIME
[Service]
Type=forking
PIDFile=/run/chrony/chronyd.pid
EnvironmentFile=-/etc/sysconfig/chronyd
ExecStart=/usr/sbin/chronyd $OPTIONS
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_KILL CAP_LEASE CAP_LINUX_IMMUTABLE
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE CAP_MKNOD CAP_SYS_ADMIN
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_PACCT
CapabilityBoundingSet=~CAP_SYS_PTRACE CAP_SYS_RAWIO CAP_SYS_TTY_CONFIG CAP_WAKE_ALARM
DeviceAllow=char-pps rw
DeviceAllow=char-ptp rw
DeviceAllow=char-rtc rw
DevicePolicy=closed
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
PrivateTmp=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectProc=invisible
ProtectSystem=full
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictSUIDSGID=yes
SystemCallArchitectures=native
SystemCallFilter=~@cpu-emulation @debug @module @mount @obsolete @raw-io @reboot @swap
# Adjust restrictions for /usr/sbin/sendmail (mailonchange directive)
NoNewPrivileges=no
RestrictAddressFamilies=AF_NETLINK
[Install]
WantedBy=multi-user.target
总结在/usr/lib/systemd/system/chronyd.service文件内容由三部分组成：
[Unit]
这个部分是用于定义服务的描述说明，服务启动顺序，以及服务依赖关系。
[Service]
这个部分是服务定义的重要内容：服务的启动、服务的停止、服务的重启等命令。
[Install]
这个部分用于定义服务的安装方式。
1.4 时间服务的进程
1.4.1 chronyd
这是一个后台进程，用于处理我们时间同步服务的进程。
1.4.2 chronyc
它是以交互式进行进行进程管理的，它只当前环境有效，如果服务重启则会失效。
[root@2303-server ~]# chronyc
chrony version 4.6.1
Copyright (C) 1997-2003, 2007, 2009-2024 Richard P. Curnow and others
chrony comes with ABSOLUTELY NO WARRANTY. This is free software, and
you are welcome to redistribute it under certain conditions. See the
GNU General Public License version 2 for details.
chronyc>
可以在提示符后面输入 help 来查看帮助信息（Ctrl+c退出）：
chronyc> help
System clock:
tracking Display system time information
makestep Correct clock by stepping immediately
makestep <threshold> <updates>
Configure automatic clock stepping
maxupdateskew <skew> Modify maximum valid skew to update frequency
waitsync [<max-tries> [<max-correction> [<max-skew> [<interval>]]]]
Wait until synchronised in specified limits
Time sources:
sources [-a] [-v] Display information about current sources
sourcestats [-a] [-v] Display statistics about collected measurements
selectdata [-a] [-v] Display information about source selection
selectopts <address|refid> <+|-options>
Modify selection options
reselect Force reselecting synchronisation source
reselectdist <dist> Modify reselection distance
offset <address|refid> <offset>
Modify offset correction
NTP sources:
activity Check how many NTP sources are online/offline
authdata [-a] [-v] Display information about authentication
ntpdata [<address>] Display information about last valid measurement
add server <name> [options] Add new NTP server
add pool <name> [options] Add new pool of NTP servers
add peer <name> [options] Add new NTP peer
delete <address> Remove server or peer
burst <n-good>/<n-max> [[<mask>/]<address>]
Start rapid set of measurements
maxdelay <address> <delay> Modify maximum valid sample delay
maxdelayratio <address> <ratio>
Modify maximum valid delay/minimum ratio
maxdelaydevratio <address> <ratio>
Modify maximum valid delay/deviation ratio
minpoll <address> <poll> Modify minimum polling interval
maxpoll <address> <poll> Modify maximum polling interval
minstratum <address> <stratum>
Modify minimum stratum
offline [[<mask>/]<address>]
Set sources in subnet to offline status
online [[<mask>/]<address>] Set sources in subnet to online status
onoffline Set all sources to online or offline status
according to network configuration
polltarget <address> <target>
Modify poll target
refresh Refresh IP addresses
reload sources Re-read *.sources files
sourcename <address> Display original name
Manual time input:
manual off|on|reset Disable/enable/reset settime command
manual list Show previous settime entries
manual delete <index> Delete previous settime entry
settime <time> Set daemon time
(e.g. Sep 25, 2015 16:30:05 or 16:30:05)
NTP access:
accheck <address> Check whether address is allowed
clients [-p <packets>] [-k] [-r]
Report on clients that accessed the server
serverstats Display statistics of the server
allow [<subnet>] Allow access to subnet as a default
allow all [<subnet>] Allow access to subnet and all children
deny [<subnet>] Deny access to subnet as a default
deny all [<subnet>] Deny access to subnet and all children
local [options] Serve time even when not synchronised
local off Don't serve time when not synchronised
smoothtime reset|activate Reset/activate time smoothing
smoothing Display current time smoothing state
Monitoring access:
cmdaccheck <address> Check whether address is allowed
cmdallow [<subnet>] Allow access to subnet as a default
cmdallow all [<subnet>] Allow access to subnet and all children
cmddeny [<subnet>] Deny access to subnet as a default
cmddeny all [<subnet>] Deny access to subnet and all children
Real-time clock:
rtcdata Print current RTC performance parameters
trimrtc Correct RTC relative to system clock
writertc Save RTC performance parameters to file
Other daemon commands:
cyclelogs Close and re-open log files
dump Dump measurements and NTS keys/cookies
rekey Re-read keys
reset sources Drop all measurements
shutdown Stop daemon
Client commands:
dns -n|+n Disable/enable resolving IP addresses to hostnames
dns -4|-6|-46 Resolve hostnames only to IPv4/IPv6/both addresses
timeout <milliseconds> Set initial response timeout
retries <retries> Set maximum number of retries
keygen [<id> [<type> [<bits>]]]
Generate key for key file
exit|quit Leave the program
help Generate this help
chronyc>
1.5 配置时间同步服务端
打开 阿里镜像网址：https://developer.aliyun.com/mirror/
点击NTP之后，找到文章最后复制，以此参考并学习
我们通过 2303-server 来作为时间同步的服务器，它与阿里云提供的时间服务进行同步。我们需要修改 /etc/chrony.conf 文件。并在文件中添加如下内容：
[root@2303-server ~]# vim /etc/chrony.conf
#在esc模式编辑下输入d，shift+d全部删除后，黏贴以下内容
server ntp.aliyun.com iburst
stratumweight 0
driftfile /var/lib/chrony/drift
rtcsync
makestep 10 3
bindcmdaddress 127.0.0.1
bindcmdaddress ::1
keyfile /etc/chrony.keys
commandkey 1
generatecommandkey
logchange 0.5
logdir /var/log/chrony
#新增这一行跟自己的网段一致
allow 192.168.183.0/24
配置参数说明：
* pool ntp.aliyun.com iburst：指定使用ntp.aliyun.com作为时间服务器池，iburst选项表示在初始同步时会发送多个请求以加快同步速度。
* driftfile /var/lib/chrony/drift：指定用于保存时钟漂移信息的文件路径。
* makestep 1.0 3：设置当系统时间与服务器时间偏差大于1秒时，会以1秒的步长进行调整。如果偏差超过3秒，则立即进行时间调整。
* rtcsync：启用硬件时钟同步功能，可以提高时钟的准确性。
* allow 192.168.10.0/24：允许192.168.0.0/24网段范围内的主机与chrony进行时间同步。
* local stratum 10：将本地时钟设为stratum 10，stratum值表示时钟的准确度，值越小表示准确度越高。
* keyfile /etc/chrony.keys：指定使用的密钥文件路径，用于对时间同步进行身份验证。
* leapsectz right/UTC：指定时区为UTC。
* logdir /var/log/chrony：指定日志文件存放目录。
然后保存退出，并执行如下的命令来验证。
[root@2303-server ~]# chronyc sources
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^- 119.28.183.184 2 9 237 396 +8417us[+8417us] +/- 71ms
^- a.chl.la 2 9 373 516 -2834us[-2814us] +/- 116ms
^- stratum2-1.ntp.mow01.ru.> 2 8 375 576 +40ms[ +40ms] +/- 103ms
^* time.nju.edu.cn 1 9 377 445 +30us[ +52us] +/- 19ms
# 重启chronyd服务让配置生效
[root@2303-server ~]# systemctl restart chronyd
[root@2303-server ~]# chronyc sources
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^* 203.107.6.88 2 6 17 25 -124us[-2301us] +/- 33ms
[root@2303-server ~]# chronyc sources -v
.-- Source mode '^' = server, '=' = peer, '#' = local clock.
/ .- Source state '*' = current best, '+' = combined, '-' = not combined,
| / 'x' = may be in error, '~' = too variable, '?' = unusable.
|| .- xxxx [ yyyy ] +/- zzzz
|| Reachability register (octal) -. | xxxx = adjusted offset,
|| Log2(Polling interval) --. | | yyyy = measured offset,
|| \ | | zzzz = estimated error.
|| | | \
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^* 203.107.6.88 2 6 17 52 -124us[-2301us] +/- 33ms
[root@2303-server ~]# chronyc sourcestats
Name/IP Address NP NR Span Frequency Freq Skew Offset Std Dev
==============================================================================
203.107.6.88 7 4 200 +9.988 105.167 +506us 3835us
[root@2303-server ~]# chronyc sourcestats -v
.- Number of sample points in measurement set.
/ .- Number of residual runs with same sign.
| / .- Length of measurement set (time).
| | / .- Est. clock freq error (ppm).
| | | / .- Est. error in freq.
| | | | / .- Est. offset.
| | | | | | On the -.
| | | | | | samples. \
| | | | | | |
Name/IP Address NP NR Span Frequency Freq Skew Offset Std Dev
==============================================================================
203.107.6.88 7 4 200 +9.988 105.167 +530us 3835us
# 查看同步的信息
[root@2303-server ~]# chronyc tracking
Reference ID : CB6B0658 (203.107.6.88)
Stratum : 3
Ref time (UTC) : Sat Oct 25 07:10:34 2025
System time : 0.000890428 seconds slow of NTP time
Last offset : -0.000980635 seconds
RMS offset : 0.014107447 seconds
Frequency : 5.359 ppm fast
Residual freq : +3.048 ppm
Skew : 1.395 ppm
Root delay : 0.063028432 seconds
Root dispersion : 0.003531739 seconds
Update interval : 64.1 seconds
Leap status : Normal
1.6 配置时间同步客户端
目录我们的 2303-client 主机同步的是默认的时间服务。
[root@2303-client system]# chronyc sources -v
.-- Source mode '^' = server, '=' = peer, '#' = local clock.
/ .- Source state '*' = current best, '+' = combined, '-' = not combined,
| / 'x' = may be in error, '~' = too variable, '?' = unusable.
|| .- xxxx [ yyyy ] +/- zzzz
|| Reachability register (octal) -. | xxxx = adjusted offset,
|| Log2(Polling interval) --. | | yyyy = measured offset,
|| \ | | zzzz = estimated error.
|| | | \
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^* time.nju.edu.cn 1 10 377 556 -807us[-1315us] +/- 20ms
^- a.chl.la 2 10 377 674 +7436us[+6941us] +/- 106ms
^- 119.28.183.184 2 10 177 288 +23ms[ +23ms] +/- 62ms
^- stratum2-1.ntp.mow01.ru.> 2 9 237 929 +43ms[ +43ms] +/- 110ms
修改 2303-client 主机中的 /etc/chrony.conf
[root@2303-client system]# vim /etc/chrony.conf
#然后将如下的内容进行修改
#pool 2.rhel.pool.ntp.org iburst（注释掉这一行）
server 192.168.183.142 iburst
修改好后保存退出，并执行重启服务的命令：
[root@2303-client system]# systemctl restart chronyd
重启好后再次查看同步的状态：(？代表还没有同步成功，等待一会查看，变*号则是成功）
[root@2303-client ~]# chronyc sources
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^? 192.168.183.142
注意：为什么客户端没有和服务端同步成功呢？因为忘记关闭防火墙了！！！！！
在两个主机添加放行防火墙的端口代码如下：
NTP 服务（时间同步服务）使用 UDP 123 端口，需确保服务端防火墙放行该端口：
[root@2303-client ~]# firewall-cmd --add-port=123/udp --permanent
success
[root@2303-client ~]# firewall-cmd --reload
success
#别忘记重启服务进程
[root@2303-client ~]# systemctl restart chronyd
[root@2303-client ~]# chronyc sources
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^* 192.168.183.142 3 6 7 0 +1449ns[+1804ms] +/- 83ms
2. NFS服务
NFS 网络文件服务，用于在多个服务器之间进行数据存储和共享。它也是有服务端和客户端之分。要想使用 nfs 服务，我们需要安装 nfs-tools 软件。
2.1 安装软件
注意：在两台主机（服务端、客户端）中都要安装。
[root@2303-server ~]# dnf install nfs-utils -y
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered with an entitlement server. You can use "rhc" or "subscription-manager" to register.
Last metadata expiration check: 1:06:41 ago on Sat 25 Oct 2025 02:40:42 PM CST.
Dependencies resolved.
================================================================================================
Package Architecture Version Repository Size
================================================================================================
Installing:
nfs-utils x86_64 1:2.5.4-34.el9 BaseOS 463 k
Installing dependencies:
gssproxy x86_64 0.8.4-7.el9 BaseOS 114 k
libev x86_64 4.33-6.el9 BaseOS 55 k
libnfsidmap x86_64 1:2.5.4-34.el9 BaseOS 66 k
libverto-libev x86_64 0.3.2-3.el9 BaseOS 15 k
quota x86_64 1:4.09-4.el9 BaseOS 202 k
quota-nls noarch 1:4.09-4.el9 BaseOS 79 k
rpcbind x86_64 1.2.6-7.el9 BaseOS 62 k
sssd-nfs-idmap x86_64 2.9.6-4.el9 BaseOS 41 k
Transaction Summary
================================================================================================
Install 9 Packages
Total size: 1.1 M
Installed size: 2.9 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : libnfsidmap-1:2.5.4-34.el9.x86_64 1/9
Running scriptlet: rpcbind-1.2.6-7.el9.x86_64 2/9
Installing : rpcbind-1.2.6-7.el9.x86_64 2/9
Running scriptlet: rpcbind-1.2.6-7.el9.x86_64 2/9
Created symlink /etc/systemd/system/multi-user.target.wants/rpcbind.service → /usr/lib/systemd/system/rpcbind.service.
Created symlink /etc/systemd/system/sockets.target.wants/rpcbind.socket → /usr/lib/systemd/system/rpcbind.socket.
Installing : quota-nls-1:4.09-4.el9.noarch 3/9
Installing : quota-1:4.09-4.el9.x86_64 4/9
Installing : libev-4.33-6.el9.x86_64 5/9
Installing : libverto-libev-0.3.2-3.el9.x86_64 6/9
Installing : gssproxy-0.8.4-7.el9.x86_64 7/9
Running scriptlet: gssproxy-0.8.4-7.el9.x86_64 7/9
Running scriptlet: nfs-utils-1:2.5.4-34.el9.x86_64 8/9
Installing : nfs-utils-1:2.5.4-34.el9.x86_64 8/9
Running scriptlet: nfs-utils-1:2.5.4-34.el9.x86_64 8/9
Installing : sssd-nfs-idmap-2.9.6-4.el9.x86_64 9/9
Running scriptlet: sssd-nfs-idmap-2.9.6-4.el9.x86_64 9/9
Verifying : gssproxy-0.8.4-7.el9.x86_64 1/9
Verifying : libev-4.33-6.el9.x86_64 2/9
Verifying : libnfsidmap-1:2.5.4-34.el9.x86_64 3/9
Verifying : libverto-libev-0.3.2-3.el9.x86_64 4/9
Verifying : nfs-utils-1:2.5.4-34.el9.x86_64 5/9
Verifying : quota-1:4.09-4.el9.x86_64 6/9
Verifying : quota-nls-1:4.09-4.el9.noarch 7/9
Verifying : rpcbind-1.2.6-7.el9.x86_64 8/9
Verifying : sssd-nfs-idmap-2.9.6-4.el9.x86_64 9/9
Installed products updated.
Installed:
gssproxy-0.8.4-7.el9.x86_64 libev-4.33-6.el9.x86_64
libnfsidmap-1:2.5.4-34.el9.x86_64 libverto-libev-0.3.2-3.el9.x86_64
nfs-utils-1:2.5.4-34.el9.x86_64 quota-1:4.09-4.el9.x86_64
quota-nls-1:4.09-4.el9.noarch rpcbind-1.2.6-7.el9.x86_64
sssd-nfs-idmap-2.9.6-4.el9.x86_64
Complete!
查看安装信息：
[root@2303-server ~]# rpm -ql nfs-utils
/etc/exports.d
/etc/gssproxy/24-nfs-server.conf
/etc/modprobe.d/lockd.conf
/etc/nfs.conf
/etc/nfsmount.conf
/etc/request-key.d/id_resolver.conf
/sbin/mount.nfs
/sbin/mount.nfs4
/sbin/nfsdcltrack
/sbin/rpc.statd
/sbin/umount.nfs
/sbin/umount.nfs4
.......
2.2 启动NFS服务
我们需要查看服务启动的文件名称：
[root@2303-server ~]# find / -name nfs*.service
/usr/lib/systemd/system/nfs-blkmap.service
/usr/lib/systemd/system/nfs-idmapd.service
/usr/lib/systemd/system/nfs-mountd.service
/usr/lib/systemd/system/nfs-server.service
/usr/lib/systemd/system/nfs-utils.service
/usr/lib/systemd/system/nfsdcld.service
执行如下的命令来启动NFS服务
[root@2303-server ~]# systemctl status nfs-server
● nfs-server.service - NFS server and services
Loaded: loaded (/usr/lib/systemd/system/nfs-server.service; disabled; preset: disabled)
Active: active (exited) since Sat 2025-10-25 15:54:39 CST; 35s ago
Docs: man:rpc.nfsd(8)
man:exportfs(8)
Process: 14137 ExecStartPre=/usr/sbin/exportfs -r (code=exited, status=0/SUCCESS)
Process: 14138 ExecStart=/usr/sbin/rpc.nfsd (code=exited, status=0/SUCCESS)
Process: 14158 ExecStart=/bin/sh -c if systemctl -q is-active gssproxy; then systemctl relo>
Main PID: 14158 (code=exited, status=0/SUCCESS)
CPU: 30ms
Oct 25 15:54:39 2303-server systemd[1]: Starting NFS server and services...
Oct 25 15:54:39 2303-server systemd[1]: Finished NFS server and services.
Loaded: loaded (/usr/lib/systemd/system/nfs-server.service; disabled; preset: disabled)
根据这条指令内容得知，目前 nfs-server 服务并没有加入到开机自启列表中，如果需要加入则执行如下的命令：
[root@2303-server ~]# systemctl enable --now nfs-server
Created symlink /etc/systemd/system/multi-user.target.wants/nfs-server.service → /usr/lib/systemd/system/nfs-server.service.
# 或者这条命令
[root@2303-server ~]# systemctl enable nfs-server
两条命令区别：就是 “既做开机准备，又马上启用” 和 “只做开机准备”
查看服务的端口：
[root@2303-server ~]# netstat -lntup
# 还可以使用如下命令来查看
[root@2303-server ~]# ss -lntup
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
udp UNCONN 0 0 0.0.0.0:52227 0.0.0.0:* users:(("rpc.statd",pid=14131,fd=8))
udp UNCONN 0 0 0.0.0.0:111 0.0.0.0:* users:(("rpcbind",pid=14130,fd=5),("systemd",pid=1,fd=57))
udp UNCONN 0 0 0.0.0.0:123 0.0.0.0:* users:(("chronyd",pid=1625,fd=7))
udp UNCONN 0 0 127.0.0.1:323 0.0.0.0:* users:(("chronyd",pid=1625,fd=5))
udp UNCONN 0 0 0.0.0.0:36387 0.0.0.0:*
udp UNCONN 0 0 0.0.0.0:20048 0.0.0.0:* users:(("rpc.mountd",pid=14136,fd=4))
udp UNCONN 0 0 127.0.0.1:739 0.0.0.0:* users:(("rpc.statd",pid=14131,fd=5))
udp UNCONN 0 0 [::]:111 [::]:* users:(("rpcbind",pid=14130,fd=7),("systemd",pid=1,fd=59))
udp UNCONN 0 0 [::]:32908 [::]:*
udp UNCONN 0 0 [::1]:323 [::]:* users:(("chronyd",pid=1625,fd=6))
udp UNCONN 0 0 [::]:20048 [::]:* users:(("rpc.mountd",pid=14136,fd=6))
udp UNCONN 0 0 [::]:35684 [::]:* users:(("rpc.statd",pid=14131,fd=10))
tcp LISTEN 0 4096 0.0.0.0:20048 0.0.0.0:* users:(("rpc.mountd",pid=14136,fd=5))
tcp LISTEN 0 64 0.0.0.0:43429 0.0.0.0:*
tcp LISTEN 0 4096 0.0.0.0:60447 0.0.0.0:* users:(("rpc.statd",pid=14131,fd=9))
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=937,fd=3))
tcp LISTEN 0 64 0.0.0.0:2049 0.0.0.0:*
tcp LISTEN 0 4096 0.0.0.0:111 0.0.0.0:* users:(("rpcbind",pid=14130,fd=4),("systemd",pid=1,fd=56))
tcp LISTEN 0 64 [::]:42919 [::]:*
tcp LISTEN 0 4096 [::]:42835 [::]:* users:(("rpc.statd",pid=14131,fd=11))
tcp LISTEN 0 4096 [::]:20048 [::]:* users:(("rpc.mountd",pid=14136,fd=7))
tcp LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=937,fd=4))
tcp LISTEN 0 64 [::]:2049 [::]:*
tcp LISTEN 0 4096 [::]:111 [::]:* users:(("rpcbind",pid=14130,fd=6),("systemd",pid=1,fd=58))
2.3 配置nfs服务端
2.3.1 配置导出目录
修改 /etc/exports
[root@2303-server ~]# vim /etc/exports
在这个文件中，我们使用一行来表示一个共享信息，如果有多个共享信息，则编写多行，每一行的格式相同。
/opt/nfs/data 192.168.72.128(rw,sync)
配置说明：
- /opt/nfs/data 表示共享目录地址
- 192.168.72.128/32(rw,sync) 表示允许哪些服务器可以访问我们共享文件，如果有多个可以以空格隔开。
- IP地址与后面的圆括号之间不能有空格。
- 192.168.72.128/32 这可以写成一个固定的IP如192.168.72.128，也可以写成IP段如：192.168.0.0/16
导出条目的默认选项有：
- `ro`导出的文件系统是只读的。远程主机无法更改文件系统中共享的数据。要允许主机更改文件系统（即读写），指定 rw 选项。
- `sync`在将之前的请求所做的更改写入磁盘前，NFS 服务器不会回复请求。要启用异步写，请指定 `async` 选项。
- `wdelay`如果 NFS 服务器预期另外一个写入请求即将发生，则 NFS 服务器会延迟写入磁盘。这可以提高性能，因为它可减少不同的写命令访问磁盘的次数，从而减少写开销。要禁用此功能，请指定 `no_wdelay` 选项，该选项仅在指定了默认 sync 选项时才可用。
- `root_squash`这可以防止远程连接的 root 用户（与本地连接相反）具有 root 特权；相反，NFS 服务器为他们分配用户 ID `nobody`。这可以有效地将远程 root 用户的权限"挤压"成最低的本地用户，从而防止在远程服务器上可能的未经授权的写操作。要禁用 root 挤压，请指定 `no_root_squash` 选项。要挤压每个远程用户（包括 root 用户），请使用 `all_squash` 选项。要指定 NFS 服务器应该分配给来自特定主机的远程用户的用户和组 ID，请分别使用 `anonuid` 和 `anongid` 选项，如下所示：`*export* *host*(anonuid=*uid*,anongid=*gid*)`这里，*uid* 和 *gid* 分别是用户 ID 号和组 ID 号。`anonuid` 和 `anongid` 选项允许您为要共享的远程 NFS 用户创建特殊的用户和组帐户。
2.3.2 创建共享目录
我们在nfs服务端创建共享目录：
[root@2303-server ~]# mkdir -p /opt/nfs/data
[root@2303-server ~]# tree /opt
/opt
└── nfs
└── data
2.3.3 重启nfs服务
我们接着重启 nfs 服务：
[root@2303-server ~]# systemctl restart nfs-server
2.4 配置nfs客户端
2.4.1 创建挂载目录
为了能够使用 nfs 服务提供的共享服务，我们需要创建挂载点
[root@2303-client system]# mkdir -p /opt/data
2.4.2 挂载共享目录
创建好了挂载点后，我们通过如下的命令来使用共享目录。
[root@2303-client system]# mount -t nfs 192.168.72.132:/opt/nfs/data /opt/data
当执行这条命令后，会发现无法挂载（一直卡在那条语句）。为什么？
原因是我们没有在防火墙中将 nfs 相关的服务放行。
为了解决这个问题，我们需要对 nfs 服务端（2303-server 端）的防火墙来放行如下服务：
[root@2303-server ~]# firewall-cmd --permanent --add-service=nfs
success
[root@2303-server ~]# firewall-cmd --permanent --add-service=mountd --add-service=rpc-bind
success
[root@2303-server ~]# firewall-cmd --reload
success
[root@2303-server ~]# firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: ens160
sources:
services: cockpit dhcpv6-client mountd nfs rpc-bind ssh
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
[root@2303-server ~]# firewall-cmd --list-services
cockpit dhcpv6-client mountd nfs rpc-bind ssh
在服务端做了以上的操作后，我们再回到客户端来重新挂载，发现挂载成功
[root@2303-client ~]# mount -t nfs 192.168.183.142:/opt/nfs/data /opt/data
[root@2303-client system]#
挂载成功后查看：
[root@2303-client ~]# df -h
Filesystem Size Used Avail Use% Mounted on
devtmpfs 4.0M 0 4.0M 0% /dev
tmpfs 1.9G 0 1.9G 0% /dev/shm
tmpfs 776M 9.1M 767M 2% /run
efivarfs 256K 56K 196K 23% /sys/firmware/efi/efivars
/dev/mapper/rhel-root 64G 2.1G 62G 4% /
/dev/nvme0n1p2 960M 200M 761M 21% /boot
/dev/nvme0n1p1 599M 7.1M 592M 2% /boot/efi
/dev/sr0 12G 12G 0 100% /mnt
/dev/mapper/rhel-home 31G 254M 31G 1% /home
tmpfs 388M 0 388M 0% /run/user/0
192.168.183.142:/opt/nfs/data 64G 2.1G 62G 4% /opt/data
[root@2303-client ~]# showmount -e 192.168.183.142
Export list for 192.168.183.142:
/opt/nfs/data 192.168.183.144
2.5 共享测试
2.5.1 服务端测试
在服务端的 /opt/nfs/data 目录下创建 f1 文件和 d1 目录
[root@2303-server ~]# cd /opt/nfs/data/
[root@2303-server data]# touch f1
[root@2303-server data]# mkdir d1
[root@2303-server data]# ls
d1 f1
[root@2303-server data]# ll
total 0
drwxr-xr-x. 2 root root 6 Dec 27 15:16 d1
-rw-r--r--. 1 root root 0 Dec 27 15:16 f1
然后在nfs的客户端来验证：
[root@2303-client ~]# cd /opt/data
[root@2303-client data]# ll
total 0
drwxr-xr-x. 2 root root 6 Dec 27 15:16 d1
-rw-r--r--. 1 root root 0 Dec 27 15:16 f1
如果我们想去修改文件时，则会报权限拒绝：
[root@2303-client data]# echo 111 > f1
-bash: f1: Permission denied
为了解决这个问题，我们先给这个目录在server服务端赋予可写权限
[root@2303-server data]# chmod -R a+w /opt/nfs/data/
[root@2303-server data]# ll
total 0
drwxrwxrwx. 2 root root 6 Dec 27 15:16 d1
-rw-rw-rw-. 1 root root 0 Dec 27 15:16 f1
当有写权限后，就能在客户端就可以去修改和增加文件了
# 修改文件
[root@2303-client data]# echo 111 > f1
[root@2303-client data]# cat f1
111
# 增加文件
[root@2303-client data]# touch f2
[root@2303-client data]# ls
d1 f1 f2
[root@2303-client data]# ll
total 4
drwxrwxrwx. 2 root root 6 Oct 25 16:24 d1
-rw-rw-rw-. 1 root root 4 Oct 25 16:28 f1
-rw-r--r--. 1 nobody nobody 0 Oct 25 16:29 f2
建议：我们不需要给 /opt/nfs/data 目录设置可写权限，而是将 /opt/nfs/data 目录的所有者和所属组权限设置为 nobody，这样也能实现文件修改与增加功能。
[root@2303-server data]# chown -R nobody: /opt/nfs/data
[root@2303-server data]# ll
total 0
drwxrwxrwx. 2 nobody nobody 6 Dec 27 15:16 d1
-rw-rw-rw-. 1 nobody nobody 0 Dec 27 15:16 f1
北京人形旗下天工造物具身智能开源社区，聚焦具身天工与慧思开物两大平台
更多推荐
21
0- 0
已为社区贡献1条内容
所有评论(0)