commit 5a636949a93542dee1860f682110006c9b925ab7
Author: Stephen Wadeley <swadeley(a)redhat.com>
Date: Mon Nov 24 20:28:37 2014 +0100
Update after translators and SME review
en-US/Configuring_NTP_Using_the_chrony_Suite.xml | 99 +++++++++++-----------
1 files changed, 50 insertions(+), 49 deletions(-)
---
diff --git a/en-US/Configuring_NTP_Using_the_chrony_Suite.xml
b/en-US/Configuring_NTP_Using_the_chrony_Suite.xml
index efaff6d..8a23bad 100644
--- a/en-US/Configuring_NTP_Using_the_chrony_Suite.xml
+++ b/en-US/Configuring_NTP_Using_the_chrony_Suite.xml
@@ -199,7 +199,7 @@ Optionally specify a host, subnet, or network from which to allow
<systemitem cl
<term>local</term>
<listitem>
<para>
- The <command>local</command> keyword is used to allow
<systemitem class="daemon">chronyd</systemitem> to appear
synchronized to real time (from the viewpoint of clients polling it), even if it has no
current synchronization source. This option is normally used on computers in an isolated
network, where several computers are required to synchronize to one other, this being the
<quote>master</quote> which is kept vaguely in line with real time by manual
input.</para>
+ The <command>local</command> keyword is used to allow
<systemitem class="daemon">chronyd</systemitem> to appear
synchronized to real time from the viewpoint of clients polling it, even if it has no
current synchronization source. This option is normally used on the
<quote>master</quote> computer in an isolated network, where several computers
are required to synchronize to one another, and the <quote>master</quote> is
kept in line with real time by manual input.</para>
<para>
An example of the command is:
<screen>local stratum 10</screen>
@@ -417,7 +417,7 @@ peer w.x.y.z key 10
<para>
A manual entry in the key file, used to authenticate packets from certain
<systemitem class="protocol">NTP</systemitem> servers or peers, can
be as simple as the following:
<screen>20 foobar</screen>
- Were <literal>20</literal> is the key ID and
<literal>foobar</literal> is the secret authentication key. The default hash
is MD5, and ASCII is the default format for the key.
+ Where <literal>20</literal> is the key ID and
<literal>foobar</literal> is the secret authentication key. The default hash
is MD5, and ASCII is the default format for the key.
</para>
<para>
By default, <systemitem class="daemon">chronyd</systemitem>
is configured to listen for commands only from <systemitem
class="systemname">localhost</systemitem> (<systemitem
class="ipaddress">127.0.0.1</systemitem> and <systemitem
class="ipaddress">::1</systemitem>) on port
<literal>323</literal>. To access <systemitem
class="daemon">chronyd</systemitem> remotely with
<application>chronyc</application>, any
<command>bindcmdaddress</command> directives in the
<filename>/etc/chrony.conf</filename> file should be removed to enable
listening on all interfaces and the <command>cmdallow</command> directive
should be used to allow commands from the remote <systemitem
class="protocol">IP</systemitem> address, network, or subnet. In
addition, port <literal>323</literal> has to be opened in the firewall in
order to connect from a remote system. Note that the <command>allow</command>
directive is for <systemitem class="protocol">NTP</systemitem>
access whereas the <command>cmda
llow</command> directive is to enable the receiving of remote commands. It is
possible to make these changes temporarily using
<application>chronyc</application> running locally. Edit the configuration
file to make persistent changes.
@@ -482,20 +482,13 @@ chronyc> <command>password
HEX:A6CFC50C9C93AB6E5A19754C246242FC5471BCDF</command
<title>Using chrony</title>
-<section id="sect-Checking_if_chrony_is_installed">
- <title>Checking if chrony is Installed</title>
- <para>
- To check if <application>chrony</application> is installed, run the
following command as <systemitem
class="username">root</systemitem>:
- <screen>~]# <command>yum install
chrony</command></screen>
- The default location for the <application>chrony</application>
daemon is <filename>/usr/sbin/chronyd</filename>. The command line utility
will be installed to <filename>/usr/bin/chronyc</filename>.
- </para>
- </section>
+
<section id="sect-Installing_chrony">
<title>Installing chrony</title>
<para>
-To install <application>chrony</application>, run the following command as
<systemitem class="username">root</systemitem>:
- <screen>~]# <command>yum install chrony
-y</command></screen>
+ The <application>chrony</application> suite is installed by default on
some versions of Fedora. If required, to ensure that it is, run the following command as
<systemitem class="username">root</systemitem>:
+ <screen>~]# <command>yum install
chrony</command></screen>
The default location for the <application>chrony</application> daemon is
<filename>/usr/sbin/chronyd</filename>. The command line utility will be
installed to <filename>/usr/bin/chronyc</filename>.
</para>
</section>
@@ -505,7 +498,7 @@ The default location for the
<application>chrony</application> daemon is <filena
<title>Checking the Status of chronyd</title>
<para>
To check the status of <systemitem
class="daemon">chronyd</systemitem>, issue the following command:
- <screen>~]$ <command>systemctl status chronyd</command>
+ <screen>~]$ <command>systemctl status chronyd</command>
chronyd.service - NTP client/server
Loaded: loaded (/usr/lib/systemd/system/chronyd.service; enabled)
Active: active (running) since Wed 2013-06-12 22:23:16 CEST; 11h ago</screen>
@@ -515,22 +508,22 @@ chronyd.service - NTP client/server
<title>Starting chronyd</title>
<para>
To start <systemitem
class="daemon">chronyd</systemitem>, issue the following command as
<systemitem class="username">root</systemitem>:
- <screen>~]# <command>systemctl start
chronyd</command></screen>
+ <screen>~]# <command>systemctl start
chronyd</command></screen>
</para>
<para>
To ensure <systemitem
class="daemon">chronyd</systemitem> starts automatically at system
start, issue the following command as <systemitem
class="username">root</systemitem>:
- <screen>~]# <command>systemctl enable
chronyd</command></screen>
+ <screen>~]# <command>systemctl enable
chronyd</command></screen>
</para>
</section>
<section id="sect-Stopping_chronyd">
<title>Stopping chronyd</title>
<para>
To stop <systemitem
class="daemon">chronyd</systemitem>, issue the following command as
<systemitem class="username">root</systemitem>:
- <screen>~]# <command>systemctl stop
chronyd</command></screen>
+ <screen>~]# <command>systemctl stop
chronyd</command></screen>
</para>
<para>
To prevent <systemitem
class="daemon">chronyd</systemitem> from starting automatically at
system start, issue the following command as <systemitem
class="username">root</systemitem>:
- <screen>~]# <command>systemctl disable
chronyd</command></screen>
+ <screen>~]# <command>systemctl disable
chronyd</command></screen>
</para>
</section>
@@ -546,7 +539,7 @@ chronyd.service - NTP client/server
<para>
To check <application>chrony</application> tracking, issue the following
command:
- <screen>~]$ <command>chronyc tracking</command>
+ <screen>~]$ <command>chronyc tracking</command>
Reference ID : 1.2.3.4 (a.b.c)
Stratum : 3
Ref time (UTC) : Fri Feb 3 15:00:29 2012
@@ -561,7 +554,7 @@ Root dispersion : 0.024780 seconds
Update interval : 64.2 seconds
Leap status : Normal
</screen>
- The fields are as follows:
+ The fields are as follows:
</para>
<variablelist>
<varlistentry>
@@ -612,7 +605,7 @@ Leap status : Normal
<term>Frequency</term>
<listitem>
<para>
- The <quote>frequency</quote> is the rate by which the system’s
clock would be would be wrong if <systemitem
class="daemon">chronyd</systemitem> was not correcting it. It is
expressed in ppm (parts per million). For example, a value of 1ppm would mean that when
the system’s clock thinks it has advanced 1 second, it has actually advanced by 1.000001
seconds relative to true time.</para>
+ The <quote>frequency</quote> is the rate by which the system’s
clock would be wrong if <systemitem
class="daemon">chronyd</systemitem> was not correcting it. It is
expressed in ppm (parts per million). For example, a value of 1ppm would mean that when
the system’s clock thinks it has advanced 1 second, it has actually advanced by 1.000001
seconds relative to true time.</para>
</listitem>
</varlistentry>
<varlistentry>
@@ -666,16 +659,14 @@ This is the total dispersion accumulated through all the computers
back to the s
The sources command displays information about the current time sources that
<systemitem class="daemon">chronyd</systemitem> is accessing.
The optional argument -v can be specified, meaning verbose. In this case, extra caption
lines are shown as a reminder of the meanings of the columns.
- <screen>~]$ <command>chronyc sources</command>
+ <screen>~]$ <command>chronyc sources</command>
210 Number of sources = 3
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
#* GPS0 0 4 377 11 -479ns[ -621ns] +/- 134ns
^? a.b.c 2 6 377 23 -923us[ -924us] +/- 43ms
-^+ d.e.f 1 6 377 21 -2629us[-2619us] +/- 86ms
-
-</screen>
-The columns are as follows:
+^+ d.e.f 1 6 377 21 -2629us[-2619us] +/-
86ms</screen>
+The columns are as follows:
<variablelist>
<varlistentry>
<term>M</term>
@@ -689,7 +680,7 @@ This indicates the mode of the source.
<literal>^</literal> means a server, <lit
<term>S</term>
<listitem>
<para>
-This column indicates the state of the sources. <quote>*</quote> indicates
the source to which <systemitem class="daemon">chronyd</systemitem>
is currently synchronized. <quote>+</quote> indicates acceptable sources which
are combined with the selected source. <quote>-</quote> indicates acceptable
sources which are excluded by the combining algorithm. <quote>?</quote>
indicates sources to which connectivity has been lost or whose packets do not pass all
tests. <quote>x</quote> indicates a clock which <systemitem
class="daemon">chronyd</systemitem> thinks is a
<firstterm>falseticker</firstterm> ( its time is inconsistent with a majority
of other sources). <quote>~</quote> indicates a source whose time appears to
have too much
+This column indicates the state of the sources. <quote>*</quote> indicates
the source to which <systemitem class="daemon">chronyd</systemitem>
is currently synchronized. <quote>+</quote> indicates acceptable sources which
are combined with the selected source. <quote>-</quote> indicates acceptable
sources which are excluded by the combining algorithm. <quote>?</quote>
indicates sources to which connectivity has been lost or whose packets do not pass all
tests. <quote>x</quote> indicates a clock which <systemitem
class="daemon">chronyd</systemitem> thinks is a
<firstterm>falseticker</firstterm> (its time is inconsistent with a majority
of other sources). <quote>~</quote> indicates a source whose time appears to
have too much
variability. The <quote>?</quote> condition is also shown at start-up,
until at least 3 samples have been gathered from it.</para>
</listitem>
</varlistentry>
@@ -739,7 +730,7 @@ This shows the stratum of the source, as reported in its most recently
received
<term>Last sample</term>
<listitem>
<para>
- This column shows the offset between the local clock and the source at the last
measurement. The number in the square brackets shows the actual measured offset. This may
be suffixed by <literal>ns</literal> (indicating nanoseconds),
<literal>us</literal> (indicating microseconds),
<literal>ms</literal> (indicating milliseconds), or
<literal>s</literal> (indicating seconds). The number to the left of the
square brackets shows the original measurement, adjusted to allow for any slews applied to
the local clock since. The number following the <literal>+/-</literal>
indicator shows the margin of error in the measurement. Positive offsets indicate that the
local clock is fast of the source.
+ This column shows the offset between the local clock and the source at the last
measurement. The number in the square brackets shows the actual measured offset. This may
be suffixed by <literal>ns</literal> (indicating nanoseconds),
<literal>us</literal> (indicating microseconds),
<literal>ms</literal> (indicating milliseconds), or
<literal>s</literal> (indicating seconds). The number to the left of the
square brackets shows the original measurement, adjusted to allow for any slews applied to
the local clock since. The number following the <literal>+/-</literal>
indicator shows the margin of error in the measurement. Positive offsets indicate that the
local clock is ahead of the source.
</para>
</listitem>
</varlistentry>
@@ -754,16 +745,13 @@ This shows the stratum of the source, as reported in its most
recently received
The <command>sourcestats</command> command displays information about the
drift rate and offset estimation process for each of the sources currently being examined
by <systemitem class="daemon">chronyd</systemitem>.
The optional argument <option>-v</option> can be specified, meaning verbose.
In this case, extra caption lines are shown as a reminder of the meanings of the columns.
- <screen>~]$ <command>chronyc sourcestats</command>
-
-
+ <screen>~]$ <command>chronyc sourcestats</command>
210 Number of sources = 1
Name/IP Address NP NR Span Frequency Freq Skew Offset Std Dev
===============================================================================
-abc.def.ghi
-</screen>
+abc.def.ghi 11 5 46m -0.001 0.045 1us
25us</screen>
-The columns are as follows:
+The columns are as follows:
<variablelist>
<varlistentry>
@@ -839,7 +827,7 @@ This is the estimated error bounds on Freq (again in parts per
million).
<title>Manually Adjusting the System Clock</title>
<para>
To update, or step, the system clock immediately, bypassing any adjustments in
progress by slewing the clock, issue the following commands as <systemitem
class="username">root</systemitem>:
- <screen>~]# <command>chronyc</command>
+ <screen>~]# <command>chronyc</command>
chrony> <command>password</command>
<replaceable>commandkey-password</replaceable>
200 OK
chrony> <command>makestep</command>
@@ -847,7 +835,7 @@ This is the estimated error bounds on Freq (again in parts per
million).
Where <replaceable>commandkey-password</replaceable> is the command key or
password stored in the key file.
</para>
<para>
- The real-time clock should not be manually adjusted if the
<command>rtcfile</command> directive is used as this would interfere with
<application>chrony</application>'s need to measure the rate at which the
real-time clock drifts if it was adjusted at random intervals.
+If the <command>rtcfile</command> directive is used, the real-time clock
should not be manually adjusted. Random adjustments would interfere with
<application>chrony</application>'s need to measure the rate at which the
real-time clock drifts.
</para>
<para>
If <application>chronyc</application> is used to configure the local
<application>chronyd</application>, the <option>-a</option> will
run the <command>authhash</command> and
<command>password</command> commands automatically. This means that the
interactive session illustrated above can be replaced by:
@@ -926,9 +914,9 @@ Where <systemitem
class="ipaddress">192.0.2.123</systemitem> is the address of t
<section id="sect-Using_chronyc_chronyc_to_control_chronyd">
<title>Using chronyc to Control chronyd</title>
<para>
- To make changes using the command line utility
<application>chronyc</application> in interactive mode, enter the following
command as <systemitem class="username">root</systemitem>:
- <screen>~]# <command>chronyc</command></screen>
- <application>chronyc</application> must run as <systemitem
class="username">root</systemitem> if some of the restricted commands
are to be used.
+ To make changes to the local instance of <systemitem
class="daemon">chronyd</systemitem> using the command line utility
<application>chronyc</application> in interactive mode, enter the following
command as <systemitem class="username">root</systemitem>:
+ <screen>~]# <command>chronyc
-a</command></screen>
+ <application>chronyc</application> must run as <systemitem
class="username">root</systemitem> if some of the restricted commands
are to be used. The <option>-a</option> option is for automatic authentication
using the local keys when configuring <systemitem
class="daemon">chronyd</systemitem> on the local system. See <xref
linkend="sect-Security_with_chronyc" /> for more information.
</para>
<para>
The <application>chronyc</application> command prompt will be
displayed as follows:</para>
@@ -936,32 +924,45 @@ Where <systemitem
class="ipaddress">192.0.2.123</systemitem> is the address of t
<para>
You can type <command>help</command> to list all of the commands.
</para>
-
+
<para>
The utility can also be invoked in non-interactive command mode if called
together with a command as follows:
- <screen>~]# <command>chronyc
<replaceable>command</replaceable></command></screen>
+ <synopsis><command>chronyc
<replaceable>command</replaceable></command></synopsis>
</para>
+ <note>
+ <para>
+ Changes made using <application>chronyc</application> are not
permanent, they will be lost after a <systemitem
class="daemon">chronyd</systemitem> restart. For permanent changes,
modify <filename>/etc/chrony.conf</filename>.
+ </para>
+ </note>
</section>
<section id="sect-Using_chronyc_for_remote_administration">
<title>Using chronyc for Remote Administration</title>
<para>
-To configure <application>chrony</application> to connect to a remote
instance of <systemitem class="daemon">chronyd</systemitem>, issue a
command as <systemitem class="username">root</systemitem> in the
following format:
-<screen>~]# <command>chronyc <option>-h</option>
<replaceable>hostname</replaceable></command></screen>
-Where <replaceable>hostname</replaceable> is the <systemitem
class="systemname">hostname</systemitem> of a system running
<systemitem class="daemon">chronyd</systemitem> to connect to in
order to allow remote administration from that host. The default is to connect to the
daemon on the localhost.
+To configure <application>chrony</application> to connect to a remote
instance of <systemitem class="daemon">chronyd</systemitem>, issue a
command in the following format:
+<screen>~]$ <command>chronyc <option>-h</option>
<replaceable>hostname</replaceable></command></screen>
+Where <replaceable>hostname</replaceable> is the host name to connect to. The
default is to connect to the local daemon.
</para>
<para>
-To configure <application>chrony</application> to connect to a remote
instance of <systemitem class="daemon">chronyd</systemitem> on a
non-default port, issue a command as <systemitem
class="username">root</systemitem> in the following format:
-<screen>~]# <command>chronyc <option>-h</option>
<replaceable>hostname</replaceable> <option>-p</option>
<replaceable>port</replaceable></command></screen>
-Where <replaceable>port</replaceable> is the port in use for controlling and
monitoring by the instance of <systemitem
class="daemon">chronyd</systemitem> to be connected to.
+To configure <application>chrony</application> to connect to a remote
instance of <systemitem class="daemon">chronyd</systemitem> on a
non-default port, issue a command in the following format:
+<screen>~]$ <command>chronyc <option>-h</option>
<replaceable>hostname</replaceable> <option>-p</option>
<replaceable>port</replaceable></command></screen>
+Where <replaceable>port</replaceable> is the port in use for controlling and
monitoring by the remote instance of <systemitem
class="daemon">chronyd</systemitem>.
</para>
<para>
-Note that commands issued at the <application>chrony</application> command
prompt are not persistent. Only commands in the configuration file are persistent.
+Note that commands issued at the <application>chronyc</application> command
prompt are not persistent. Only commands in the configuration file are persistent.
</para>
+ <para>
+The first command must be the <command>password</command> command at the
<application>chronyc</application> command prompt as follows:
+ <screen>chronyc> <command>password
<replaceable>password</replaceable></command>
+200 OK</screen>
+The password should not have any spaces.
+ </para>
+
<para>
-From the remote systems, the system administrator can issue commands after first using
the <command>password</command> command, preceded by the
<command>authhash</command> command if the key used a hash different from MD5,
at the <application>chronyc</application> command prompt as follows:
- <screen>chronyc> <command>password
secretpasswordwithnospaces</command>
+ If the password is not an MD5 hash, the hashed password must be preceded by the
<command>authhash</command> command as follows:
+ <screen>chronyc> <command>authhash SHA1</command>
+chronyc> <command>password
HEX:A6CFC50C9C93AB6E5A19754C246242FC5471BCDF</command>
200 OK</screen>
</para>