Dec 23

Configure NTP server (Chrony) on CentOS / RHEL7

Classic NTP is replaced by Chrony and  CentOS / RHEL7 is no longer use it, instead it’s default is Chrony.  The Chrony is a different implementation of the network time protocol (NTP) than the network time protocol daemon (ntpd)  that is able to synchronize the system clock faster and with better accuracy than ntpd. Here is little comparison between Chronyd and NTPd

 

Things chrony can do better than ntp:

  • chrony can perform usefully in an environment where access to the time reference is intermittent. ntp needs regular polling of the reference to work well.
  • chrony can usually synchronise the clock faster and with better time accuracy.
  • chrony quickly adapts to sudden changes in the rate of the clock (e.g. due to changes in the temperature of the crystal oscillator). ntp may need a long time to settle down again.
  • chrony can perform well even when the network is congested for longer periods of time.
  • chrony in the default configuration never steps the time to not upset other running programs. ntp can be configured to never step the time too, but in that case it has to use a different means of adjusting the clock (daemon loop instead of kernel discipline), which may have a negative effect on accuracy of the clock.
  • chrony can adjust the rate of the clock in a larger range, which allows it to operate even on machines with broken or unstable clock (e.g. in some virtual machines).
  • chrony is smaller, it uses less memory and it wakes up the CPU only when necessary, which is better for power saving.

 

Things chrony can do that ntp can’t:

  • chrony provides support for isolated networks whether the only method of time correction is manual entry (e.g. by the administrator looking at a clock). chrony can look at the errors corrected at different updates to work out the rate at which the computer gains or loses time, and use this estimate to trim the computer clock subsequently.
  • chrony provides support to work out the gain or loss rate of the real-time clock, i.e. the clock that maintains the time when the computer is turned off. It can use this data when the system boots to set the system time from a corrected version of the real-time clock. These real-time clock facilities are only available on Linux, so far.

 

Things ntp can do that chrony can’t:

  • ntp supports all operating modes from RFC 5905, including broadcast, multicast, and manycast server/client. However, the broadcast and multicast modes are inherently less accurate and less secure (even with authentication) than the ordinary server/client mode and should generally be avoided.
  • ntp supports the Autokey protocol (RFC 5906) to authenticate servers with public-key cryptography. Note that the protocol has been shown to be insecure and it will be probably replaced with an implementation of the Network Time Security (NTS) specification.
  • ntp has been ported to more operating systems.
  • ntp includes a large number of reference clock drivers. chrony relies on other programs (e.g. gpsd) to access the timing data via the SHM or SOCK driver.

 

So let’s look at how to Configure NTP server (Chrony) on CentOS / RHEL7

1) Install Chrony

 

2) Change servers for synchronization

this step is optional, you can skip if do not want to customize NTP servers

 

then commented out default servers and add your own NTP servers .

 

3) Disable NTP server and start chronyd

 

4) Verify NTP sources

chronyc sources -V

chronyc sources -V

5) Verify NTP time synchronization

 

Have a Nice day 😀

Sep 03

Redirect non-www requests to www using AWS Route 53

Many web masters prefer to redirect non-www request to www. There are lots of different approaches for that and most famous one is using 301 redirection on the web server to handle this redirect part. Then what happen is, server must need to put extra processing for this redirection request.  If the server have to handle thousands of request, it would not be efficient method at all. If your domain NS (name servers) is hosted with AWS Route53, you can use their own proprietary alias “record” to solve this problem. The traditional DNS, you cannot do it at all and you have to used 301 redirect instead as I mentioned earlier. Other advantage of the redirection is SEO improvement as some search engine recognize www and non-www as two different web sites and this cause to penalize the domain considering website has duplicate content.
Here I’m going to demonstrate how to redirect non-www requests to www using AWS Route 53. So let’s look at.

1) create S3 bucket for naked domain

ex:- domain.com

2) Configure non-www request to www on AWS S3

i) Highlight previously created bucket

ii) From “Properties” expand “Static Website Hosting”

iii) Select “Redirect all request to another host name”

non-www to www redirect using AWS s3

3) Configure AWS Route53

i) select your domain from “hosted zones”

ii) point www to your server ip or ELB (Elastic Load Balancer) by creating new records

you may click on “Create Record Set” button

iii) select your naked domain record from the list

list may contains other records such MX, TXT as well, but you must select just your domain.
ex:- example.com.

when you select it, you can set following parameters from right hand side panel.

select Type as “A – IPV4 address” from drop down
select Alia as “YES
select Alias Target as previously created S3 bucket from drop down.

AWS Route53 Alias records

 

that’s how to do that. Comment here If you are having any question at all !    🙂

Aug 06

Adding users to Linux EC2 instance and give SSH access

The default AWS Linux EC2 instances come up with one user account such as centos, ubuntu etc  with sudo privileges.
However in complex environment you may be needed add more users to EC2 instance with different privileges. Here we are going to discuss
how to adding users to Linux EC2 instance and give SSH access to the accounts. At the end of the tutorial we give you a trick to make the user
into sudo user.

1) Create new user account

2) Switch into new user account

3) Generate new private key from AWS Account.

Log into AWS Account, then Goto “EC2” , next select “Key Pairs” under “NETWORK & SECURITY” which can find from left hand side.

EC2 key pair generator

4) How to obtain public key ??

i) Copy *.pem file into Linux machine.

ii) Run following command

This will will be asked to enter private key, then enter previously copied *.pem file

iii) Copy output file

example output :-

5) Create a .ssh directory for the authorized_keys file.

you may need to switch into “newuser”

6) Change the file permissions of the .ssh directory

7) Copy public key into authorized_keys and set permission to file

8) Log into server with .pem file

[root ~]$ssh -i your_private_key.pem newuser@remote.server.ip.address

ex :- ssh -i user.pem newuser@192.168.5.20

9) how to make new user into root or sudo user

this will require password, so we are going to disable this

log into remote server
type
#visudo

add following

Reference :- http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/managing-users.html

Older posts «

» Newer posts

Fetch more items