Product SiteDocumentation Site

8.9. 其他配置：时间同步、日志记录、共享访问…

本节列出的细目对希望精通 GNU/Linux 系统配置极有帮助。这里只列出简要的内容，详情仍需参阅文档。

8.9.1. 时区

基础知识 符号链接

符号链接是一种指向另一个文件的指针。使用时，被指向的文件就被打开。移除链接不会删除指向的文件。同样的，没有自身的授权，而是使用目标的授权。最后，可以用于任何类型的文件：文件夹、特殊文件 (socket、命名管道、设备文件等)、甚至另一个符号链接。
ln -s target link-name 命令添加一个符号链接，命名为 link-name，指向 target。
若目标不存在，则链接算是 “破损” 且其使用返回错误消息指示目标文件不存在。若链接指向另一个链接，该链接又指向其前一个链接，则该链接的 “链” 形成 “循环”。在这种情况下，使用循环内的任一链接也会得到特定的错误 (“过多层的符号链接”)；经过若干循环后内核会放弃它。
The timezone, configured during initial installation, is a configuration item for the tzdata package. To modify it, use the dpkg-reconfigure tzdata command, which allows you to choose the timezone to be used in an interactive manner. Its configuration is stored in the /etc/timezone file. Additionally, /etc/localtime becomes a symbolic link to the corresponding file in the /usr/share/zoneinfo; the file that contains the rules governing the dates where daylight saving time (DST) is active, for countries that use it.
暂时变更时区，可使用 TZ 环境变量，它的优先次序在缺省的配置档之前： 
$ date
Mon Jul 29 07:53:36 PM EDT 2024
$ TZ="Pacific/Honolulu" date
Mon Jul 29 01:54:00 PM HST 2024

说明 系统时钟，硬件时钟

电脑内有两个时间来源。主板有个硬件时钟，称为 “CMOS 时钟”。这个时钟不准，访问的速度慢。操作系统内核有自己的系统时钟，以自己的方式 (可能由时间服务器协助，见 第 8.9.2 节 “时间同步”) 保持时间的正确。此系统时钟较为准确，尤其是不需经由硬件变量就能近用。然而，系统时钟只存在于内存，开机就归零，不像 CMOS 时间钟，有电池支持，不受重新开机影响，关机时仍能 “存活”。因此，开机时，由 CMOS 时钟设置系统时钟，关机时更新 CMOS 时钟 (若被不当调整就能修正它)。
实务上有个问题，因为 CMOS 时钟只是个计数器，未含时区信息。有几个方式选择其解释方式：系统以世界标准时间 (UTC，旧称 GMT)，或当地时间看待。虽然可以简单切换，但却颇为复杂：它的偏移值不是常数。系统无法判断偏移值的正确性，尤其在时区交接。总是在世界标准时间与时区信息之间重组本地时间，强烈推荐使用 CMOS 时间为世界标准时间。
Unfortunately, some Windows systems in their default configuration ignore this recommendation; they keep the CMOS clock on local time, applying time changes when booting the computer by trying to guess during time changes if the change has already been applied or not. This works relatively well, as long as the system has only Windows running on it. But when a computer has several systems (whether it be a “dual-boot” configuration or running other systems via virtual machine), chaos ensues, with no means to determine if the time is correct. If you absolutely must retain Windows on a computer, you should either configure it to keep the CMOS clock as UTC (setting the registry key HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation\RealTimeIsUniversal to “1” as a DWORD), or use hwclock --localtime --set on the Debian system to set the hardware clock and mark it as tracking the local time (and make sure to manually check your clock in spring and autumn).

8.9.2. 时间同步

时间同步，在单机时代是多余，但在网络时代却很重要。用户无权修改日期与时间，所以需要精准的时间以免混乱。尤有甚者，网络上的电脑时间同步后，有助于安排社区工作者透过全球网络互联。受到攻击时，容易依序恢复原来的运作。由多部机器收集来的统计数据，必须有同步的时间，才能发挥作用。

基础知识 NTP

网络时间协议 (Network Time Protocol, NTP) 可以让机器间相当精准的同步，甚至把网络延迟及其他偏移值列入考量。
互联网上很多 NTP 服务器可用，受欢迎的其工作量可能负荷过重。所以推荐使用 pool.ntp.org NTP 服务器，它是一组公开的 NTP 服务器。也可使用针对特定地区的次群组服务器，如 us.pool.ntp.org 系供美国使用、ca.pool.ntp.org 供加拿大使用。
然而，管理大型网络时，还推荐安装与公共服务器同步的自己 NTP 服务器。同个网络上自己的机器，就能使用内部的 NTP 服务器不必增加外部公共服务器的负担。以自己的时钟增加网络内机器的同质化，同步截取与共用资源，使用共同的网络交换时间。

8.9.2.1. 工作站

Since work stations are regularly rebooted (even if only to save energy), synchronizing them by NTP at boot is enough. To do so, simply install either the ntpdate or the systemd-timesyncd package. You can then change the NTP server used if needed by modifying the /etc/default/ntpdate or the /etc/systemd/timesyncd.conf file.

8.9.2.2. 服务器

服务器很少重启，系统时间必须绝对精准。为了永久维持时间的正确性，必须安装由 ntp 软件包提供的 NPT 服务器。缺省的配置方式系与 pool.ntp.org 同步，且回应本地网络的请求。可以编辑 /etc/ntp.conf 文件改变原来的配置，NTP 服务器依照该文件的内容而变更。若有多个服务器，最好有一个本地时间服务器与公共的服务器同步，并做为本地网络其他服务器的同步的依据。

进一步 GPS 模块与其他时间来源

如果网络对时间同步极为敏感，最好在服务器安装 GPS 模块 (从GPS卫星获取时间) 或 DCF-77 模块 (与位于德国法兰克福的原子钟同步时间 )。在这种情况下，NTP 服务器的配置就有点复杂，必须参照文档办理。

8.9.3. 轮转日志文件

日志文件的增长速度很快，需要存档。最常的做法是循环存档：只保留最新的 X 部分。logrotate 是负责循环的程序，根据 /etc/logrotate.conf 文件内的配置，把日志文件保存在 /etc/logrotate.d/ 文件夹内。管理者可以修改该文件，修改 Debian 缺省的循环政策。logrotate(1) 手册页面描述该配置可用的选项。可以在循环的过程中，增加存档的文件数，或把文件移至指定的文件夹而不是删除它们。也可以电子邮件方式邮寄到别的地方。
logrotate 程序每日运行 cron 调度的要求 (详情见 第 9.7 节 “使用 cron 和 atd运行计划任务”)。

8.9.4. 共享管理员权限

数个管理者共同在同个服务器工作。共用同一个root用户密码不是好主意，匿名引发的误用很麻烦。解决方案是使用 sudo 程序，允许用户对特定命令拥有专门的权力。在多数情况下，sudo 允许受信任的用户以root的权限运行命令。用户只需运行 sudo command 并以个人的密码通过认证。
When installed, the sudo package gives full root rights to members of the sudo Unix group. To delegate other rights, the administrator can use the visudo command, which allows them to modify the /etc/sudoers configuration file (here again, this will invoke the vi editor, or any other editor indicated in the EDITOR environment variable). Alternatively, they might put rules in small files in /etc/sudoers.d/ with the file permissions 0440 as long as this directory is included by /etc/sudoers via @includedir /etc/sudoers.d, which is the default for Debian. Adding a line with username ALL=(ALL) ALL allows the user in question to execute any command as root. The permissions and syntax of all files can be verified with the visudo -c command.
More sophisticated configurations allow authorization of only specific commands to specific users. All the details of the various possibilities are given in the sudoers(5) manual page.

8.9.5. 挂载点清单

基础知识 挂载与卸载

In a Unix-like system such as Debian, files are organized in a single tree-like hierarchy of directories. The / directory is called the “root directory”; all additional directories are sub-directories within this root. “Mounting” is the action of including the content of a peripheral device (often a hard drive) into the system's general file tree. As a consequence, if you use a separate hard drive to store users' personal data, this disk will have to be “mounted” in the /home/ directory (during installation you already made relevant choices, see 第 4.2.13.1 节 “引导分区”). The root filesystem is always mounted at boot by the kernel; other devices are often mounted later during the startup sequence or manually with the mount command.
有些移动式设备在链接时系统自动挂载，尤其在 GNOME、Plasma 或其他图形桌面环境。有些情况就需要用户手动挂载。同样的，也需要卸载 (从文件树移除)。标准的用户权限不允许运行挂载 mount 与卸载 umount 命令。只有管理者才能够设置 /etc/fstab 文件内的 user 选项，授权用户运行该等命令 (独立于每个挂载点)。
The mount command can be used without arguments to list all mounted filesystems (as found in /proc/mounts as well); you can execute findmnt --fstab to show only the filesystems from /etc/fstab. The following parameters are required to mount or unmount a device - for the complete list, please refer to the corresponding man pages, mount(8) and umount(8). For simple cases, the syntax is simple too: for example, to mount the /dev/sdc1 partition, which has an ext3 filesystem, into the /mnt/tmp/ directory, you would simply run mount -t ext3 /dev/sdc1 /mnt/tmp/. In fact, in most cases it is even not necessary to define the filesystem anymore because it is detected automatically.
The /etc/fstab file gives a list of all possible mounts that happen either automatically on boot or manually for removable storage devices. Each mount point is described by a line with several space-separated fields:
  • file system: this indicates where the filesystem to be mounted can be found, it can be a local device (hard drive partition, CD-ROM) or a remote filesystem (such as NFS or even SSHFS).
    This field is frequently replaced with the unique ID of the filesystem (which you can determine with blkid device) prefixed with UUID=. This guards against a change in the name of the device in the event of addition or removal of disks, or if disks are detected in a different order. 第 8.8.1 节 “辨识磁盘” covers this topic in more detail.
  • mount point：这是把设备、远程系统或分区挂载到本地文件系统的位置。
  • type：这个字段定义挂载设备使用的文件系统。ext4、ext3、vfat、ntfs、btrfs、xfs 等。

    基础知识 NFS，网络文件系统

    NFS 是一种 Linux 环境下的网络文件系统，把远程的文件以透明方式纳入本地的文件系统内。
    A complete list of known filesystems is available in the mount(8) manual page. The swap special value is for swap partitions; the auto special value tells the mount program to automatically detect the filesystem (which is especially useful for disk readers and USB keys, since each one might have a different filesystem);
  • options：依文件系统的不同，而有多种选项，详情见 mount 手册页面。最常用的是
    • rw 或 ro，表示该设备挂载后可以读/写，或只有读取的权限。
    • noauto 开机时关闭自动挂载。
    • nofail 允许在启动时处理设备，即使该设备不存在。确认启动时，该外置磁盘机可能未插入，因为 systemd 将确认所有挂载点在启动完成前必须自动挂载。可将此与 x-systemd.device-timeout=5s 并用，告诉 systemd 不必等 5 秒以上的时间，直接进入下个作业阶段 (见 systemd.mount(5))。
    • user 授权所有的用户均可挂载此文件系统 (若无此选项，则只有根用户才有此权限)。
    • defaults 表示缺省的选项群组为：rw、suid、dev、exec、auto、nouser 与 async，使用了 defaults 之后，还可以用 nosuid 命令、nodev 及其他类似的命令，中止 suid、dev 等作用。加入 user 选项可再启用它，因为 defaults 包括 nouser。
  • dump: this field is almost always set to 0 and kind of a relic. When it is greater then zero, it tells the dump tool that the partition contains data that is to be backed up frequently. The tool supports Ext2/3/4 filesystems only and will use the value here when run via dump -W or dump -w to determine which partitions need to be backed up. Consider the examples in /usr/share/doc/dump/examples/ if you want to use this feature. But there are better alternatives to backup a filesystem, like fsarchiver.
  • pass：最后一个字段告知系统在启动时，或其他时机，检查文件系统的完整性。若设为 0，则不检查。根文件系统的值为 1，其他固定文件系统的值为 2。

例 8.5. 范例 /etc/fstab 文件

# /etc/fstab: static file system information.
#
# Use 'blkid' to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).
#
# systemd generates mount units based on this file, see systemd.mount(5).
# Please run 'systemctl daemon-reload' after making changes here.
#
# <file system>                           <mount point>   <type>      <options>         <dump>  <pass>
# / was on /dev/sda1 during installation
UUID=7a250fb8-c16d-4a4e-9808-ec08ae92b6c6 /               ext4        errors=remount-ro 0       1
# swap was on /dev/sda5 during installation
UUID=13f367ae-dbaf-40ed-85c0-4072a2ebe426 none            swap        sw                0       0
/dev/sr0                                  /media/cdrom0   udf,iso9660 user,noauto       0       0
/dev/fd0                                  /media/floppy   auto        rw,user,noauto    0       0
arrakis:/shared                           /shared         nfs         defaults          0       0
The last entry in the example corresponds to a network filesystem (NFS): the /shared/ directory on the arrakis server is mounted at /shared/ on the local machine.
The format of the /etc/fstab file is documented in the fstab(5) manual page.

进一步 自动挂载

systemd is able to manage automount points: those are filesystems that are mounted on-demand when a user attempts to access their target mount points. It can also unmount these filesystems when no process is accessing them any longer.
Like most concepts in systemd, automount points are managed with dedicated units, using the .automount suffix. See systemd.automount(5) for their precise syntax.
Other auto-mounting utilities exist, such as automount in the autofs package.
Note also that GNOME, Plasma, and other graphical desktop environments work together with udisks2, and can automatically mount removable media when they are connected.

8.9.6. locate 与 updatedb

The locate command can find the location of a file when you only know part of the name. It sends a result almost instantaneously, since it consults a database that stores the location of all the files on the system; this database is updated daily by the updatedb command. There are multiple implementations of the locate command and Debian picked mlocate for its standard system. If you want to consider an alternative, you can try plocate which provides the same command line options and can be considered a drop-in replacement.
locate is smart enough to only return files which are accessible to the user running the command even though it uses a database that knows about all files on the system (since its updatedb implementation runs with root rights). For extra safety, the administrator can use PRUNEDPATHS in /etc/updatedb.conf to exclude some directories from being indexed.