8.9. 其他組態：時間同步、記錄、共享近用…

本節列出的細目對希望精通 GNU/Linux 系統組態極有幫助。這裡祗列出簡要的內容，詳情仍需參閱文件。

8.9.1. 時區

基本符號連結

符號連結是一種指向另個檔案的指標。近用時，被指向的檔案就被打開。移除連結不會刪除指向的檔案。同樣的，沒有自的授權，而是使用目標本身的授權。最後，可以用於任何類型的檔案：資料夾、特殊檔案 (網路插座、具名管道、設備檔案等)、甚至另個符號連結。

ln -s target link-name 命令新增一個符號連結，命名為 link-name，指向 target。

若目標不存在，則連結算是 “破損” 且其近用送回錯誤訊息指示目標檔案不存在。若連結指向另個連結，該連結又指向其前任連結，則該等連結的 “鏈” 形成 “循環”。在這種情況下，近用循環內的任一連結也會得到特定的錯誤 (“過多層的符號連結”)；經過若干循環後核心放棄它。

The timezone, configured during initial installation, is a configuration item for the tzdata package. To modify it, use the dpkg-reconfigure tzdata command, which allows you to choose the timezone to be used in an interactive manner. Its configuration is stored in the /etc/timezone file. Additionally, /etc/localtime becomes a symbolic link to the corresponding file in the /usr/share/zoneinfo; the file that contains the rules governing the dates where daylight saving time (DST) is active, for countries that use it.

暫時變更時區，可使用 TZ 環境變數，它的優先次序在預設的組態檔之前：

$ date
Thu Sep  2 22:29:48 CEST 2021
$ TZ="Pacific/Honolulu" date
Thu 02 Sep 2021 10:31:01 AM HST

說明系統時鐘，硬體時鐘

電腦內有兩個時間來源。主機板有個硬體時鐘，稱為 “CMOS 時鐘”。這個時鐘不準，近用的速度慢。作業系統核心有自己的系統時鐘，以自己的方式 (可能由時間伺服器協助，見節 8.9.2, “時間同步”) 保持時間的正確。此系統時鐘較為準確，尤其是不需經由硬體變數就能近用。然而，系統時鐘祗存在於記憶體，開機就歸零，不像 CMOS 時間鐘，有電池支援，不受重新開機或暫停下仍能 “存活”。因此，開機時，由 CMOS 時鐘設定系統時鐘，關機時更新 CMOS 時鐘 (若被不當調整就能修正它)。

實務上有個問題，因為 CMOS 時鐘祗是個計數器，未含時區資訊。有幾個方式選擇其解釋方式：系統以世界標準時間 (UTC，舊稱 GMT)，或當地時間看待。雖然可以簡單切換，但卻頗為複雜：它的偏移值不是常數。系統無法判斷偏移值的正確性，尤其在時區交接。總是在世界標準時間與時區資訊之間重組在地時間，建議使用 CMOS 時間為世界標準時間。

Unfortunately, some Windows systems in their default configuration ignore this recommendation; they keep the CMOS clock on local time, applying time changes when booting the computer by trying to guess during time changes if the change has already been applied or not. This works relatively well, as long as the system has only Windows running on it. But when a computer has several systems (whether it be a “dual-boot” configuration or running other systems via virtual machine), chaos ensues, with no means to determine if the time is correct. If you absolutely must retain Windows on a computer, you should either configure it to keep the CMOS clock as UTC (setting the registry key HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation\RealTimeIsUniversal to “1” as a DWORD), or use hwclock --localtime --set on the Debian system to set the hardware clock and mark it as tracking the local time (and make sure to manually check your clock in spring and autumn).

8.9.2. 時間同步

時間同步，在單機時代是多餘，但在網路時代卻很重要。使用者無權修改日期與時間，所以需要精準的時間以免混亂。尤有甚者，網路上的電腦時間同步後，有助於安排社群工作者透過網路全球串聯。受到攻擊時，容易依序恢復原來的運作。由多部機器收集來的統計資料，必須有同步的時間，才能發揮作用。

基本 NTP

網路時間協定 (Network Time Protocol, NTP) 可以讓機器間相當精準的同步，甚至把網路延遲及其他偏移值列入考量。

網際網路上很多 NTP 伺服器可用，受歡迎的其工作量可能負荷過重。所以建議使用 pool.ntp.org NTP 伺服器，它是一組公開的 NTP 伺服器。也可使用針對特定地區的次群組伺服器，如 us.pool.ntp.org 係供美國使用、ca.pool.ntp.org 供加拿大使用。

然而，管理大型網路時，還是應安裝與公共伺服器同步的自己 NTP 伺服器。同個網路上自己的機器，就能使用內部的 NTP 伺服器不必增加外部公共伺服器的負擔。以自己的時鐘增加網路內機器的同質化，同步擷取與共用資源，使用共同的網路交換時間。

8.9.2.1. 給工作站

工作經常需要重新開機 (雖然祗是節省能源)，開機時以 NTP 同步就夠了。安裝 ntpdate 套件就可以。需要更換 NTP 伺服器時，再修改 /etc/default/ntpdate 檔案即可。

8.9.2.2. 供伺服器

伺服器很少重開機，系統時間必須絕對精準。為了永久維持時間的正確性，必須安裝由 ntp 套件提供的 NPT 伺服器。預設的組態方式係與 pool.ntp.org 同步，且回應在地網路的請求。可以編輯 /etc/ntp.conf 檔案改變原來的組態，NTP 伺服器依照該檔案的內容而變更。若有多個伺服器，最好有一個在地時間伺服器與公共的伺服器同步，並做為在地網路其他伺服器的同步的依據。

8.9.3. 輪轉日誌檔

日誌檔成長的速度很快，需要典藏它。最常的做法是循環典藏：祗保留最新的 X 部份。logrotate 是負責循環的程式，根據 /etc/logrotate.conf 檔案內的組態，把日誌檔儲存在 /etc/logrotate.d/ 資料夾內。管理者可以修改該等檔案，修改 Debian 預設的循環政策。logrotate(1) 手冊頁面描述該組態可用的選項。可以在循環的過程中，增加典藏的檔案數，或把檔案移至指定的資料夾而不是刪除它們。也可以電子郵件方式寄到別的地方。

logrotate 程式每日執行 cron 排程的要求 (詳情見節 9.7, “以 cron 和 atd 使用排定的工作”)。

8.9.4. 共享管理員權限

數個管理者共同在同個伺服器工作。共用同個根使用者密碼不是好主意，匿名引發的誤用很麻煩。解決方案是使用 sudo 程式，允許使用者對特定命令擁有專門的權力。在多數情況下，sudo 允許受信任的使用者以根的權限執行命令。使用者祗需執行 sudo command 並以個人的密碼通過認證。

When installed, the sudo package gives full root rights to members of the sudo Unix group. To delegate other rights, the administrator can use the visudo command, which allows them to modify the /etc/sudoers configuration file (here again, this will invoke the vi editor, or any other editor indicated in the EDITOR environment variable). Alternatively they might put rules in small files in /etc/sudoers.d/ as long as this directory is included by /etc/sudoers via @includedir /etc/sudoers.d, which is the default for Debian. Adding a line with username ALL=(ALL) ALL allows the user in question to execute any command as root.

More sophisticated configurations allow authorization of only specific commands to specific users. All the details of the various possibilities are given in the sudoers(5) manual page.

8.9.5. 掛載點清單

基本掛載與卸載

In a Unix-like system such as Debian, files are organized in a single tree-like hierarchy of directories. The / directory is called the “root directory”; all additional directories are sub-directories within this root. “Mounting” is the action of including the content of a peripheral device (often a hard drive) into the system's general file tree. As a consequence, if you use a separate hard drive to store users' personal data, this disk will have to be “mounted” in the /home/ directory (during installation you already made relevant choices, see 節 4.2.13.1, “引導分割”) The root filesystem is always mounted at boot by the kernel; other devices are often mounted later during the startup sequence or manually with the mount command.

Some removable devices are automatically mounted when connected, especially when using the GNOME, Plasma or other graphical desktop environments. Others have to be mounted manually by the user. Likewise, they must be unmounted (removed from the file tree). Normal users do not usually have permission to execute the mount and umount commands. The administrator can, however, authorize these operations (independently for each mount point) by including the user option in the /etc/fstab file.

The mount command can be used without arguments to list all mounted filesystems (as found in /proc/mounts as well); you can execute findmnt --fstab to show only the filesystems from /etc/fstab. The following parameters are required to mount or unmount a device - for the complete list, please refer to the corresponding man pages, mount(8) and umount(8). For simple cases, the syntax is simple too: for example, to mount the /dev/sdc1 partition, which has an ext3 filesystem, into the /mnt/tmp/ directory, you would simply run mount -t ext3 /dev/sdc1 /mnt/tmp/.

The /etc/fstab file gives a list of all possible mounts that happen either automatically on boot or manually for removable storage devices. Each mount point is described by a line with several space-separated fields:

file system: this indicates where the filesystem to be mounted can be found, it can be a local device (hard drive partition, CD-ROM) or a remote filesystem (such as NFS or even SSHFS).
This field is frequently replaced with the unique ID of the filesystem (which you can determine with blkid device) prefixed with UUID=. This guards against a change in the name of the device in the event of addition or removal of disks, or if disks are detected in a different order. 節 8.8.1, “辨識磁碟” covers this topic in more detail.
掛載點：這是把設備、遠端系統，或分區掛載於在地檔案系統的位置。
類型：這個欄位定義掛載設備使用的檔案系統。ext4、ext3、vfat、ntfs、btrfs、xfs 等。
基本 NFS，網路檔案系統
NFS 是一種 Linux 環境下的網路檔案系統，把遠端的檔案以透明方式納入在地的檔案系統內。
A complete list of known filesystems is available in the mount(8) manual page. The swap special value is for swap partitions; the auto special value tells the mount program to automatically detect the filesystem (which is especially useful for disk readers and USB keys, since each one might have a different filesystem);
選項：依檔案系統的不同，而有多種選項，詳情見 mount 手冊頁面。最常用的是
- rw 或 ro，表示該設備掛載後可以讀/寫，或祗有讀取的權限。
- noauto 開機時關閉自動掛載。
- nofail 允許在啟動時處理設備，即使該設備不存在。確認啟動時，該外接磁碟機可能未插入，因為 systemd 將確認所有掛載點在啟動完成前必須自動掛載。可將此與 x-systemd.device-timeout=5s 併用，告訴 systemd 不必等 5 秒以上的時間，直接進入下個作業階段 (見 systemd.mount(5))。
- user 授權所有的使用者均可掛載此檔案系統 (若無此選項，則祗有根使用者才有此權限)。
- defaults 表示預設的選項群組為：rw、suid、dev、exec、auto、nouser 與 async，使用了 defaults 之後，還可以用 nosuid 命令、nodev 及其他類似的命令，中止 suid、dev 等作用。加入 user 選項可再啟用它，因為 defaults 包括 nouser。
dump: this field is almost always set to 0 and kind of a relic. When it is greater then zero, it tells the dump tool that the partition contains data that is to be backed up frequently. The tool supports Ext2/3/4 filesystems only and will use the value here when run via dump -W or dump -w to determine which partitions need to be backed up. Consider the examples in /usr/share/doc/dump/examples/ if you want to use this feature. But there are better alternatives to backup a filesystem, like fsarchiver.
pass: this last field indicates whether the integrity of the filesystem should be checked on boot, and in which order this check should be executed. If it is 0, no check is conducted. The root filesystem should have the value 1, while other permanent filesystems get the value 2.

範例 8.5. 範例 /etc/fstab 檔案

# /etc/fstab: static file system information.
#
# Use 'blkid' to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).
#
# systemd generates mount units based on this file, see systemd.mount(5).
# Please run 'systemctl daemon-reload' after making changes here.
#
# <file system>                           <mount point>   <type>      <options>         <dump>  <pass>
# / was on /dev/sda1 during installation
UUID=7a250fb8-c16d-4a4e-9808-ec08ae92b6c6 /               ext4        errors=remount-ro 0       1
# swap was on /dev/sda5 during installation
UUID=13f367ae-dbaf-40ed-85c0-4072a2ebe426 none            swap        sw                0       0
/dev/sr0                                  /media/cdrom0   udf,iso9660 user,noauto       0       0
/dev/fd0                                  /media/floppy   auto        rw,user,noauto    0       0
arrakis:/shared                           /shared         nfs         defaults          0       0

The last entry in the example corresponds to a network filesystem (NFS): the /shared/ directory on the arrakis server is mounted at /shared/ on the local machine.

The format of the /etc/fstab file is documented in the fstab(5) manual page.

下一步 自動掛載

systemd is able to manage automount points: those are filesystems that are mounted on-demand when a user attempts to access their target mount points. It can also unmount these filesystems when no process is accessing them any longer.

Like most concepts in systemd, automount points are managed with dedicated units, using the .automount suffix. See systemd.automount(5) for their precise syntax.

Other auto-mounting utilities exist, such as automount in the autofs package or amd in the am-utils package.

Note also that GNOME, Plasma, and other graphical desktop environments work together with udisks2, and can automatically mount removable media when they are connected.

8.9.6. `locate` 與 `updatedb`

The locate command can find the location of a file when you only know part of the name. It sends a result almost instantaneously, since it consults a database that stores the location of all the files on the system; this database is updated daily by the updatedb command. There are multiple implementations of the locate command and Debian picked mlocate for its standard system. If you want to consider an alternative, you can try plocate which provides the same command line options and can be considered a drop-in replacement.

locate is smart enough to only return files which are accessible to the user running the command even though it uses a database that knows about all files on the system (since its updatedb implementation runs with root rights). For extra safety, the administrator can use PRUNEDPATHS in /etc/updatedb.conf to exclude some directories from being indexed.