NTP services "authorization"?

Question

I have recently enabled NTP on a G5 Xserve with Mac OS X 10.4.8 Server. I have a firewall rule in place to allow this server to use time-c.timefreq.boardrdoc.gov through our corporate firewall as a time server from outside of our corporate campus. (This is the same time server that the Windows servers are using.) I have ten or so workstations and a couple of other Mac OS X servers pointing to the Xserve for network time for testing. When I first set this up, all the workstation seemed to be getting their network time just fine.
Unfortunately, at some point last week, two or three days after setting it up, the Xserve simply stopped putting out the NTP services even though it's still checked "on". On my workstation, for example, I would see a message similar to this in my System.log:
Apr 9 08:37:28 WORKSTATIONID ntpdate[97]: no server suitable for synchronization found
My computer did start to drift a bit off the corporate network time. I did a search here in the Discussions and found that, like some other folks, it seemed I had two ntpd processes running on the server. The second process was initiated by the /System/Library/StartupItems/NetworkTime/ folder. I put it in the Trash and restarted the server and for two days everything was fine. The Xserve was serving up network time for the clients. However, there are now five ntpd services running on the server and it is not serving up network time for the clients pointing to it.
It seems that the Xserve is demoting itself or de-authorizing itself as an NTP server if it doesn't get a "quick" reply from it's own time server (I would find a message in the System.log similar to the one above). If I change the network time option on the server to point to an internal time server and restart the server, it then becomes a valid time server for the clients who do catch-up to network time. But, if I leave the server pointing to that external time server (I only have access to that one through the firewall), after a couple of days the Xserve gives up and stops serving network time for the clients pointed to it.
Does anyone have some general time server advice for my Xserve? Or advice about keeping the service running? Or restarting the service without having to restart the server while I'm testing different options?
-Doug

Answer 1

I previously made a post on this issue and got some feedback. Needless to say after reading about others dealing with what is a neglected issue by apple I think I have a fix that works. I have setup my network this way for about 2 months now with no kerberos drift problems and all seems well in NTP land.
It is fairly simple just DON'T turn on the update time setting on the server. That means in both the SA under "Date & Time" and/or under System Preferences the "Set date & time automatically" should NOT be checked on the server! The only thing that should be on is in SA is the NTP check box. Now how this effects which time server you are syncing to i.e. time.apple.com etc. I'm not sure. I assume I'm using the last server listed as the entire in the "Set date & time automatically" box. I'm sure you could also edit the ntp.conf to set the correct server on your own as well.
Anyway since I have done this my Mac OS X Server time has stayed right on and all my clients point to my Mac OS X Server to get there time on the LAN. I have a JPG screenshot with VNC to the server and a client from my Laptop. In the screenshot the top most date & time is the client. The middle D&T is the Server and the bottom is my laptops. As you can see all 3 times are in sync. Both my laptop and I believe the server are both getting the ntp time from time.apple.com. The client is pointed to the server. On the Mac OS X server only 1 ntpd process is running as it should be. The only thing I can't seem to verify is the system.log on the server I don't see any ntpd entries but the time is right on. On the client log shows fine "13 Apr 16:18:43 ntpdate[3753]: step time server 192.168.1.2 offset -0.907011 sec"
I hope this helps.