I have a Snow Leopard Server box running on a private LAN with no Internet access. If you can avoid ever doing this, you should, as not having an Internet connection has brought us hours and hours of headaches.
Anyway, our most recent headache is that Open Directory users can't authenticate with Kerberos as the client computers' individual clocks drift from the server's clock. So the server also needs to be an NTP server.
I cannot figure out how to configure the server so that it will respond to client requests in a way that they trust. Here's what a query looks like from a client machine:
$ ntpdate -q 192.168.1.250 server 192.168.1.250, stratum 16, offset 8.010421, delay 0.02605 2 Sep 16:32:23 ntpdate: no server suitable for synchronization found
Here are my configuration files on the server:
server 192.168.1.250 fudge 127.0.0.1 stratum 8 refid NIST
restrict 127.0.0.1 restrict -6 ::1 restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap includefile /private/etc/ntp.conf
This is the configuration that I went with.
These 2 files are configured, and the NTP service is turned on in Server Admin under the General tab, and these 2 files are configured thusly:
server 127.127.1.1 fudge 127.127.1.1 stratum 8 refid NIST
restrict default notrust nomodify restrict 127.127.1.1 mask 255.255.0.0 nomodify restrict 192.168.1.0 mask 255.255.255.0 nomodify includefile /private/etc/ntp.conf
Then the clients are configured to point to this server by name. It works perfectly.