Apparently ntpdate is deprecated. Alan's ntp patch looks reasonable to me. I'm still testing it. Only thing I'd change is to replace down|vpn-down) code with a call to ntp_servers_setup_remove(). Michael, can you move this bug to the ntp package so that this patch gets in?