The Timekeeping issue is a very large issue with lots of things to consider for a JumpBox since we support over 5 platforms with the same image. We have lots of experience with dealing with this and unfortunately, no single solution will completely satisfy every customer or every platform. Our users experiences have varied dramatically even using the same exact virtualization platforms and host OSes.

Since you are a VMWare user you may want to read this if you really want to know VMWare's story: http://www.vmware.com/pdf/vmware_timekeeping.pdf

I would suggest for you, to either use NTPD or set up a cron job that runs ntpdate periodically. The reason I don't necessarily suggest running is summarized in the above document (and other NTP in virtualization related discussions on the net):

Because of the way that timer devices in a virtual machine may fall behind real time and then 
catch up later, standard clock synchronization software such as the Windows Time Service 
(W32Time) or the Network Time Protocol (NTP) does not work well when run in a virtual 
machine. If the virtual machine is aware that it is behind real time and is already delivering timer 
interrupts at a higher rate so that the guest clock can catch up to real time, running non-VMware 
clock synchronization software inside the guest at the same time may also advance the virtual 
machine's clock, causing it to end up ahead of real time. Also, the widely varying timer interrupt 
rate of a virtual machine, as compared with real time, is likely to confuse algorithms in non- 
VMware clock synchronization software that attempt to detect the machine's exact timer 
oscillator input frequency and correct for small variations from the specified frequency. 

Using NTPD in your case would probably be a dramatic improvement since you are drifting so much. I have been testing ntpd in our lab here and it appears to work for me in VMWare but my clocks aren't drifting nearly as much as yours when I leave them alone (5-10min/month on Linux host using VMWare server). It probably doesn't result in native ntp accuracy but its probably good enough for most time sensitive uses (including kerberos). If you are uneasy about inefficiencies or potential problems do an hourly (give or take) cronjob that runs ntpdate.

I have been uncertain which method to choose for production JumpBoxes so far, so any user feedback is greatly appreciated.

Austin