Subject: where does time come from?
To: netbsd-help <netbsd-help@netbsd.org>
From: James K. Lowden <jklowden@schemamania.org>
List: netbsd-help
Date: 09/24/2002 22:57:22
Hi all, 

AFAICT, my ancient 1.4.2 i386 firewall-cum-mailhub went south at 6:04 AM
today.  That's the last mail I received, the last message from named, the
end of /var/log/messages.  I don't find evidence anywhere that anyone else
logged in.  When I looked at the console, it was in the kernel debugger. 
OK, I don't know, 100 days uptime or something, I'm not complaining.  

I didn't realize anything was wrong until 13 hours later, at ~19:00.  

What puzzles me is that on restarting, the system still thought it was
6:04 (or so).  I killed ntpd, ran date(1) to approximate the time,
ntpdate(8) to fix it, and restarted ntpd.  

Is the TOD clock initialized from time information on the root filesystem,
or is it possible my system was compromised and tampered with?  

Much obliged.  

--jkl