1.\" $NetBSD: afterboot.8,v 1.13 2004/07/22 03:44:12 atatat Exp $ 2.\" 3.\" Copyright (c) 2002-2003 The NetBSD Foundation, Inc. 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. All advertising materials mentioning features or use of this software 15.\" must display the following acknowledgement: 16.\" This product includes software developed by the NetBSD 17.\" Foundation, Inc. and its contributors. 18.\" 4. Neither the name of The NetBSD Foundation nor the names of its 19.\" contributors may be used to endorse or promote products derived 20.\" from this software without specific prior written permission. 21.\" 22.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 23.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 24.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 25.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 26.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 27.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 28.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 29.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 30.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 31.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 32.\" POSSIBILITY OF SUCH DAMAGE. 33.\" 34.\" $OpenBSD: afterboot.8,v 1.72 2002/02/22 02:02:33 miod Exp $ 35.\" 36.\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu 37.\" Adapted to NetBSD by Julio Merino -- 2002-05-10, jmmv@hispabsd.org 38.\" 39.Dd July 21, 2004 40.Dt AFTERBOOT 8 41.Os 42.Sh NAME 43.Nm afterboot 44.Nd things to check after the first complete boot 45.Sh DESCRIPTION 46.Ss Starting Out 47This document attempts to list items for the system administrator 48to check and set up after the installation and first complete boot of the 49system. 50The idea is to create a list of items that can be checked off so that you have 51a warm fuzzy feeling that something obvious has not been missed. 52A basic knowledge of 53.Ux 54is assumed. 55.Pp 56Complete instructions for correcting and fixing items is not provided. 57There are manual pages and other methodologies available for doing that. 58For example, to view the man page for the 59.Xr ls 1 60command, type: 61.Bd -literal -offset indent 62.Ic man 1 ls 63.Ed 64.Pp 65Administrators will rapidly become more familiar with 66.Nx 67if they get used to using the manual pages. 68.Ss Security alerts 69By the time that you have installed your system, it is quite likely that 70bugs in the release have been found. 71All significant and easily fixed problems will be reported at 72.Pa http://www.NetBSD.org/Security/ . 73It is recommended that you check this page regularly. 74.Ss Login 75Login as 76.Dq Ic root . 77You can do so on the console, or over the network using 78.Xr ssh 1 . 79If you wish to allow root logins over the network (if you have 80enabled the ssh daemon), edit the 81.Pa /etc/ssh/sshd_config 82file and set 83.Cm PermitRootLogin 84to 85.Dq yes 86(see 87.Xr sshd 8 ) . 88The default is to not permit root logins over the network 89after fresh install in 90.Nx . 91Note defaults on other operating systems might be different. 92.Pp 93Upon successful login on the console, you may see the message 94.Dq We recommend creating a non-root account... . 95For security reasons, it is bad practice to login as root during 96regular use and maintenance of the system. 97Instead, administrators are encouraged to add a 98.Dq regular 99user, add said user to the 100.Dq wheel 101group, then use the 102.Ic su 103and 104.Ic sudo 105commands when root privileges are required. 106This process is described in more detail later. 107.Ss Root password 108Change the password for the root user. 109(Note that throughout the documentation, the term 110.Dq superuser 111is a synonym for the root user.) 112Choose a password that has numbers, digits, and special characters (not space) 113as well as from the upper and lower case alphabet. 114Do not choose any word in any language. 115It is common for an intruder to use dictionary attacks. 116Type the command 117.Ic /usr/bin/passwd 118to change it. 119.Pp 120It is a good idea to always specify the full path name for both the 121.Xr passwd 1 122and 123.Xr su 1 124commands as this inhibits the possibility of files placed in your execution 125.Ev PATH 126for most shells. 127Furthermore, the superuser's 128.Ev PATH 129should never contain the current directory 130.Po Dq \&. 131.Pc . 132.Ss System date 133Check the system date with the 134.Xr date 1 135command. 136If needed, change the date, and/or change the symbolic link of 137.Pa /etc/localtime 138to appropriate time zone in the 139.Pa /usr/share/zoneinfo 140directory. 141.Pp 142Examples: 143.Bl -tag -width date 144.It Cm date 200205101820 145Set the current date to May 10th, 2002 6:20pm. 146.It Cm ln -fs /usr/share/zoneinfo/Europe/Helsinki /etc/localtime 147Set the time zone to Eastern Europe Summer Time. 148.El 149.Ss Console settings 150One of the first things you will likely need to do is to set up your 151keyboard map (and maybe some other aspects about the system console). 152To change your keyboard encoding, edit the 153.Dq Va encoding 154variable found in 155.Pa /etc/wscons.conf . 156.Pp 157.Xr wscons.conf 5 158contains more information about this file. 159.Ss Check hostname 160Use the 161.Ic hostname 162command to verify that the name of your machine is correct. 163See the man page for 164.Xr hostname 1 165if it needs to be changed. 166You will also need to change the contents of the 167.Dq Va hostname 168variable in 169.Pa /etc/rc.conf 170or edit the 171.Pa /etc/myname 172file 173to have it stick around for the next reboot. 174Note that hostname is supposed to be FQDN commonly and should 175not be confused with YP 176.Xr domainname 1 . 177.Ss Verify network interface configuration 178The first thing to do is an 179.Ic ifconfig -a 180to see if the network interfaces are properly configured. 181Correct by editing 182.Pa /etc/ifconfig. Ns Ar interface 183(where 184.Ar interface 185is the interface name, e.g., 186.Dq le0 ) 187and then using 188.Xr ifconfig 8 189to manually configure it 190if you do not wish to reboot. 191Read the 192.Xr ifconfig.if 5 193man page for more information on the format of 194.Pa /etc/ifconfig. Ns Ar interface 195files. 196The loopback interface will look something like: 197.Bd -literal -offset indent 198lo0: flags=8009\*[Lt]UP,LOOPBACK,MULTICAST\*[Gt] mtu 32972 199 inet 127.0.0.1 netmask 0xff000000 200 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 201 inet6 ::1 prefixlen 128 202.Ed 203.Pp 204an Ethernet interface something like: 205.Bd -literal -offset indent 206le0: flags=9863\*[Lt]UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST\*[Gt] 207 inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255 208 inet6 fe80::5ef0:f0f0%le0 prefixlen 64 scopeid 0x1 209.Ed 210.Pp 211and, a PPP interface something like: 212.Bd -literal -offset indent 213ppp0: flags=8051\*[Lt]UP,POINTOPOINT,RUNNING,MULTICAST\*[Gt] 214 inet 203.3.131.108 --\*[Gt] 198.181.0.253 netmask 0xffff0000 215.Ed 216.Pp 217See 218.Xr mrouted 8 219for instructions on configuring multicast routing. 220.Pp 221See 222.Xr dhcpd 8 223for instructions on configuring interfaces with DHCP. 224.Ss Check routing tables 225Issue a 226.Ic netstat -rn 227command. 228The output will look something like: 229.Bd -literal -offset indent 230Routing tables 231 232Internet: 233Destination Gateway Flags Refs Use Mtu Interface 234default 192.168.4.254 UGS 0 11098028 - le0 235127 127.0.0.1 UGRS 0 0 - lo0 236127.0.0.1 127.0.0.1 UH 3 24 - lo0 237192.168.4 link#1 UC 0 0 - le0 238192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - le0 239192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - le0 240 241Internet6: 242Destination Gateway Flags Refs Use Mtu Interface 243::/96 ::1 UGRS 0 0 32972 lo0 =\*[Gt] 244::1 ::1 UH 4 0 32972 lo0 245::ffff:0.0.0.0/96 ::1 UGRS 0 0 32972 lo0 246fc80::/10 ::1 UGRS 0 0 32972 lo0 247fe80::/10 ::1 UGRS 0 0 32972 lo0 248fe80::%le0/64 link#1 UC 0 0 1500 le0 249fe80::%lo0/64 fe80::1%lo0 U 0 0 32972 lo0 250ff01::/32 ::1 U 0 0 32972 lo0 251ff02::%le0/32 link#1 UC 0 0 1500 le0 252ff02::%lo0/32 fe80::1%lo0 UC 0 0 32972 lo0 253 254.Ed 255.Pp 256The default gateway address is stored in the 257.Dq Va defaultroute 258variable 259.Pa /etc/rc.conf , 260or in the file 261.Pa /etc/mygate . 262If you need to edit this file, a painless way to reconfigure the network 263afterwards is to issue 264.Bd -literal -offset indent 265.Ic /etc/rc.d/network restart 266.Ed 267.Pp 268Or, you may prefer to manually configure using a series of 269.Ic route add 270and 271.Ic route delete 272commands (see 273.Xr route 8 ) . 274If you run 275.Xr dhclient 8 276you will have to kill it by running 277.Bd -literal -offset indent 278.Ic /etc/rc.d/dhclient stop 279.Pp 280.Ed 281after you flush the routes. 282.Pp 283If you wish to route packets between interfaces, add the directive 284.Dl net.inet.ip.forwarding=1 285and/or 286.Dl net.inet6.ip6.forwarding=1 287.Pp 288to 289.Pa /etc/sysctl.conf , 290or compile a new kernel with the 291.Cm GATEWAY 292option. 293Packets are not forwarded by default, due to RFC requirements. 294.Pp 295You can add new 296.Dq virtual interfaces 297by adding the required entries to 298.Pa /etc/ifconfig.if . 299.Ss Secure Shell (ssh) 300By default, all services are disabled (and ssh is no exception). 301You may wish to enable it so you can remotely control your system. 302Set "sshd=yes" in 303.Pa /etc/rc.conf 304and then starting the server with the command 305.Bd -literal -offset indent 306.Ic /etc/rc.d/sshd start 307.Ed 308.Pp 309The first time the server is started, it will generate a new keypair, 310which will be stored inside the directory 311.Pa /etc/ssh . 312.Ss BIND Name Server (DNS) 313If you are using the BIND Name Server, check the 314.Pa /etc/resolv.conf 315file. 316It may look something like: 317.Bd -literal -offset indent 318domain some.thing.dom 319nameserver 192.168.0.1 320nameserver 192.168.4.55 321search some.thing.dom. thing.dom. 322.Ed 323.Pp 324For further details, see 325.Xr resolv.conf 5 . 326Note the name service lookup order is set via 327.Xr nsswitch.conf 5 328mechanism. 329.Pp 330If using a caching name server add the line "nameserver 127.0.0.1" first. 331To get a local caching name server to run 332you will need to set "named=yes" in 333.Pa /etc/rc.conf 334and create the 335.Pa named.conf 336file in the appropriate place for 337.Xr named 8 , 338usually in 339.Pa /etc/namedb . 340The same holds true if the machine is going to be a 341name server for your domain. 342In both these cases, make sure that 343.Xr named 8 344is running 345(otherwise there are long waits for resolver timeouts). 346.Ss YP Setup 347Check the YP domain name with the 348.Xr domainname 1 349command. 350If necessary, correct it by editing the 351.Pa /etc/defaultdomain 352file or by setting the 353.Dq Va domainname 354variable in 355.Pa /etc/rc.conf . 356The 357.Pa /etc/rc.d/network 358script reads this file on bootup to determine and set the domain name. 359You may also set the running system's domain name with the 360.Xr domainname 1 361command. 362To start YP client services, simply run 363.Ic ypbind , 364then perform the remaining 365YP activation as described in 366.Xr passwd 5 367and 368.Xr group 5 . 369.Pp 370In particular, to enable YP passwd support, you'd need to update 371.Pa /etc/nsswitch.conf 372to include 373.Dq nis 374for the 375.Dq passwd 376entry. 377A traditional way to accomplish the same thing is to 378add following entry to local passwd database via 379.Xr vipw 8 : 380.Bd -literal -offset indent 381.Li +:*:::::::: 382.Pp 383.Ed 384Note this entry has to be the very last one. 385This traditional way works with the default 386.Xr nsswitch.conf 5 387setting of 388.Dq passwd , 389which is 390.Dq compat . 391.Pp 392You can find more information by starting with 393.Xr yp 8 . 394.Ss Check disk mounts 395Check that the disks are mounted correctly by 396comparing the 397.Pa /etc/fstab 398file against the output of the 399.Xr mount 8 400and 401.Xr df 1 402commands. 403Example: 404.Bd -literal -offset indent 405.Li # Ic cat /etc/fstab 406/dev/sd0a / ffs rw 1 1 407/dev/sd0b none swap sw 0 0 408/dev/sd0e /usr ffs rw 1 2 409/dev/sd0f /var ffs rw 1 3 410/dev/sd0g /tmp ffs rw 1 4 411/dev/sd0h /home ffs rw 1 5 412.Li # Ic mount 413/dev/sd0a on / type ffs (local) 414/dev/sd0e on /usr type ffs (local) 415/dev/sd0f on /var type ffs (local) 416/dev/sd0g on /tmp type ffs (local) 417/dev/sd0h on /home type ffs (local) 418.Li # Ic df 419Filesystem 1024-blocks Used Avail Capacity Mounted on 420/dev/sd0a 22311 14589 6606 69% / 421/dev/sd0e 203399 150221 43008 78% /usr 422/dev/sd0f 10447 682 9242 7% /var 423/dev/sd0g 18823 2 17879 0% /tmp 424/dev/sd0h 7519 5255 1888 74% /home 425.Li # Ic pstat -s 426Device 512-blocks Used Avail Capacity Priority 427/dev/sd0b 131072 84656 46416 65% 0 428.Ed 429.Pp 430Edit 431.Pa /etc/fstab 432and use the 433.Xr mount 8 434and 435.Xr umount 8 436commands as appropriate. 437Refer to the above example and 438.Xr fstab 5 439for information on the format of this file. 440.Pp 441You may wish to do NFS mounts now too, or you can do them later. 442.Ss Concatenated disks (ccd) 443If you are using 444.Xr ccd 4 445concatenated disks, edit 446.Pa /etc/ccd.conf . 447You may wish to take a look to 448.Xr ccdconfig 8 449for more information about this file. 450Use the 451.Ic ccdconfig -U 452command to unload and the 453.Ic ccdconfig -C 454command to create tables internal to the kernel for the concatenated disks. 455You then 456.Xr mount 8 , 457.Xr umount 8 , 458and edit 459.Pa /etc/fstab 460as needed. 461.Ss CHANGING /etc FILES 462The system should be usable now, but you may wish to do more 463customization, such as adding users, etc. 464Many of the following sections may be skipped 465if you are not using that package (for example, skip the 466.Sx Kerberos 467section if you won't be using Kerberos). 468We suggest that you 469.Ic cd /etc 470and edit most of the files in that directory. 471.Pp 472Note that the 473.Pa /etc/motd 474file is modified by 475.Pa /etc/rc.d/motd 476whenever the system is booted. 477To keep any custom message intact, ensure that you leave two blank lines 478at the top, or your message will be overwritten. 479.Ss Sushi 480Since 481.Nx 1.6 , 482a new tool for configuring the system has been 483included, called 484.Xr sushi 8 . 485It will allow you to set up many aspects of the 486system from interactive menus. 487You can launch it typing: 488.Bd -literal -offset indent 489.Ic sushi 490.Ed 491.Ss Add new users 492There are 493.Xr useradd 8 494and 495.Xr groupadd 8 496scripts. 497You may use 498.Xr vipw 8 499to add users to the 500.Pa /etc/passwd 501file 502and edit 503.Pa /etc/group 504by hand to add new groups. 505The manual page for 506.Xr su 1 , 507tells you to make sure to put people in 508the 509.Sq wheel 510group if they need root access (non-Kerberos). 511For example: 512.Bd -literal -offset indent 513wheel:*:0:root,myself 514.Ed 515.Pp 516Follow instructions for 517.Xr kerberos 8 518if using 519Kerberos 520for authentication. 521.Ss rc.conf, rc.local 522Check for any local changes needed in the files 523.Pa /etc/rc.conf , 524and 525.Pa /etc/rc.local . 526.Pp 527.Xr rc.conf 5 528contains configuration for various daemons included with 529the system. 530Script 531.Pa /etc/rc.local 532is run as the last thing during multiuser boot, and is provided 533to allow any other local hooks necessary for the system. 534.Pp 535You can take a look to 536.Pa /etc/defaults/rc.conf 537to see a list of default system variables, which you can override in 538.Pa /etc/rc.conf . 539Note you are 540.Em not 541supposed to change 542.Pa /etc/defaults/rc.conf 543directly, edit only 544.Pa /etc/rc.conf . 545See 546.Xr rc.conf 5 547for further information. 548.Pp 549The directory 550.Pa /etc/rc.d 551contains a serie of scripts used at startup/shutdown, called by 552.Pa /etc/rc . 553.Pp 554If you've installed X, you may want to turn on 555.Xr xdm 1 , 556the X Display Manager. 557To do this, set the variable xdm to yes, i.e., "xdm=yes", in 558.Pa /etc/rc.conf . 559.Ss Printers 560Edit 561.Pa /etc/printcap 562and 563.Pa /etc/hosts.lpd 564to get any printers set up. 565Consult 566.Xr lpd 8 567and 568.Xr printcap 5 569if needed. 570.Ss Tighten up security 571In 572.Pa /etc/inetd.conf 573comment out any extra entries you do not need, and only add things 574that are really needed. 575Note that by default all services are disabled for security reasons. 576.Ss Kerberos 577If you are going to use 578.Xr kerberos 8 579for authentication, and you already have a 580Kerberos 581master, change directory to 582.Pa /etc/kerberosIV 583or 584.Pa /etc/kerberosV 585and configure. 586Remember to get a 587.Pa srvtab 588from the master so that the remote commands work. 589.Ss Mail Aliases 590Check 591.Pa /etc/mail/aliases 592and update appropriately if you want e-mail to be routed 593to non-local address or to different users. 594.Pp 595Run 596.Xr newaliases 1 597after changes. 598.Ss Sendmail 599.Nx 600ships with default 601.Pa /etc/mail/sendmail.cf 602and 603.Pa /etc/mail/submit.cf 604files that will work for simple installations; they were generated from 605.Pa netbsd-proto.mc 606and 607.Pa netbsd-msp.mc 608in 609.Pa /usr/share/sendmail/cf . 610Please see 611.Pa /usr/share/sendmail/README 612and 613.Pa /usr/share/doc/smm/08.sendmailop/op.me 614for information on generating your own sendmail configuration files. 615.Pa /etc/mailer.conf 616is configured to use Sendmail binaries by default and 617.Xr sendmail 8 618will start by default if no other changes to the mail system are made. 619See 620.Xr mailer.conf 5 621and 622.Xr rc.conf 5 623for more details. 624.Ss Postfix 625.Nx 626comes also with Postfix in the base system. 627You may wish to set it up in favor of sendmail. 628Take a look to 629.Pa /etc/postfix/main.cf 630and enable the daemon in 631.Pa /etc/rc.conf 632using "postfix=yes". 633It is very important to configure 634.Pa /etc/mailer.conf 635to point to Postfix binaries. 636.Ss DHCP server 637If this is a 638DHCP 639server, edit 640.Pa /etc/dhcpd.conf 641and 642.Pa /etc/dhcpd.interfaces 643as needed. 644You will have to make sure 645.Pa /etc/rc.conf 646has "dhcpd=yes" 647or run 648.Xr dhcpd 8 649manually. 650.Ss Bootparam server 651If this is a 652Bootparam 653server, edit 654.Pa /etc/bootparams 655as needed. 656You will have to turn it on in 657.Pa /etc/rc.conf 658by adding "bootparamd=yes". 659.Ss NFS server 660If this is an NFS server, make sure 661.Pa /etc/rc.conf 662has: 663.Bd -literal -offset indent 664nfs_server=yes 665mountd=yes 666rpcbind=yes 667.Ed 668.Pp 669Edit 670.Pa /etc/exports 671and get it correct. 672After this, you can start the server by issuing: 673.Bd -literal -offset indent 674.Ic /etc/rc.d/nfsd start 675.Ed 676which will also start dependancies. 677.Ss HP remote boot server 678Edit 679.Pa /etc/rbootd.conf 680if needed for remote booting. 681If you do not have HP computers doing remote booting, do not enable this. 682.Ss Daily, weekly, monthly scripts 683Look at and possibly edit the 684.Pa /etc/daily.conf , /etc/weekly.conf , 685and 686.Pa /etc/monthly.conf 687configuration files. 688You can check which values you can set by looking 689to their matching files in 690.Pa /etc/defaults . 691Your site specific things should go into 692.Pa /etc/daily.local , /etc/weekly.local , 693and 694.Pa /etc/monthly.local . 695.Pp 696These scripts have been limited so as to keep the system running without 697filling up disk space from normal running processes and database updates. 698(You probably do not need to understand them.) 699.Ss Other files in /etc 700Look at the other files in 701.Pa /etc 702and edit them as needed. 703(Do not edit files ending in 704.Pa .db 705\(em like 706.Pa pwd.db , spwd.db , 707nor 708.Pa localtime , 709nor 710.Pa rmt , 711nor any directories.) 712.Ss Crontab (background running processes) 713Check what is running by typing 714.Ic crontab -l 715as root 716and see if anything unexpected is present. 717Do you need anything else? 718Do you wish to change things? 719e.g., if you do not 720like root getting standard output of the daily scripts, and want only 721the security scripts that are mailed internally, you can type 722.Ic crontab -e 723and change some of the lines to read: 724.Bd -literal -offset indent 72530 1 * * * /bin/sh /etc/daily 2\*[Gt]\*[Am]1 \*[Gt] /var/log/daily.out 72630 3 * * 6 /bin/sh /etc/weekly 2\*[Gt]\*[Am]1 \*[Gt] /var/log/weekly.out 72730 5 1 * * /bin/sh /etc/monthly 2\*[Gt]\*[Am]1 \*[Gt] /var/log/monthly.out 728.Ed 729.Pp 730See 731.Xr crontab 5 . 732.Ss Next day cleanup 733After the first night's security run, change ownerships and permissions 734on files, directories, and devices; root should have received mail 735with subject: "\*[Lt]hostname\*[Gt] daily insecurity output.". 736This mail contains 737a set of security recommendations, presented as a list looking like this: 738.Bd -literal -offset indent 739var/mail: 740 permissions (0755, 0775) 741etc/daily: 742 user (0, 3) 743.Ed 744.Pp 745The best bet is to follow the advice in that list. 746The recommended setting is the first item in parentheses, while 747the current setting is the second one. 748This list is generated by 749.Xr mtree 8 750using 751.Pa /etc/mtree/special . 752Use 753.Xr chmod 1 , 754.Xr chgrp 1 , 755and 756.Xr chown 8 757as needed. 758.Ss Packages 759Install your own packages. 760The 761.Nx 762package collection includes a large set of Third-Party software. 763A lot of it is available as binary packages that you can download from 764.Pa ftp://ftp.NetBSD.org/ 765or a mirror, and install using 766.Xr pkg_add 1 . 767See 768.Pa http://www.NetBSD.org/Documentation/software/ 769and 770.Xr packages 7 771for more details. 772.Pp 773Copy vendor binaries and install them. 774You will need to install any shared libraries, etc. 775(Hint: 776.Ic man -k compat 777to find out how to install and use compatibility mode.) 778.Pp 779There is also other Third-Party Software that is available 780in source form only, either because it has not been ported to 781.Nx 782yet, because licensing restrictions make binary redistribution 783impossible, or simply because you want to build your own binaries. 784This group is called pkgsrc. 785Sometimes checking the mailing lists for 786past problems that people have encountered will result in a fix posted. 787.Ss COMPILING A KERNEL 788First, review the system message buffer using the 789.Xr dmesg 8 790command to find out information on your system's devices as probed by the 791kernel at boot. 792In particular, note which devices were not configured. 793This information will prove useful when editing kernel configuration files. 794.Pp 795To compile a kernel inside a writable source tree, do the following: 796.Bd -literal -offset indent 797# cd /usr/src/sys/arch/SOMEARCH/conf 798# cp GENERIC SOMEFILE (only the first time) 799# vi SOMEFILE (adapt to your needs) 800# config SOMEFILE 801# cd ../compile/SOMEFILE 802# make depend 803# make 804.Ed 805.Pp 806where 807.Ar SOMEARCH 808is the architecture (e.g., i386), and 809.Ar SOMEFILE 810should be a name indicative of a particular configuration (often 811that of the hostname). 812.Pp 813If you are building your kernel again, before you do a 814.Ic make 815you should do a 816.Ic make clean 817after making changes to your kernel options. 818.Pp 819After either of these two methods, you can place the new kernel (called 820.Pa netbsd ) 821in 822.Pa / 823(i.e., 824.Pa /netbsd ) 825by issuing 826.Ic make install 827and the system will boot it next time. 828The old kernel is stored as 829.Pa /onetbsd 830so you can boot it in case of failure. 831.Pp 832If you are using toolchain to build your kernel, you will also need to 833build a new set of toolchain binaries. 834You can do it by entering 835.Pa /usr/src 836and issuing 837.Ic ./build.sh tools 838.Sh SEE ALSO 839.Xr chgrp 1 , 840.Xr chmod 1 , 841.Xr crontab 1 , 842.Xr date 1 , 843.Xr df 1 , 844.Xr domainname 1 , 845.Xr hostname 1 , 846.Xr make 1 , 847.Xr man 1 , 848.Xr netstat 1 , 849.Xr newaliases 1 , 850.Xr passwd 1 , 851.Xr su 1 , 852.Xr ccd 4 , 853.Xr aliases 5 , 854.Xr crontab 5 , 855.Xr exports 5 , 856.Xr fstab 5 , 857.Xr group 5 , 858.Xr krb.conf 5 , 859.Xr krb.realms 5 , 860.Xr mailer.conf 5 , 861.Xr passwd 5 , 862.Xr rc.conf 5 , 863.Xr resolv.conf 5 , 864.Xr hostname 7 , 865.Xr packages 7 , 866.Xr adduser 8 , 867.Xr amd 8 , 868.Xr bootparamd 8 , 869.Xr ccdconfig 8 , 870.Xr chown 8 , 871.Xr config 8 , 872.Xr dhcpd 8 , 873.Xr ifconfig 8 , 874.Xr inetd 8 , 875.Xr kerberos 8 , 876.Xr mount 8 , 877.Xr mrouted 8 , 878.Xr mtree 8 , 879.Xr named 8 , 880.Xr rbootd 8 , 881.Xr rc 8 , 882.Xr rmt 8 , 883.Xr route 8 , 884.Xr sushi 8 , 885.Xr umount 8 , 886.Xr vipw 8 , 887.Xr ypbind 8 888.Sh HISTORY 889This document first appeared in 890.Ox 2.2 . 891It has been adapted to 892.Nx 893and first appeared in 894.Nx 2.0 . 895