1.\" $NetBSD: afterboot.8,v 1.83 2023/03/19 17:26:12 kre Exp $ 2.\" $OpenBSD: afterboot.8,v 1.72 2002/02/22 02:02:33 miod Exp $ 3.\" 4.\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu 5.\" Adapted to NetBSD by Julio Merino -- 2002-05-10, jmmv@NetBSD.org 6.\" 7.\" 8.\" Copyright (c) 2002-2008 The NetBSD Foundation, Inc. 9.\" All rights reserved. 10.\" 11.\" Redistribution and use in source and binary forms, with or without 12.\" modification, are permitted provided that the following conditions 13.\" are met: 14.\" 1. Redistributions of source code must retain the above copyright 15.\" notice, this list of conditions and the following disclaimer. 16.\" 2. Redistributions in binary form must reproduce the above copyright 17.\" notice, this list of conditions and the following disclaimer in the 18.\" documentation and/or other materials provided with the distribution. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 21.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 24.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30.\" POSSIBILITY OF SUCH DAMAGE. 31.\" 32.\" 33.\" Copyright (c) 1997 Marshall M. Midden 34.\" All rights reserved. 35.\" 36.\" Redistribution and use in source and binary forms, with or without 37.\" modification, are permitted provided that the following conditions 38.\" are met: 39.\" 40.\" 1. Redistributions of source code must retain the above copyright 41.\" notice, this list of conditions and the following disclaimer. 42.\" 2. Redistributions in binary form must reproduce the above copyright 43.\" notice, this list of conditions and the following disclaimer in the 44.\" documentation and/or other materials provided with the distribution. 45.\" 3. All advertising materials mentioning features or use of this software 46.\" must display the following acknowledgement: 47.\" This product includes software developed by Marshall M. Midden. 48.\" 4. The name of the author may not be used to endorse or promote products 49.\" derived from this software without specific prior written permission. 50.\" 51.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 52.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 53.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 54.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 55.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 56.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 57.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 58.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 59.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 60.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 61.\" 62.Dd June 4, 2021 63.Dt AFTERBOOT 8 64.Os 65.Sh NAME 66.Nm afterboot 67.Nd things to check after the first complete boot 68.Sh DESCRIPTION 69.Ss Starting Out 70This document attempts to list items for the system administrator 71to check and set up after the installation and first complete boot of the 72system. 73The idea is to create a list of items that can be checked off so that you have 74a warm fuzzy feeling that something obvious has not been missed. 75A basic knowledge of 76.Ux 77is assumed. 78.Pp 79Complete instructions for correcting and fixing items is not provided. 80There are manual pages and other methodologies available for doing that. 81For example, to view the man page for the 82.Xr ls 1 83command, type: 84.Bd -literal -offset indent 85.Ic man 1 ls 86.Ed 87.Pp 88Administrators will rapidly become more familiar with 89.Nx 90if they get used to using the manual pages. 91.Ss Login 92On a fresh install with no other user accounts, login as 93.Dq Ic root . 94You can do so on the console, or over the network using 95.Xr ssh 1 . 96If you have enabled the SSH daemon (see 97.Xr sshd 8 ) 98and wish to allow root logins over the network, edit the 99.Pa /etc/ssh/sshd_config 100file and set 101.Dq PermitRootLogin 102to 103.Dq yes 104(see 105.Xr sshd_config 5 ) . 106The default is to not permit root logins over the network 107after fresh install in 108.Nx . 109.Pp 110Upon successful login on the console, you may see the message 111.Dq We recommend creating a non-root account... . 112For security reasons, it is bad practice to login as root during 113regular use and maintenance of the system. 114In fact, the system will only let you login as root on a secure 115terminal. 116By default, only the console is considered to be a secure terminal. 117Instead, administrators are encouraged to add a 118.Dq regular 119user, add said user to the 120.Dq wheel 121group, then use the 122.Xr su 1 123command when root privileges are required: 124.Bd -literal -offset indent 125.Ic useradd -G wheel -m myuser 126.Ic passwd myuser 127.Ed 128.Ss Root password 129Change the password for the root user. 130(Note that throughout the documentation, the term 131.Dq superuser 132is a synonym for the root user.) 133Choose a password that has numbers, digits, and special characters (not space) 134as well as from the upper and lower case alphabet. 135Do not choose any word in any language. 136It is common for an intruder to use dictionary attacks. 137Type the command 138.Ic /usr/bin/passwd 139to change it. 140.Pp 141It is a good idea to always specify the full path name for both the 142.Xr passwd 1 143and 144.Xr su 1 145commands as this inhibits the possibility of files placed in your execution 146.Ev PATH 147for most shells. 148Furthermore, the superuser's 149.Ev PATH 150should never contain the current directory 151.Po Dq \&. 152.Pc . 153.Ss System date 154Check the system date with the 155.Xr date 1 156command. 157If needed, change the date, and/or change the symbolic link of 158.Pa /etc/localtime 159to the correct time zone in the 160.Pa /usr/share/zoneinfo 161directory. 162.Pp 163Examples: 164.Bl -tag -width date 165.It Cm date 202010051820 166Set the current date to October 5th, 2020 6:20pm. 167.It Cm ln -fs /usr/share/zoneinfo/Europe/Helsinki /etc/localtime 168Set the time zone to Eastern Europe Summer Time. 169.El 170.Ss Console settings 171One of the first things you will likely need to do is to set up your 172keyboard map (and maybe some other aspects about the system console). 173To change your keyboard layout, edit the 174.Dq Va encoding 175variable found in 176.Pa /etc/wscons.conf . 177.Pp 178.Xr wscons.conf 5 179contains more information about this file. 180.Ss Security alerts 181All significant and easily fixed problems will be reported at 182.Lk https://www.NetBSD.org/support/security/ the security advisories web page . 183It is recommended that you check this page regularly. 184.Pp 185Additionally, you should set 186.Dq fetch_pkg_vulnerabilities=YES 187in 188.Pa /etc/daily.conf 189to allow your system to automatically update the local database of known 190vulnerable packages to the latest version available on-line. 191The system will later check, on a daily basis, if any of your installed 192packages are vulnerable based on the contents of this database. 193See 194.Xr daily.conf 5 195and 196.Xr security.conf 5 197for more details. 198.Ss Entropy 199If your machine does not have a hardware random number generator, it 200may not be safe to use on the internet until it has enough entropy to 201generate unpredictable secrets for programs like web browsers and 202.Xr ssh 1 . 203You can use 204.Xr rndctl 8 205to list the entropy sources with 206.Ic rndctl -l , 207or save entropy from another machine running 208.Nx 209with 210.Ic rndctl -S 211and load it on this one with 212.Ic rndctl -L 213(as long as there are no eavesdroppers on the medium between the two 214machines). 215See 216.Xr entropy 7 217for more details. 218.Ss Check hostname 219Use the 220.Ic hostname 221command to verify that the name of your machine is correct. 222See the man page for 223.Xr hostname 1 224if it needs to be changed. 225You will also need to change the contents of the 226.Dq Va hostname 227variable in 228.Pa /etc/rc.conf 229or edit the 230.Pa /etc/myname 231file to have it stick around for the next reboot. 232Note that 233.Dq Va hostname 234is supposed include a domainname, and that this should 235not be confused with YP (NIS) 236.Xr domainname 1 . 237If you are using 238.Xr dhcpcd 8 239to configure network interfaces, it might override these local hostname 240settings if your DHCP server specifies client's hostname with other network 241configurations. 242.Ss Verify network interface configuration 243The first thing to do is an 244.Ic ifconfig -a 245to see if the network interfaces are properly configured. 246Correct by editing 247.Pa /etc/ifconfig. Ns Ar interface 248or the corresponding 249.Dq Va ifconfig_ Ns Ar interface 250variable in 251.Xr rc.conf 5 252(where 253.Ar interface 254is the interface name, e.g., 255.Dq le0 ) 256and then using 257.Xr ifconfig 8 258to manually configure it 259if you do not wish to reboot. 260.Pp 261Alternatively, many networks allow interfaces to be configured 262automatically via DHCP. 263To get 264.Xr dhcpcd 8 265to start automatically on boot, 266you will need to have this line in 267.Pa /etc/rc.conf : 268.Pp 269.Dl dhcpcd=YES 270.Pp 271See 272.Xr dhcpcd 8 273and 274.Xr dhcpcd.conf 5 275for more information on setting up a DHCP client. 276For information on setting up Wi-Fi, see 277.Sx Wireless networking . 278.Pp 279You can add new 280.Dq virtual interfaces 281by adding the required entries to 282.Pa /etc/ifconfig. Ns Ar interface . 283Read the 284.Xr ifconfig.if 5 285man page for more information on the format of 286.Pa /etc/ifconfig. Ns Ar interface 287files. 288The loopback interface will look something like: 289.Bd -literal -offset indent 290lo0: flags=8009<UP,LOOPBACK,MULTICAST> mtu 32972 291 inet 127.0.0.1 netmask 0xff000000 292 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 293 inet6 ::1 prefixlen 128 294.Ed 295.Pp 296an Ethernet interface something like: 297.Bd -literal -offset indent 298le0: flags=9863<UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST> 299 inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255 300 inet6 fe80::5ef0:f0f0%le0 prefixlen 64 scopeid 0x1 301.Ed 302.Pp 303and a PPP interface something like: 304.Bd -literal -offset indent 305ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> 306 inet 203.3.131.108 --> 198.181.0.253 netmask 0xffff0000 307.Ed 308.Pp 309See 310.Xr mrouted 8 311for instructions on configuring multicast routing. 312.Ss Check routing tables 313Issue a 314.Ic netstat -rn 315command. 316The output will look something like: 317.Bd -literal -offset indent 318Routing tables 319 320Internet: 321Destination Gateway Flags Refs Use Mtu Interface 322default 192.168.4.254 UGS 0 11098028 - le0 323127 127.0.0.1 UGRS 0 0 - lo0 324127.0.0.1 127.0.0.1 UH 3 24 - lo0 325192.168.4 link#1 UC 0 0 - le0 326192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - le0 327192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - le0 328 329Internet6: 330Destination Gateway Flags Refs Use Mtu Interface 331::/96 ::1 UGRS 0 0 32972 lo0 => 332::1 ::1 UH 4 0 32972 lo0 333::ffff:0.0.0.0/96 ::1 UGRS 0 0 32972 lo0 334fc80::/10 ::1 UGRS 0 0 32972 lo0 335fe80::/10 ::1 UGRS 0 0 32972 lo0 336fe80::%le0/64 link#1 UC 0 0 1500 le0 337fe80::%lo0/64 fe80::1%lo0 U 0 0 32972 lo0 338ff01::/32 ::1 U 0 0 32972 lo0 339ff02::%le0/32 link#1 UC 0 0 1500 le0 340ff02::%lo0/32 fe80::1%lo0 UC 0 0 32972 lo0 341.Ed 342.Pp 343The default gateway address is stored in the 344.Dq Va defaultroute 345variable in 346.Pa /etc/rc.conf , 347or in the file 348.Pa /etc/mygate . 349If you need to edit this file, a painless way to reconfigure the network 350afterwards is to issue 351.Bd -literal -offset indent 352.Ic service network restart 353.Ed 354.Pp 355Or, you may prefer to manually configure using a series of 356.Ic route add 357and 358.Ic route delete 359commands (see 360.Xr route 8 ) . 361If you run 362.Xr dhcpcd 8 363you will have to kill it by running 364.Bd -literal -offset indent 365.Ic service dhcpcd stop 366.Ed 367.Pp 368before you flush the routes. 369.Pp 370If you wish to route packets between interfaces, add one or both 371of the following directives (depending on whether IPv4 or IPv6 routing 372is required) to 373.Pa /etc/sysctl.conf : 374.Pp 375.Dl net.inet.ip.forwarding=1 376.Dl net.inet6.ip6.forwarding=1 377.Pp 378As an alternative, compile a new kernel with the 379.Dq GATEWAY 380option. 381Packets are not forwarded by default, due to RFC requirements. 382.Ss Device nodes 383By default, nodes are created in 384.Pa /dev 385for a fairly typical number of devices. 386.Pp 387However, if this system has a large number of devices connected 388(e.g. for large scale storage), you may want to enable 389.Xr devpubd 8 390to ensure a sufficient number of nodes are available. 391Set 392.Dq Va devpubd=YES 393in 394.Pa /etc/rc.conf 395to create nodes automatically during system runtime. 396You can also run the node creation script by hand: 397.Bd -literal -offset indent 398.Ic cd /dev && sh MAKEDEV 399.Ed 400.Ss Secure Shell (SSH) 401By default, all services are disabled in a fresh 402.Nx 403installation, and SSH is no exception. 404You may wish to enable it so you can remotely control your system. 405Set 406.Dq Va sshd=YES 407in 408.Pa /etc/rc.conf 409and then starting the server with the command 410.Bd -literal -offset indent 411.Ic service sshd start 412.Ed 413.Pp 414The first time the server is started, it will generate a new keypair, 415which will be stored inside the directory 416.Pa /etc/ssh . 417.Ss Host names and DNS 418The system resolves host names according the rules for hosts in the 419name service switch configuration at 420.Pa /etc/nsswitch.conf . 421By default, it will query 422.Pa /etc/hosts 423first, and then the DNS resolver specified in 424.Pa /etc/resolv.conf . 425.Pp 426Multicast DNS and DNS Service Discovery are usually not enabled by 427default on a fresh 428.Nx 429system, and can be enabled by setting 430.Dq mdnsd=YES 431in 432.Pa /etc/rc.conf , 433and either rebooting or running the following command: 434.Bd -literal -offset indent 435.Ic service mdnsd start 436.Ed 437.Pp 438You may also wish to enable mdnsd as a source for host lookups 439in 440.Pa /etc/nsswitch.conf , 441see 442.Xr nsswitch.conf 5 . 443.Pp 444If your network does not have a usable DNS resolver, e.g. one provided 445by DHCP, you can run a local caching recursive resolver by setting 446.Dq named=YES 447in 448.Pa /etc/rc.conf 449and either rebooting or running the following command: 450.Bd -literal -offset indent 451.Ic service named start 452.Ed 453.Pp 454.Xr named 8 455is configured in 456.Pa /etc/named.conf 457by default to run as a local caching recursive resolver. 458Then, to make the system use it, put the following in 459.Pa /etc/resolv.conf : 460.Bd -literal -offset indent 461nameserver 127.0.0.1 462.Ed 463.Ss Wireless networking 464To configure the system to connect to a Wi-Fi network with a password 465using WPA: 466.Bd -literal -offset indent 467.Ic wpa_passphrase networkname password >> /etc/wpa_supplicant.conf 468.Ed 469.Pp 470To configure the system to connect to an open wireless network with 471no password, edit 472.Pa /etc/wpa_supplicant.conf 473instead of using 474.Xr wpa_passphrase 8 : 475.Bd -literal -offset indent 476network={ 477 ssid="Public-WiFi" 478 key_mgmt=NONE 479 priority=100 480} 481.Ed 482.Pp 483Then bring up the interface and start the necessary daemons: 484.Bd -literal -offset indent 485.Ic ifconfig iwm0 up 486.Ic service wpa_supplicant onestart 487.Ic service dhcpcd onestart 488.Ed 489.Pp 490To automatically connect at boot, add the following to 491.Pa /etc/rc.conf : 492.Pp 493.Dl ifconfig_iwm0="up" 494.Dl dhcpcd=YES 495.Dl wpa_supplicant=YES 496.Pp 497While using 498.Xr wpa_supplicant 8 , 499you can easily retrieve network scan results with 500.Xr wpa_cli 8 : 501.Bd -literal -offset indent 502.Ic wpa_cli scan_results 503.Ed 504.Pp 505Or trigger a rescan: 506.Bd -literal -offset indent 507.Ic wpa_cli scan 508.Ed 509.Ss RPC-based network services 510Several services depend on the RPC portmapper 511.Xr rpcbind 8 512- formerly known as 513.Ic portmap 514- being running for proper operation. 515This includes YP (NIS) and NFS exports, among other services. 516To get the RPC portmapper to start automatically on boot, 517you will need to have this line in 518.Pa /etc/rc.conf : 519.Pp 520.Dl rpcbind=YES 521.Ss YP (Network Information Service) Setup 522Check the YP domain name with the 523.Xr domainname 1 524command. 525If necessary, correct it by editing the 526.Pa /etc/defaultdomain 527file or by setting the 528.Dq Va domainname 529variable in 530.Pa /etc/rc.conf . 531The 532.Pa /etc/rc.d/network 533script reads this file on bootup to determine and set the domain name. 534You may also set the running system's domain name with the 535.Xr domainname 1 536command. 537To start YP client services, simply run 538.Ic ypbind , 539then perform the remaining 540YP activation as described in 541.Xr passwd 5 542and 543.Xr group 5 . 544.Pp 545In particular, to enable YP passwd support, you'll need to update 546.Pa /etc/nsswitch.conf 547to include 548.Dq nis 549for the 550.Dq passwd 551and 552.Dq group 553entries. 554A traditional way to accomplish the same thing is to 555add following entry to local passwd database via 556.Xr vipw 8 : 557.Bd -literal -offset indent 558.Li +:*:::::::: 559.Ed 560.Pp 561Note this entry has to be the very last one. 562This traditional way works with the default 563.Xr nsswitch.conf 5 564setting of 565.Dq passwd , 566which is 567.Dq compat . 568.Pp 569There are many more YP man pages available to help you. 570You can find more information by starting with 571.Xr nis 8 . 572.Ss Check disk mounts 573Check that the disks are mounted correctly by 574comparing the 575.Pa /etc/fstab 576file against the output of the 577.Xr mount 8 578and 579.Xr df 1 580commands. 581Example: 582.Bd -literal -offset indent 583.Li # Ic cat /etc/fstab 584/dev/sd0a / ffs rw 1 1 585/dev/sd0b none swap sw 586/dev/sd0e /usr ffs rw 1 2 587/dev/sd0f /var ffs rw 1 3 588/dev/sd0g /tmp ffs rw 1 4 589/dev/sd0h /home ffs rw 1 5 590 591.Li # Ic mount 592/dev/sd0a on / type ffs (local) 593/dev/sd0e on /usr type ffs (local) 594/dev/sd0f on /var type ffs (local) 595/dev/sd0g on /tmp type ffs (local) 596/dev/sd0h on /home type ffs (local) 597 598.Li # Ic df 599Filesystem 1024-blocks Used Avail Capacity Mounted on 600/dev/sd0a 22311 14589 6606 69% / 601/dev/sd0e 203399 150221 43008 78% /usr 602/dev/sd0f 10447 682 9242 7% /var 603/dev/sd0g 18823 2 17879 0% /tmp 604/dev/sd0h 7519 5255 1888 74% /home 605 606.Li # Ic pstat -s 607Device 512-blocks Used Avail Capacity Priority 608/dev/sd0b 131072 84656 46416 65% 0 609.Ed 610.Pp 611Edit 612.Pa /etc/fstab 613and use the 614.Xr mount 8 615and 616.Xr umount 8 617commands as appropriate. 618Refer to the above example and 619.Xr fstab 5 620for information on the format of this file. 621.Pp 622You may wish to do NFS mounts now too, or you can do them later. 623.Ss Clock synchronization 624In order to make sure the system clock is synchronized 625to that of a publicly accessible NTP server, 626make sure that 627.Pa /etc/rc.conf 628contains the following: 629.Pp 630.Dl ntpdate=YES 631.Dl ntpd=YES 632.Pp 633See 634.Xr date 1 , 635.Xr ntpdate 8 , 636.Xr ntpd 8 , 637.Xr rdate 8 , 638and 639.Xr timed 8 640for more information on setting the system's date. 641.Ss Installing packages 642The 643.Nx 644packages collection, pkgsrc, includes a large set of third-party software. 645A lot of it is available as binary packages that you can download from 646.Lk https://cdn.NetBSD.org/pub/pkgsrc/packages/NetBSD/ 647or a mirror. 648.Pp 649For most users, using pkgin to manage binary packages is recommended. 650.Pp 651To install pkgin, if it was not done by the installer: 652.Bd -literal -offset indent 653.Ic PKG_PATH=https://cdn.NetBSD.org/pub/pkgsrc/packages/NetBSD/[...] 654.Ic export PKG_PATH 655.Ic pkg_add pkgin 656.Ic pkgin update 657.Ic pkgin install bash mpg123 fluxbox ... 658.Ed 659.Pp 660See 661.Lk https://www.pkgsrc.org/ 662and 663.Pa pkgsrc/doc/pkgsrc.txt 664for more details. 665.Sh CHANGING /etc FILES 666The system should be usable now, but you may wish to do more customizing, 667such as adding users, etc. 668Many of the following sections may be skipped 669if you are not using that package (for example, skip the 670.Sx Kerberos 671section if you won't be using Kerberos). 672We suggest that you 673.Ic cd /etc 674and edit most of the files in that directory. 675.Pp 676Note that the 677.Pa /etc/motd 678file is modified by 679.Pa /etc/rc.d/motd 680whenever the system is booted. 681To keep any custom message intact, ensure that you leave two blank lines 682at the top, or your message will be overwritten. 683.Ss Add new users 684To add new users and groups, there are 685.Xr useradd 8 686and 687.Xr groupadd 8 ; 688see also 689.Xr user 8 690for further programs for user and group manipulation. 691You may use 692.Xr vipw 8 693to add users to the 694.Pa /etc/passwd 695file 696and edit 697.Pa /etc/group 698by hand to add new groups. 699The manual page for 700.Xr su 1 , 701tells you to make sure to put people in 702the 703.Sq wheel 704group if they need root access (non-Kerberos). 705For example: 706.Bd -literal -offset indent 707wheel:*:0:root,myself 708.Ed 709.Pp 710Follow instructions for 711.Xr kerberos 8 712if using 713Kerberos 714for authentication. 715.Ss System boot scripts and /etc/rc.local 716.Pa /etc/rc 717and the 718.Pa /etc/rc.d/* 719scripts are invoked at boot time after single user mode has exited, 720and at shutdown. 721The whole process is controlled by the master script 722.Pa /etc/rc . 723This script should not be changed by administrators. 724.Pp 725The directory 726.Pa /etc/rc.d 727contains a series of scripts used at startup/shutdown, called by 728.Pa /etc/rc . 729.Pa /etc/rc 730is in turn influenced by the configuration variables present in 731.Pa /etc/rc.conf . 732.Pp 733The script 734.Pa /etc/rc.local 735is run as the last thing during multiuser boot, and is provided 736to allow any other local hooks necessary for the system. 737.Ss rc.conf 738To enable or disable various services on system startup, 739corresponding entries can be made in 740.Pa /etc/rc.conf . 741You can take a look at 742.Pa /etc/defaults/rc.conf 743to see a list of default system variables, which you can override in 744.Pa /etc/rc.conf . 745Note you are 746.Em not 747supposed to change 748.Pa /etc/defaults/rc.conf 749directly, edit only 750.Pa /etc/rc.conf . 751See 752.Xr rc.conf 5 753for further information. 754.Ss Automounter daemon (AMD) 755To use the 756.Xr amd 8 757automounter, create the 758.Pa /etc/amd 759directory, copy example config files from 760.Pa /usr/share/examples/amd 761to 762.Pa /etc/amd 763and customize them as needed. 764Alternatively, you can get your maps with YP. 765.Ss Concatenated disks (ccd) 766If you are using 767.Xr ccd 4 768concatenated disks, edit 769.Pa /etc/ccd.conf . 770You may wish to take a look to 771.Xr ccdconfig 8 772for more information about this file. 773Use the 774.Ic ccdconfig -U 775command to unload and the 776.Ic ccdconfig -C 777command to create tables internal to the kernel for the concatenated disks. 778You then 779.Xr mount 8 , 780.Xr umount 8 , 781and edit 782.Pa /etc/fstab 783as needed. 784.Ss Nx Packet Filter 785.Xr npf 7 786is the default firewall used on 787.Nx . 788You may wish to enable it if your machine is connected directly to the 789internet. 790To do this, edit 791.Pa /etc/npf.conf 792and set 793.Dq npf=YES 794in 795.Pa /etc/rc.conf . 796Configuration examples for NPF can be found in 797.Pa /usr/share/examples/npf . 798Before installing a configuration, you can validate it with 799.Xr npfctl 8 . 800.Ss X Display Manager 801If you've installed X, you may want to turn on 802.Xr xdm 1 , 803the X Display Manager. 804To do this, set 805.Dq xdm=YES 806in 807.Pa /etc/rc.conf . 808.Ss Printers 809Edit 810.Pa /etc/printcap 811and 812.Pa /etc/hosts.lpd 813to get any printers set up. 814Consult 815.Xr lpd 8 816and 817.Xr printcap 5 818if needed. 819.Ss Internet Services (inetd) 820Various internet services can be enabled in 821.Pa /etc/inetd.conf , 822including 823.Xr httpd 8 824and 825.Xr finger 1 . 826Note that by default all services are disabled for security reasons. 827Only add things that are really needed. 828.Ss Kerberos 829If you are going to use Kerberos for authentication, 830see 831.Xr kerberos 8 832and 833.Dq info heimdal 834for more information. 835If you already have a Kerberos master, change directory to 836.Pa /etc/kerberosV 837and configure. 838Remember to get a 839.Pa srvtab 840from the master so that the remote commands work. 841.Ss Mail Aliases 842Check 843.Pa /etc/mail/aliases 844and update appropriately if you want e-mail to be routed 845to non-local addresses or to different users. 846.Pp 847Run 848.Xr newaliases 1 849after changes. 850.Ss Postfix 851.Nx 852uses Postfix as its Mail Transfer Agent. 853Postfix is started by default, but its initial configuration does not 854cause it to listen on the network for incoming connections. 855To configure Postfix, see 856.Pa /etc/postfix/main.cf 857and 858.Pa /etc/postfix/master.cf . 859If you wish to use a different MTA (e.g., sendmail), install your MTA of 860choice and edit 861.Pa /etc/mailer.conf 862to point to the proper binaries. 863.Ss DHCP server 864If this is a 865DHCP 866server, edit 867.Pa /etc/dhcpd.conf 868and 869.Pa /etc/dhcpd.interfaces 870as needed. 871You will have to make sure 872.Pa /etc/rc.conf 873has 874.Dq dhcpd=YES 875or run 876.Xr dhcpd 8 877manually. 878.Ss Bootparam server 879If this is a 880Bootparam 881server, edit 882.Pa /etc/bootparams 883as needed. 884You will have to turn it on in 885.Pa /etc/rc.conf 886by adding 887.Dq bootparamd=YES . 888.Ss NFS server 889If this is an NFS server, make sure 890.Pa /etc/rc.conf 891has: 892.Bd -literal -offset indent 893nfs_server=YES 894mountd=YES 895rpcbind=YES 896.Ed 897.Pp 898Edit 899.Pa /etc/exports 900and get it correct. 901After this, you can start the server by issuing: 902.Bd -literal -offset indent 903.Ic service rpcbind start 904.Ic service mountd start 905.Ic service nfsd start 906.Ed 907which will also start dependencies. 908.Ss HP remote boot server 909Edit 910.Pa /etc/rbootd.conf 911if needed for remote booting. 912If you do not have HP computers doing remote booting, do not enable this. 913.Ss Daily, weekly, monthly scripts 914Look at and possibly edit the 915.Pa /etc/daily.conf , /etc/weekly.conf , 916and 917.Pa /etc/monthly.conf 918configuration files. 919You can check which values you can set by looking 920to their matching files in 921.Pa /etc/defaults . 922Your site specific things should go into 923.Pa /etc/daily.local , /etc/weekly.local , 924and 925.Pa /etc/monthly.local . 926.Pp 927These scripts have been limited so as to keep the system running without 928filling up disk space from normal running processes and database updates. 929(You probably do not need to understand them.) 930.Ss Other files in /etc 931Look at the other files in 932.Pa /etc 933and edit them as needed. 934(Do not edit files ending in 935.Pa .db 936\(em like 937.Pa pwd.db , spwd.db , 938nor 939.Pa localtime , 940nor 941.Pa rmt , 942nor any directories.) 943.Ss Crontab (background running processes) 944Check what is running by typing 945.Ic crontab -l 946as root 947and see if anything unexpected is present. 948Do you need anything else? 949Do you wish to change things? 950For example, if you do not 951like root getting standard output of the daily scripts, and want only 952the security scripts that are mailed internally, you can type 953.Ic crontab -e 954and change some of the lines to read: 955.Bd -literal -offset indent 95630 1 * * * /bin/sh /etc/daily 2>&1 > /var/log/daily.out 95730 3 * * 6 /bin/sh /etc/weekly 2>&1 > /var/log/weekly.out 95830 5 1 * * /bin/sh /etc/monthly 2>&1 > /var/log/monthly.out 959.Ed 960.Pp 961See 962.Xr crontab 5 . 963.Ss Next day cleanup 964After the first night's security run, change ownerships and permissions 965on files, directories, and devices; root should have received mail 966with subject: "<hostname> daily insecurity output.". 967This mail contains 968a set of security recommendations, presented as a list looking like this: 969.Bd -literal -offset indent 970var/mail: 971 permissions (0755, 0775) 972etc/daily: 973 user (0, 3) 974.Ed 975.Pp 976The best bet is to follow the advice in that list. 977The recommended setting is the first item in parentheses, while 978the current setting is the second one. 979This list is generated by 980.Xr mtree 8 981using 982.Pa /etc/mtree/special . 983Use 984.Xr chmod 1 , 985.Xr chgrp 1 , 986and 987.Xr chown 8 988as needed. 989.Sh SYSTEM TESTING 990At this point, the system should be fully configured to your liking. 991It is now a good time to ensure that the system behaves according to 992its specifications and that it is stable on your hardware. 993Please refer to 994.Xr tests 7 995for details on how to do so. 996.Pp 997You can use 998.Xr ps 1 , 999.Xr netstat 1 , 1000and 1001.Xr fstat 1 1002to check on running processes, network connections, and opened files, 1003respectively. 1004Other tools you may find useful are 1005.Xr systat 1 1006and 1007.Xr top 1 . 1008.Sh SEE ALSO 1009.Xr chgrp 1 , 1010.Xr chmod 1 , 1011.Xr config 1 , 1012.Xr crontab 1 , 1013.Xr date 1 , 1014.Xr df 1 , 1015.Xr domainname 1 , 1016.Xr fstat 1 , 1017.Xr hostname 1 , 1018.Xr make 1 , 1019.Xr man 1 , 1020.Xr netstat 1 , 1021.Xr newaliases 1 , 1022.Xr passwd 1 , 1023.Xr pkg_add 1 , 1024.Xr ps 1 , 1025.Xr ssh 1 , 1026.Xr su 1 , 1027.Xr systat 1 , 1028.Xr top 1 , 1029.Xr xdm 1 , 1030.Xr ccd 4 , 1031.Xr aliases 5 , 1032.Xr crontab 5 , 1033.Xr dhcpcd.conf 5 , 1034.Xr exports 5 , 1035.Xr fstab 5 , 1036.Xr group 5 , 1037.Xr hosts 5 , 1038.Xr ifconfig.if 5 , 1039.Xr mailer.conf 5 , 1040.Xr named.conf 5 , 1041.Xr nsswitch.conf 5 , 1042.Xr passwd 5 , 1043.Xr printcap 5 , 1044.Xr rc.conf 5 , 1045.Xr resolv.conf 5 , 1046.Xr sshd_config 5 , 1047.Xr wpa_supplicant.conf 5 , 1048.Xr wscons.conf 5 , 1049.Xr hier 7 , 1050.Xr hostname 7 , 1051.Xr pkgsrc 7 , 1052.Xr tests 7 , 1053.Xr amd 8 , 1054.Xr ccdconfig 8 , 1055.Xr chown 8 , 1056.Xr devpubd 8 , 1057.Xr dhcpcd 8 , 1058.Xr dhcpd 8 , 1059.Xr dmesg 8 , 1060.Xr groupadd 8 , 1061.Xr ifconfig 8 , 1062.Xr inetd 8 , 1063.Xr kerberos 8 , 1064.Xr lpd 8 , 1065.Xr mdnsd 8 , 1066.Xr mount 8 , 1067.Xr mrouted 8 , 1068.Xr mtree 8 , 1069.Xr named 8 , 1070.Xr nis 8 , 1071.Xr ntpd 8 , 1072.Xr ntpdate 8 , 1073.Xr rbootd 8 , 1074.Xr rc 8 , 1075.Xr rdate 8 , 1076.Xr rmt 8 , 1077.Xr route 8 , 1078.Xr rpc.bootparamd 8 , 1079.Xr rpcbind 8 , 1080.Xr sshd 8 , 1081.Xr timed 8 , 1082.Xr umount 8 , 1083.Xr useradd 8 , 1084.Xr vipw 8 , 1085.Xr wpa_cli 8 , 1086.Xr wpa_supplicant 8 , 1087.Xr yp 8 , 1088.Xr ypbind 8 1089.Sh HISTORY 1090This document first appeared in 1091.Ox 2.2 . 1092It has been adapted to 1093.Nx 1094and first appeared in 1095.Nx 2.0 . 1096