1.\" $NetBSD: afterboot.8,v 1.42 2009/10/24 12:18:05 reed Exp $ 2.\" $OpenBSD: afterboot.8,v 1.72 2002/02/22 02:02:33 miod Exp $ 3.\" 4.\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu 5.\" Adapted to NetBSD by Julio Merino -- 2002-05-10, jmmv@NetBSD.org 6.\" 7.\" 8.\" Copyright (c) 2002-2008 The NetBSD Foundation, Inc. 9.\" All rights reserved. 10.\" 11.\" Redistribution and use in source and binary forms, with or without 12.\" modification, are permitted provided that the following conditions 13.\" are met: 14.\" 1. Redistributions of source code must retain the above copyright 15.\" notice, this list of conditions and the following disclaimer. 16.\" 2. Redistributions in binary form must reproduce the above copyright 17.\" notice, this list of conditions and the following disclaimer in the 18.\" documentation and/or other materials provided with the distribution. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 21.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 24.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30.\" POSSIBILITY OF SUCH DAMAGE. 31.\" 32.\" 33.\" Copyright (c) 1997 Marshall M. Midden 34.\" All rights reserved. 35.\" 36.\" Redistribution and use in source and binary forms, with or without 37.\" modification, are permitted provided that the following conditions 38.\" are met: 39.\" 40.\" 1. Redistributions of source code must retain the above copyright 41.\" notice, this list of conditions and the following disclaimer. 42.\" 2. Redistributions in binary form must reproduce the above copyright 43.\" notice, this list of conditions and the following disclaimer in the 44.\" documentation and/or other materials provided with the distribution. 45.\" 3. All advertising materials mentioning features or use of this software 46.\" must display the following acknowledgement: 47.\" This product includes software developed by Marshall M. Midden. 48.\" 4. The name of the author may not be used to endorse or promote products 49.\" derived from this software without specific prior written permission. 50.\" 51.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 52.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 53.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 54.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 55.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 56.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 57.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 58.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 59.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 60.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 61.\" 62.Dd May 18, 2009 63.Dt AFTERBOOT 8 64.Os 65.Sh NAME 66.Nm afterboot 67.Nd things to check after the first complete boot 68.Sh DESCRIPTION 69.Ss Starting Out 70This document attempts to list items for the system administrator 71to check and set up after the installation and first complete boot of the 72system. 73The idea is to create a list of items that can be checked off so that you have 74a warm fuzzy feeling that something obvious has not been missed. 75A basic knowledge of 76.Ux 77is assumed. 78.Pp 79Complete instructions for correcting and fixing items is not provided. 80There are manual pages and other methodologies available for doing that. 81For example, to view the man page for the 82.Xr ls 1 83command, type: 84.Bd -literal -offset indent 85.Ic man 1 ls 86.Ed 87.Pp 88Administrators will rapidly become more familiar with 89.Nx 90if they get used to using the manual pages. 91.Ss Security alerts 92By the time that you have installed your system, it is quite likely that 93bugs in the release have been found. 94All significant and easily fixed problems will be reported at 95.Pa http://www.NetBSD.org/support/security/ . 96It is recommended that you check this page regularly. 97.Ss Login 98Login as 99.Dq Ic root . 100You can do so on the console, or over the network using 101.Xr ssh 1 . 102If you have enabled the ssh daemon and wish to allow root logins over 103the network, edit the 104.Pa /etc/ssh/sshd_config 105file and set 106.Cm PermitRootLogin 107to 108.Dq yes 109(see 110.Xr sshd_config 5 ) . 111The default is to not permit root logins over the network 112after fresh install in 113.Nx . 114.Pp 115Upon successful login on the console, you may see the message 116.Dq We recommend creating a non-root account... . 117For security reasons, it is bad practice to login as root during 118regular use and maintenance of the system. 119In fact, the system will only let you login as root on a secure 120terminal. 121By default, only the console is considered to be a secure terminal. 122Instead, administrators are encouraged to add a 123.Dq regular 124user, add said user to the 125.Dq wheel 126group, then use the 127.Xr su 1 128command when root privileges are required. 129This process is described in more detail later. 130.Ss Root password 131Change the password for the root user. 132(Note that throughout the documentation, the term 133.Dq superuser 134is a synonym for the root user.) 135Choose a password that has numbers, digits, and special characters (not space) 136as well as from the upper and lower case alphabet. 137Do not choose any word in any language. 138It is common for an intruder to use dictionary attacks. 139Type the command 140.Ic /usr/bin/passwd 141to change it. 142.Pp 143It is a good idea to always specify the full path name for both the 144.Xr passwd 1 145and 146.Xr su 1 147commands as this inhibits the possibility of files placed in your execution 148.Ev PATH 149for most shells. 150Furthermore, the superuser's 151.Ev PATH 152should never contain the current directory 153.Po Dq \&. 154.Pc . 155.Ss System date 156Check the system date with the 157.Xr date 1 158command. 159If needed, change the date, and/or change the symbolic link of 160.Pa /etc/localtime 161to the correct time zone in the 162.Pa /usr/share/zoneinfo 163directory. 164.Pp 165Examples: 166.Bl -tag -width date 167.It Cm date 200205101820 168Set the current date to May 10th, 2002 6:20pm. 169.It Cm ln -fs /usr/share/zoneinfo/Europe/Helsinki /etc/localtime 170Set the time zone to Eastern Europe Summer Time. 171.El 172.Ss Console settings 173One of the first things you will likely need to do is to set up your 174keyboard map (and maybe some other aspects about the system console). 175To change your keyboard encoding, edit the 176.Dq Va encoding 177variable found in 178.Pa /etc/wscons.conf . 179.Pp 180.Xr wscons.conf 5 181contains more information about this file. 182.Ss Check hostname 183Use the 184.Ic hostname 185command to verify that the name of your machine is correct. 186See the man page for 187.Xr hostname 1 188if it needs to be changed. 189You will also need to change the contents of the 190.Dq Va hostname 191variable in 192.Pa /etc/rc.conf 193or edit the 194.Pa /etc/myname 195file to have it stick around for the next reboot. 196Note that 197.Dq Va hostname 198is supposed include a domainname, and that this should 199not be confused with YP (NIS) 200.Xr domainname 1 . 201If you are using 202.Xr dhclient 8 203to configure network interfaces, it might override these local hostname 204settings if your DHCP server specifies client's hostname with other network 205configurations. 206.Ss Verify network interface configuration 207The first thing to do is an 208.Ic ifconfig -a 209to see if the network interfaces are properly configured. 210Correct by editing 211.Pa /etc/ifconfig. Ns Ar interface 212or the corresponding 213.Dq Va ifconfig_ Ns Ar interface 214variable in 215.Xr rc.conf 5 216(where 217.Ar interface 218is the interface name, e.g., 219.Dq le0 ) 220and then using 221.Xr ifconfig 8 222to manually configure it 223if you do not wish to reboot. 224.Pp 225Alternatively, you can configure interfaces automatically via DHCP with 226.Xr dhclient 8 227if you have a DHCP server running somewhere on your network. 228To get 229.Xr dhclient 8 230to start automatically on boot, 231you will need to have this line in 232.Pa /etc/rc.conf : 233.Pp 234.Dl dhclient=YES 235.Pp 236See 237.Xr dhclient 8 238and 239.Xr dhclient.conf 5 240for more information on setting up a DHCP client. 241.Pp 242You can add new 243.Dq virtual interfaces 244by adding the required entries to 245.Pa /etc/ifconfig. Ns Ar interface . 246Read the 247.Xr ifconfig.if 5 248man page for more information on the format of 249.Pa /etc/ifconfig. Ns Ar interface 250files. 251The loopback interface will look something like: 252.Bd -literal -offset indent 253lo0: flags=8009\*[Lt]UP,LOOPBACK,MULTICAST\*[Gt] mtu 32972 254 inet 127.0.0.1 netmask 0xff000000 255 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 256 inet6 ::1 prefixlen 128 257.Ed 258.Pp 259an Ethernet interface something like: 260.Bd -literal -offset indent 261le0: flags=9863\*[Lt]UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST\*[Gt] 262 inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255 263 inet6 fe80::5ef0:f0f0%le0 prefixlen 64 scopeid 0x1 264.Ed 265.Pp 266and a PPP interface something like: 267.Bd -literal -offset indent 268ppp0: flags=8051\*[Lt]UP,POINTOPOINT,RUNNING,MULTICAST\*[Gt] 269 inet 203.3.131.108 --\*[Gt] 198.181.0.253 netmask 0xffff0000 270.Ed 271.Pp 272See 273.Xr mrouted 8 274for instructions on configuring multicast routing. 275.Ss Check routing tables 276Issue a 277.Ic netstat -rn 278command. 279The output will look something like: 280.Bd -literal -offset indent 281Routing tables 282 283Internet: 284Destination Gateway Flags Refs Use Mtu Interface 285default 192.168.4.254 UGS 0 11098028 - le0 286127 127.0.0.1 UGRS 0 0 - lo0 287127.0.0.1 127.0.0.1 UH 3 24 - lo0 288192.168.4 link#1 UC 0 0 - le0 289192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - le0 290192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - le0 291 292Internet6: 293Destination Gateway Flags Refs Use Mtu Interface 294::/96 ::1 UGRS 0 0 32972 lo0 =\*[Gt] 295::1 ::1 UH 4 0 32972 lo0 296::ffff:0.0.0.0/96 ::1 UGRS 0 0 32972 lo0 297fc80::/10 ::1 UGRS 0 0 32972 lo0 298fe80::/10 ::1 UGRS 0 0 32972 lo0 299fe80::%le0/64 link#1 UC 0 0 1500 le0 300fe80::%lo0/64 fe80::1%lo0 U 0 0 32972 lo0 301ff01::/32 ::1 U 0 0 32972 lo0 302ff02::%le0/32 link#1 UC 0 0 1500 le0 303ff02::%lo0/32 fe80::1%lo0 UC 0 0 32972 lo0 304.Ed 305.Pp 306The default gateway address is stored in the 307.Dq Va defaultroute 308variable in 309.Pa /etc/rc.conf , 310or in the file 311.Pa /etc/mygate . 312If you need to edit this file, a painless way to reconfigure the network 313afterwards is to issue 314.Bd -literal -offset indent 315.Ic /etc/rc.d/network restart 316.Ed 317.Pp 318Or, you may prefer to manually configure using a series of 319.Ic route add 320and 321.Ic route delete 322commands (see 323.Xr route 8 ) . 324If you run 325.Xr dhclient 8 326you will have to kill it by running 327.Bd -literal -offset indent 328.Ic /etc/rc.d/dhclient stop 329.Pp 330.Ed 331after you flush the routes. 332.Pp 333If you wish to route packets between interfaces, add one or both 334of the following directives (depending on whether IPv4 or IPv6 routing 335is required) to 336.Pa /etc/sysctl.conf : 337.Pp 338.Dl net.inet.ip.forwarding=1 339.Dl net.inet6.ip6.forwarding=1 340.Pp 341As an alternative, compile a new kernel with the 342.Cm GATEWAY 343option. 344Packets are not forwarded by default, due to RFC requirements. 345.Ss Secure Shell (ssh) 346By default, all services are disabled in a fresh 347.Nx 348installation, and ssh is no exception. 349You may wish to enable it so you can remotely control your system. 350Set 351.Dq Va sshd=yes 352in 353.Pa /etc/rc.conf 354and then starting the server with the command 355.Bd -literal -offset indent 356.Ic /etc/rc.d/sshd start 357.Ed 358.Pp 359The first time the server is started, it will generate a new keypair, 360which will be stored inside the directory 361.Pa /etc/ssh . 362.Ss BIND Name Server (DNS) 363If you are using the BIND Name Server, check the 364.Pa /etc/resolv.conf 365file. 366It may look something like: 367.Bd -literal -offset indent 368domain some.thing.dom 369nameserver 192.168.0.1 370nameserver 192.168.4.55 371search some.thing.dom. thing.dom. 372.Ed 373.Pp 374For further details, see 375.Xr resolv.conf 5 . 376Note the name service lookup order is set via 377.Xr nsswitch.conf 5 378mechanism. 379.Pp 380If using a caching name server add the line "nameserver 127.0.0.1" first. 381To get a local caching name server to run 382you will need to set "named=yes" in 383.Pa /etc/rc.conf 384and create the 385.Pa named.conf 386file in the appropriate place for 387.Xr named 8 , 388usually in 389.Pa /etc/namedb . 390The same holds true if the machine is going to be a 391name server for your domain. 392In both these cases, make sure that 393.Xr named 8 394is running 395(otherwise there are long waits for resolver timeouts). 396.Ss RPC-based network services 397Several services depend on the RPC portmapper 398.Xr rpcbind 8 399- formerly known as 400.Ic portmap 401- being running for proper operation. 402This includes YP (NIS) and NFS exports, among other services. 403To get the RPC portmapper to start automatically on boot, 404you will need to have this line in 405.Pa /etc/rc.conf : 406.Pp 407.Dl rpcbind=YES 408.Ss YP (NIS) Setup 409Check the YP domain name with the 410.Xr domainname 1 411command. 412If necessary, correct it by editing the 413.Pa /etc/defaultdomain 414file or by setting the 415.Dq Va domainname 416variable in 417.Pa /etc/rc.conf . 418The 419.Pa /etc/rc.d/network 420script reads this file on bootup to determine and set the domain name. 421You may also set the running system's domain name with the 422.Xr domainname 1 423command. 424To start YP client services, simply run 425.Ic ypbind , 426then perform the remaining 427YP activation as described in 428.Xr passwd 5 429and 430.Xr group 5 . 431.Pp 432In particular, to enable YP passwd support, you'll need to update 433.Pa /etc/nsswitch.conf 434to include 435.Dq nis 436for the 437.Dq passwd 438and 439.Dq group 440entries. 441A traditional way to accomplish the same thing is to 442add following entry to local passwd database via 443.Xr vipw 8 : 444.Bd -literal -offset indent 445.Li +:*:::::::: 446.Pp 447.Ed 448Note this entry has to be the very last one. 449This traditional way works with the default 450.Xr nsswitch.conf 5 451setting of 452.Dq passwd , 453which is 454.Dq compat . 455.Pp 456There are many more YP man pages available to help you. 457You can find more information by starting with 458.Xr nis 8 . 459.Ss Check disk mounts 460Check that the disks are mounted correctly by 461comparing the 462.Pa /etc/fstab 463file against the output of the 464.Xr mount 8 465and 466.Xr df 1 467commands. 468Example: 469.Bd -literal -offset indent 470.Li # Ic cat /etc/fstab 471/dev/sd0a / ffs rw 1 1 472/dev/sd0b none swap sw 473/dev/sd0e /usr ffs rw 1 2 474/dev/sd0f /var ffs rw 1 3 475/dev/sd0g /tmp ffs rw 1 4 476/dev/sd0h /home ffs rw 1 5 477 478.Li # Ic mount 479/dev/sd0a on / type ffs (local) 480/dev/sd0e on /usr type ffs (local) 481/dev/sd0f on /var type ffs (local) 482/dev/sd0g on /tmp type ffs (local) 483/dev/sd0h on /home type ffs (local) 484 485.Li # Ic df 486Filesystem 1024-blocks Used Avail Capacity Mounted on 487/dev/sd0a 22311 14589 6606 69% / 488/dev/sd0e 203399 150221 43008 78% /usr 489/dev/sd0f 10447 682 9242 7% /var 490/dev/sd0g 18823 2 17879 0% /tmp 491/dev/sd0h 7519 5255 1888 74% /home 492 493.Li # Ic pstat -s 494Device 512-blocks Used Avail Capacity Priority 495/dev/sd0b 131072 84656 46416 65% 0 496.Ed 497.Pp 498Edit 499.Pa /etc/fstab 500and use the 501.Xr mount 8 502and 503.Xr umount 8 504commands as appropriate. 505Refer to the above example and 506.Xr fstab 5 507for information on the format of this file. 508.Pp 509You may wish to do NFS mounts now too, or you can do them later. 510.Ss Concatenated disks (ccd) 511If you are using 512.Xr ccd 4 513concatenated disks, edit 514.Pa /etc/ccd.conf . 515You may wish to take a look to 516.Xr ccdconfig 8 517for more information about this file. 518Use the 519.Ic ccdconfig -U 520command to unload and the 521.Ic ccdconfig -C 522command to create tables internal to the kernel for the concatenated disks. 523You then 524.Xr mount 8 , 525.Xr umount 8 , 526and edit 527.Pa /etc/fstab 528as needed. 529.Ss Automounter daemon (AMD) 530To use the 531.Xr amd 8 532automounter, create the 533.Pa /etc/amd 534directory, copy example config files from 535.Pa /usr/share/examples/amd 536to 537.Pa /etc/amd 538and customize them as needed. 539Alternatively, you can get your maps with YP. 540.Ss Clock synchronization 541In order to make sure the system clock is synchronized 542to that of a publicly accessible NTP server, 543make sure that 544.Pa /etc/rc.conf 545contains the following: 546.Pp 547.Dl ntpdate=yes 548.Dl ntpd=yes 549.Pp 550See 551.Xr date 1 , 552.Xr ntpdate 8 , 553.Xr ntpd 8 , 554.Xr rdate 8 , 555and 556.Xr timed 8 557for more information on setting the system's date. 558.Sh CHANGING /etc FILES 559The system should be usable now, but you may wish to do more customizing, 560such as adding users, etc. 561Many of the following sections may be skipped 562if you are not using that package (for example, skip the 563.Sx Kerberos 564section if you won't be using Kerberos). 565We suggest that you 566.Ic cd /etc 567and edit most of the files in that directory. 568.Pp 569Note that the 570.Pa /etc/motd 571file is modified by 572.Pa /etc/rc.d/motd 573whenever the system is booted. 574To keep any custom message intact, ensure that you leave two blank lines 575at the top, or your message will be overwritten. 576.Ss Add new users 577To add new users and groups, there are 578.Xr useradd 8 579and 580.Xr groupadd 8 , 581see also 582.Xr user 8 583for further programs for user and group manipulation. 584You may use 585.Xr vipw 8 586to add users to the 587.Pa /etc/passwd 588file 589and edit 590.Pa /etc/group 591by hand to add new groups. 592The manual page for 593.Xr su 1 , 594tells you to make sure to put people in 595the 596.Sq wheel 597group if they need root access (non-Kerberos). 598For example: 599.Bd -literal -offset indent 600wheel:*:0:root,myself 601.Ed 602.Pp 603Follow instructions for 604.Xr kerberos 8 605if using 606Kerberos 607for authentication. 608.Ss System boot scripts and /etc/rc.local 609.Pa /etc/rc 610and the 611.Pa /etc/rc.d/* 612scripts are invoked at boot time after single user mode has exited, 613and at shutdown. 614The whole process is controlled by the master script 615.Pa /etc/rc . 616This script should not be changed by administrators. 617.Pp 618The directory 619.Pa /etc/rc.d 620contains a series of scripts used at startup/shutdown, called by 621.Pa /etc/rc . 622.Pa /etc/rc 623is in turn influenced by the configuration variables present in 624.Pa /etc/rc.conf . 625.Pp 626The script 627.Pa /etc/rc.local 628is run as the last thing during multiuser boot, and is provided 629to allow any other local hooks necessary for the system. 630.Ss rc.conf 631To enable or disable various services on system startup, 632corresponding entries can be made in 633.Pa /etc/rc.conf . 634You can take a look at 635.Pa /etc/defaults/rc.conf 636to see a list of default system variables, which you can override in 637.Pa /etc/rc.conf . 638Note you are 639.Em not 640supposed to change 641.Pa /etc/defaults/rc.conf 642directly, edit only 643.Pa /etc/rc.conf . 644See 645.Xr rc.conf 5 646for further information. 647.Pp 648If you've installed X, you may want to turn on 649.Xr xdm 1 , 650the X Display Manager. 651To do this, set the variable 652.Dq xdm 653to yes in 654.Pa /etc/rc.conf , 655i.e.: 656.Dq xdm=yes 657.Ss Printers 658Edit 659.Pa /etc/printcap 660and 661.Pa /etc/hosts.lpd 662to get any printers set up. 663Consult 664.Xr lpd 8 665and 666.Xr printcap 5 667if needed. 668.Ss Tighten up security 669In 670.Pa /etc/inetd.conf 671comment out any extra entries you do not need, and only add things 672that are really needed. 673Note that by default all services are disabled for security reasons. 674.Ss Kerberos 675If you are going to use Kerberos for authentication, 676see 677.Xr kerberos 8 678and 679.Dq info heimdal 680for more information. 681If you already have a Kerberos master, change directory to 682.Pa /etc/kerberosV 683and configure. 684Remember to get a 685.Pa srvtab 686from the master so that the remote commands work. 687.Ss Mail Aliases 688Check 689.Pa /etc/mail/aliases 690and update appropriately if you want e-mail to be routed 691to non-local addresses or to different users. 692.Pp 693Run 694.Xr newaliases 1 695after changes. 696.Ss Postfix 697.Nx 698uses Postfix as its MTA. 699Postfix is started by default, but its initial configuration does not 700cause it to listen on the network for incoming connections. 701To configure Postfix, see 702.Pa /etc/postfix/main.cf 703and 704.Pa /etc/postfix/master.cf . 705If you wish to use a different MTA (e.g., sendmail), install your MTA of 706choice and edit 707.Pa /etc/mailer.conf 708to point to the proper binaries. 709.Ss DHCP server 710If this is a 711DHCP 712server, edit 713.Pa /etc/dhcpd.conf 714and 715.Pa /etc/dhcpd.interfaces 716as needed. 717You will have to make sure 718.Pa /etc/rc.conf 719has "dhcpd=yes" 720or run 721.Xr dhcpd 8 722manually. 723.Ss Bootparam server 724If this is a 725Bootparam 726server, edit 727.Pa /etc/bootparams 728as needed. 729You will have to turn it on in 730.Pa /etc/rc.conf 731by adding "bootparamd=yes". 732.Ss NFS server 733If this is an NFS server, make sure 734.Pa /etc/rc.conf 735has: 736.Bd -literal -offset indent 737nfs_server=yes 738mountd=yes 739rpcbind=yes 740.Ed 741.Pp 742Edit 743.Pa /etc/exports 744and get it correct. 745After this, you can start the server by issuing: 746.Bd -literal -offset indent 747.Ic /etc/rc.d/rpcbind start 748.Ic /etc/rc.d/mountd start 749.Ic /etc/rc.d/nfsd start 750.Ed 751which will also start dependencies. 752.Ss HP remote boot server 753Edit 754.Pa /etc/rbootd.conf 755if needed for remote booting. 756If you do not have HP computers doing remote booting, do not enable this. 757.Ss Daily, weekly, monthly scripts 758Look at and possibly edit the 759.Pa /etc/daily.conf , /etc/weekly.conf , 760and 761.Pa /etc/monthly.conf 762configuration files. 763You can check which values you can set by looking 764to their matching files in 765.Pa /etc/defaults . 766Your site specific things should go into 767.Pa /etc/daily.local , /etc/weekly.local , 768and 769.Pa /etc/monthly.local . 770.Pp 771These scripts have been limited so as to keep the system running without 772filling up disk space from normal running processes and database updates. 773(You probably do not need to understand them.) 774.Ss Other files in /etc 775Look at the other files in 776.Pa /etc 777and edit them as needed. 778(Do not edit files ending in 779.Pa .db 780\(em like 781.Pa pwd.db , spwd.db , 782nor 783.Pa localtime , 784nor 785.Pa rmt , 786nor any directories.) 787.Ss Crontab (background running processes) 788Check what is running by typing 789.Ic crontab -l 790as root 791and see if anything unexpected is present. 792Do you need anything else? 793Do you wish to change things? 794For example, if you do not 795like root getting standard output of the daily scripts, and want only 796the security scripts that are mailed internally, you can type 797.Ic crontab -e 798and change some of the lines to read: 799.Bd -literal -offset indent 80030 1 * * * /bin/sh /etc/daily 2\*[Gt]\*[Am]1 \*[Gt] /var/log/daily.out 80130 3 * * 6 /bin/sh /etc/weekly 2\*[Gt]\*[Am]1 \*[Gt] /var/log/weekly.out 80230 5 1 * * /bin/sh /etc/monthly 2\*[Gt]\*[Am]1 \*[Gt] /var/log/monthly.out 803.Ed 804.Pp 805See 806.Xr crontab 5 . 807.Ss Next day cleanup 808After the first night's security run, change ownerships and permissions 809on files, directories, and devices; root should have received mail 810with subject: "\*[Lt]hostname\*[Gt] daily insecurity output.". 811This mail contains 812a set of security recommendations, presented as a list looking like this: 813.Bd -literal -offset indent 814var/mail: 815 permissions (0755, 0775) 816etc/daily: 817 user (0, 3) 818.Ed 819.Pp 820The best bet is to follow the advice in that list. 821The recommended setting is the first item in parentheses, while 822the current setting is the second one. 823This list is generated by 824.Xr mtree 8 825using 826.Pa /etc/mtree/special . 827Use 828.Xr chmod 1 , 829.Xr chgrp 1 , 830and 831.Xr chown 8 832as needed. 833.Ss Packages 834Install your own packages. 835The 836.Nx 837packages collection, pkgsrc, includes a large set of third-party software. 838A lot of it is available as binary packages that you can download from 839.Pa ftp://ftp.NetBSD.org/pub/NetBSD/packages/ 840or a mirror, and install using 841.Xr pkg_add 1 . 842See 843.Pa http://www.NetBSD.org/docs/pkgsrc/ 844and 845.Pa pkgsrc/doc/pkgsrc.txt 846for more details. 847.Pp 848Copy vendor binaries and install them. 849You will need to install any shared libraries, etc. 850(Hint: 851.Ic man -k compat 852to find out how to install and use compatibility mode.) 853.Pp 854There is also other third-party software that is available 855in source form only, either because it has not been ported to 856.Nx 857yet, because licensing restrictions make binary redistribution 858impossible, or simply because you want to build your own binaries. 859Sometimes checking the mailing lists for 860past problems that people have encountered will result in a fix posted. 861.Ss Check the running system 862You can use 863.Xr ps 1 , 864.Xr netstat 1 , 865and 866.Xr fstat 1 867to check on running processes, network connections, and opened files, 868respectively. 869Other tools you may find useful are 870.Xr systat 1 871and 872.Xr top 1 . 873.Sh COMPILING A KERNEL 874Note: 875The standard 876.Nx 877kernel configuration (GENERIC) is suitable for most purposes. 878.Pp 879First, review the system message buffer in 880.Pa /var/run/dmesg.boot 881and by using the 882.Xr dmesg 8 883command to find out information on your system's devices as probed by the 884kernel at boot. 885In particular, note which devices were not configured. 886This information will prove useful when editing kernel configuration files. 887.Pp 888To compile a kernel inside a writable source tree, do the following: 889.Bd -literal -offset indent 890$ cd /usr/src/sys/arch/SOMEARCH/conf 891$ cp GENERIC SOMEFILE (only the first time) 892$ vi SOMEFILE (adapt to your needs) 893$ config SOMEFILE 894$ cd ../compile/SOMEFILE 895$ make depend 896$ make 897.Ed 898.Pp 899where 900.Ar SOMEARCH 901is the architecture (e.g., i386), and 902.Ar SOMEFILE 903should be a name indicative of a particular configuration (often 904that of the hostname). 905.Pp 906If you are building your kernel again, before you do a 907.Ic make 908you should do a 909.Ic make clean 910after making changes to your kernel options. 911.Pp 912After either of these two methods, you can place the new kernel (called 913.Pa netbsd ) 914in 915.Pa / 916(i.e., 917.Pa /netbsd ) 918by issuing 919.Ic make install 920and the system will boot it next time. 921The old kernel is stored as 922.Pa /onetbsd 923so you can boot it in case of failure. 924.Pp 925If you are using toolchain to build your kernel, you will also need to 926build a new set of toolchain binaries. 927You can do it by changing into 928.Pa /usr/src 929and issuing: 930.Bd -literal -offset indent 931$ cd /usr/src 932$ K=sys/arch/`uname -m`/conf 933$ cp $K/GENERIC $K/SOMEFILE 934$ vi $K/SOMEFILE (adapt to your needs) 935$ ./build.sh tools 936$ ./build.sh kernel=SOMEFILE 937.Ed 938.Sh SYSTEM TESTING 939At this point, the system should be fully configured to your liking. 940It is now a good time to ensure that the system behaves according to 941its specifications and that it is stable on your hardware. 942You can easily do so by running the test suites available at 943.Pa /usr/tests/ , 944assuming that you installed the 945.Pa tests.tgz 946set. 947If not, you can install it now by running: 948.Bd -literal -offset indent 949# cd / 950# tar xzpf /path/to/tests.tgz 951.Ed 952.Pp 953Once done, edit the 954.Pa /etc/atf/NetBSD.conf 955file to tune the configuration of the test suite, go to 956.Pa /usr/tests/ 957hierarchy and use the 958.Xr atf-run 1 959and 960.Xr atf-report 1 961utilities to run all the tests in an automated way: 962.Bd -literal -offset indent 963# cd /usr/tests/ 964# atf-run | atf-report 965.Ed 966.Pp 967Should any problems appear when running the test suite, please let the 968.Nx 969developers know by sending a message to the appropriate mailing list or 970by sending a problem report. 971For more details see: 972.Bl -bullet -offset indent 973.It 974.Pa http://www.netbsd.org/mailinglists/ 975.It 976.Pa http://www.netbsd.org/support/send-pr.html 977.El 978.Sh SEE ALSO 979.Xr atf-report 1 , 980.Xr atf-run 1 , 981.Xr chgrp 1 , 982.Xr chmod 1 , 983.Xr config 1 , 984.Xr crontab 1 , 985.Xr date 1 , 986.Xr df 1 , 987.Xr domainname 1 , 988.Xr hostname 1 , 989.Xr make 1 , 990.Xr man 1 , 991.Xr netstat 1 , 992.Xr newaliases 1 , 993.Xr passwd 1 , 994.Xr su 1 , 995.Xr ccd 4 , 996.Xr aliases 5 , 997.Xr crontab 5 , 998.Xr exports 5 , 999.Xr fstab 5 , 1000.Xr group 5 , 1001.Xr mailer.conf 5 , 1002.Xr passwd 5 , 1003.Xr rc.conf 5 , 1004.Xr resolv.conf 5 , 1005.Xr hier 7 , 1006.Xr hostname 7 , 1007.Xr pkgsrc 7 , 1008.Xr amd 8 , 1009.Xr ccdconfig 8 , 1010.Xr chown 8 , 1011.Xr dhcpd 8 , 1012.Xr ifconfig 8 , 1013.Xr inetd 8 , 1014.Xr kerberos 8 , 1015.Xr mount 8 , 1016.Xr mrouted 8 , 1017.Xr mtree 8 , 1018.Xr named 8 , 1019.Xr nis 8 . 1020.Xr rbootd 8 , 1021.Xr rc 8 , 1022.Xr rmt 8 , 1023.Xr route 8 , 1024.Xr rpc.bootparamd 8 , 1025.Xr umount 8 , 1026.Xr useradd 8 , 1027.Xr vipw 8 , 1028.Xr ypbind 8 1029.Sh HISTORY 1030This document first appeared in 1031.Ox 2.2 . 1032It has been adapted to 1033.Nx 1034and first appeared in 1035.Nx 2.0 . 1036