1.\" $NetBSD: afterboot.8,v 1.38 2008/10/21 08:43:15 wiz Exp $ 2.\" $OpenBSD: afterboot.8,v 1.72 2002/02/22 02:02:33 miod Exp $ 3.\" 4.\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu 5.\" Adapted to NetBSD by Julio Merino -- 2002-05-10, jmmv@NetBSD.org 6.\" 7.\" 8.\" Copyright (c) 2002-2008 The NetBSD Foundation, Inc. 9.\" All rights reserved. 10.\" 11.\" Redistribution and use in source and binary forms, with or without 12.\" modification, are permitted provided that the following conditions 13.\" are met: 14.\" 1. Redistributions of source code must retain the above copyright 15.\" notice, this list of conditions and the following disclaimer. 16.\" 2. Redistributions in binary form must reproduce the above copyright 17.\" notice, this list of conditions and the following disclaimer in the 18.\" documentation and/or other materials provided with the distribution. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 21.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 24.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30.\" POSSIBILITY OF SUCH DAMAGE. 31.\" 32.\" 33.\" Copyright (c) 1997 Marshall M. Midden 34.\" All rights reserved. 35.\" 36.\" Redistribution and use in source and binary forms, with or without 37.\" modification, are permitted provided that the following conditions 38.\" are met: 39.\" 40.\" 1. Redistributions of source code must retain the above copyright 41.\" notice, this list of conditions and the following disclaimer. 42.\" 2. Redistributions in binary form must reproduce the above copyright 43.\" notice, this list of conditions and the following disclaimer in the 44.\" documentation and/or other materials provided with the distribution. 45.\" 3. All advertising materials mentioning features or use of this software 46.\" must display the following acknowledgement: 47.\" This product includes software developed by Marshall M. Midden. 48.\" 4. The name of the author may not be used to endorse or promote products 49.\" derived from this software without specific prior written permission. 50.\" 51.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 52.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 53.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 54.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 55.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 56.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 57.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 58.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 59.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 60.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 61.\" 62.Dd October 20, 2008 63.Dt AFTERBOOT 8 64.Os 65.Sh NAME 66.Nm afterboot 67.Nd things to check after the first complete boot 68.Sh DESCRIPTION 69.Ss Starting Out 70This document attempts to list items for the system administrator 71to check and set up after the installation and first complete boot of the 72system. 73The idea is to create a list of items that can be checked off so that you have 74a warm fuzzy feeling that something obvious has not been missed. 75A basic knowledge of 76.Ux 77is assumed. 78.Pp 79Complete instructions for correcting and fixing items is not provided. 80There are manual pages and other methodologies available for doing that. 81For example, to view the man page for the 82.Xr ls 1 83command, type: 84.Bd -literal -offset indent 85.Ic man 1 ls 86.Ed 87.Pp 88Administrators will rapidly become more familiar with 89.Nx 90if they get used to using the manual pages. 91.Ss Security alerts 92By the time that you have installed your system, it is quite likely that 93bugs in the release have been found. 94All significant and easily fixed problems will be reported at 95.Pa http://www.NetBSD.org/support/security/ . 96It is recommended that you check this page regularly. 97.Ss Login 98Login as 99.Dq Ic root . 100You can do so on the console, or over the network using 101.Xr ssh 1 . 102If you have enabled the ssh daemon and wish to allow root logins over 103the network, edit the 104.Pa /etc/ssh/sshd_config 105file and set 106.Cm PermitRootLogin 107to 108.Dq yes 109(see 110.Xr sshd_config 5 ) . 111The default is to not permit root logins over the network 112after fresh install in 113.Nx . 114.Pp 115Upon successful login on the console, you may see the message 116.Dq We recommend creating a non-root account... . 117For security reasons, it is bad practice to login as root during 118regular use and maintenance of the system. 119In fact, the system will only let you login as root on a secure 120terminal. 121By default, only the console is considered to be a secure terminal. 122Instead, administrators are encouraged to add a 123.Dq regular 124user, add said user to the 125.Dq wheel 126group, then use the 127.Xr su 1 128command when root privileges are required. 129This process is described in more detail later. 130.Ss Root password 131Change the password for the root user. 132(Note that throughout the documentation, the term 133.Dq superuser 134is a synonym for the root user.) 135Choose a password that has numbers, digits, and special characters (not space) 136as well as from the upper and lower case alphabet. 137Do not choose any word in any language. 138It is common for an intruder to use dictionary attacks. 139Type the command 140.Ic /usr/bin/passwd 141to change it. 142.Pp 143It is a good idea to always specify the full path name for both the 144.Xr passwd 1 145and 146.Xr su 1 147commands as this inhibits the possibility of files placed in your execution 148.Ev PATH 149for most shells. 150Furthermore, the superuser's 151.Ev PATH 152should never contain the current directory 153.Po Dq \&. 154.Pc . 155.Ss System date 156Check the system date with the 157.Xr date 1 158command. 159If needed, change the date, and/or change the symbolic link of 160.Pa /etc/localtime 161to the correct time zone in the 162.Pa /usr/share/zoneinfo 163directory. 164.Pp 165Examples: 166.Bl -tag -width date 167.It Cm date 200205101820 168Set the current date to May 10th, 2002 6:20pm. 169.It Cm ln -fs /usr/share/zoneinfo/Europe/Helsinki /etc/localtime 170Set the time zone to Eastern Europe Summer Time. 171.El 172.Ss Console settings 173One of the first things you will likely need to do is to set up your 174keyboard map (and maybe some other aspects about the system console). 175To change your keyboard encoding, edit the 176.Dq Va encoding 177variable found in 178.Pa /etc/wscons.conf . 179.Pp 180.Xr wscons.conf 5 181contains more information about this file. 182.Ss Check hostname 183Use the 184.Ic hostname 185command to verify that the name of your machine is correct. 186See the man page for 187.Xr hostname 1 188if it needs to be changed. 189You will also need to change the contents of the 190.Dq Va hostname 191variable in 192.Pa /etc/rc.conf 193or edit the 194.Pa /etc/myname 195file to have it stick around for the next reboot. 196Note that hostname is supposed include a domainname, and that this should 197not be confused with YP (NIS) 198.Xr domainname 1 . 199If you are using 200.Xr dhclient 8 201to configure network interfaces, it might override these local hostname 202settings if your DHCP server specifies client's hostname with other network 203configurations. 204.Ss Verify network interface configuration 205The first thing to do is an 206.Ic ifconfig -a 207to see if the network interfaces are properly configured. 208Correct by editing 209.Pa /etc/ifconfig. Ns Ar interface 210or the corresponding 211.Dq Va ifconfig_ Ns Ar interface 212variable in 213.Xr rc.conf 5 214(where 215.Ar interface 216is the interface name, e.g., 217.Dq le0 ) 218and then using 219.Xr ifconfig 8 220to manually configure it 221if you do not wish to reboot. 222.Pp 223Alternatively, you can configure interfaces automatically via DHCP with 224.Xr dhclient 8 225if you have a DHCP server running somewhere on your network. 226To get 227.Xr dhclient 8 228to start automatically on boot, 229you will need to have this line in 230.Pa /etc/rc.conf : 231.Pp 232.Dl dhclient=YES 233.Pp 234See 235.Xr dhclient 8 236and 237.Xr dhclient.conf 5 238for more information on setting up a DHCP client. 239.Pp 240You can add new 241.Dq virtual interfaces 242by adding the required entries to 243.Pa /etc/ifconfig. Ns Ar interface . 244Read the 245.Xr ifconfig.if 5 246man page for more information on the format of 247.Pa /etc/ifconfig. Ns Ar interface 248files. 249The loopback interface will look something like: 250.Bd -literal -offset indent 251lo0: flags=8009\*[Lt]UP,LOOPBACK,MULTICAST\*[Gt] mtu 32972 252 inet 127.0.0.1 netmask 0xff000000 253 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 254 inet6 ::1 prefixlen 128 255.Ed 256.Pp 257an Ethernet interface something like: 258.Bd -literal -offset indent 259le0: flags=9863\*[Lt]UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST\*[Gt] 260 inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255 261 inet6 fe80::5ef0:f0f0%le0 prefixlen 64 scopeid 0x1 262.Ed 263.Pp 264and a PPP interface something like: 265.Bd -literal -offset indent 266ppp0: flags=8051\*[Lt]UP,POINTOPOINT,RUNNING,MULTICAST\*[Gt] 267 inet 203.3.131.108 --\*[Gt] 198.181.0.253 netmask 0xffff0000 268.Ed 269.Pp 270See 271.Xr mrouted 8 272for instructions on configuring multicast routing. 273.Ss Check routing tables 274Issue a 275.Ic netstat -rn 276command. 277The output will look something like: 278.Bd -literal -offset indent 279Routing tables 280 281Internet: 282Destination Gateway Flags Refs Use Mtu Interface 283default 192.168.4.254 UGS 0 11098028 - le0 284127 127.0.0.1 UGRS 0 0 - lo0 285127.0.0.1 127.0.0.1 UH 3 24 - lo0 286192.168.4 link#1 UC 0 0 - le0 287192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - le0 288192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - le0 289 290Internet6: 291Destination Gateway Flags Refs Use Mtu Interface 292::/96 ::1 UGRS 0 0 32972 lo0 =\*[Gt] 293::1 ::1 UH 4 0 32972 lo0 294::ffff:0.0.0.0/96 ::1 UGRS 0 0 32972 lo0 295fc80::/10 ::1 UGRS 0 0 32972 lo0 296fe80::/10 ::1 UGRS 0 0 32972 lo0 297fe80::%le0/64 link#1 UC 0 0 1500 le0 298fe80::%lo0/64 fe80::1%lo0 U 0 0 32972 lo0 299ff01::/32 ::1 U 0 0 32972 lo0 300ff02::%le0/32 link#1 UC 0 0 1500 le0 301ff02::%lo0/32 fe80::1%lo0 UC 0 0 32972 lo0 302.Ed 303.Pp 304The default gateway address is stored in the 305.Dq Va defaultroute 306variable in 307.Pa /etc/rc.conf , 308or in the file 309.Pa /etc/mygate . 310If you need to edit this file, a painless way to reconfigure the network 311afterwards is to issue 312.Bd -literal -offset indent 313.Ic /etc/rc.d/network restart 314.Ed 315.Pp 316Or, you may prefer to manually configure using a series of 317.Ic route add 318and 319.Ic route delete 320commands (see 321.Xr route 8 ) . 322If you run 323.Xr dhclient 8 324you will have to kill it by running 325.Bd -literal -offset indent 326.Ic /etc/rc.d/dhclient stop 327.Pp 328.Ed 329after you flush the routes. 330.Pp 331If you wish to route packets between interfaces, add one or both 332of the following directives (depending on whether IPv4 or IPv6 routing 333is required) to 334.Pa /etc/sysctl.conf : 335.Pp 336.Dl net.inet.ip.forwarding=1 337.Dl net.inet6.ip6.forwarding=1 338.Pp 339As an alternative, compile a new kernel with the 340.Cm GATEWAY 341option. 342Packets are not forwarded by default, due to RFC requirements. 343.Ss Secure Shell (ssh) 344By default, all services are disabled in a fresh 345.Nx 346installation, and ssh is no exception. 347You may wish to enable it so you can remotely control your system. 348Set 349.Dq Va sshd=yes 350in 351.Pa /etc/rc.conf 352and then starting the server with the command 353.Bd -literal -offset indent 354.Ic /etc/rc.d/sshd start 355.Ed 356.Pp 357The first time the server is started, it will generate a new keypair, 358which will be stored inside the directory 359.Pa /etc/ssh . 360.Ss BIND Name Server (DNS) 361If you are using the BIND Name Server, check the 362.Pa /etc/resolv.conf 363file. 364It may look something like: 365.Bd -literal -offset indent 366domain some.thing.dom 367nameserver 192.168.0.1 368nameserver 192.168.4.55 369search some.thing.dom. thing.dom. 370.Ed 371.Pp 372For further details, see 373.Xr resolv.conf 5 . 374Note the name service lookup order is set via 375.Xr nsswitch.conf 5 376mechanism. 377.Pp 378If using a caching name server add the line "nameserver 127.0.0.1" first. 379To get a local caching name server to run 380you will need to set "named=yes" in 381.Pa /etc/rc.conf 382and create the 383.Pa named.conf 384file in the appropriate place for 385.Xr named 8 , 386usually in 387.Pa /etc/namedb . 388The same holds true if the machine is going to be a 389name server for your domain. 390In both these cases, make sure that 391.Xr named 8 392is running 393(otherwise there are long waits for resolver timeouts). 394.Ss RPC-based network services 395Several services depend on the RPC portmapper 396.Xr rpcbind 8 397- formerly known as 398.Ic portmap 399- being running for proper operation. 400This includes YP (NIS) and NFS exports, among other services. 401To get the RPC portmapper to start automatically on boot, 402you will need to have this line in 403.Pa /etc/rc.conf : 404.Pp 405.Dl rpcbind=YES 406.Ss YP (NIS) Setup 407Check the YP domain name with the 408.Xr domainname 1 409command. 410If necessary, correct it by editing the 411.Pa /etc/defaultdomain 412file or by setting the 413.Dq Va domainname 414variable in 415.Pa /etc/rc.conf . 416The 417.Pa /etc/rc.d/network 418script reads this file on bootup to determine and set the domain name. 419You may also set the running system's domain name with the 420.Xr domainname 1 421command. 422To start YP client services, simply run 423.Ic ypbind , 424then perform the remaining 425YP activation as described in 426.Xr passwd 5 427and 428.Xr group 5 . 429.Pp 430In particular, to enable YP passwd support, you'll need to update 431.Pa /etc/nsswitch.conf 432to include 433.Dq nis 434for the 435.Dq passwd 436and 437.Dq group 438entries. 439A traditional way to accomplish the same thing is to 440add following entry to local passwd database via 441.Xr vipw 8 : 442.Bd -literal -offset indent 443.Li +:*:::::::: 444.Pp 445.Ed 446Note this entry has to be the very last one. 447This traditional way works with the default 448.Xr nsswitch.conf 5 449setting of 450.Dq passwd , 451which is 452.Dq compat . 453.Pp 454There are many more YP man pages available to help you. 455You can find more information by starting with 456.Xr yp 8 . 457.Ss Check disk mounts 458Check that the disks are mounted correctly by 459comparing the 460.Pa /etc/fstab 461file against the output of the 462.Xr mount 8 463and 464.Xr df 1 465commands. 466Example: 467.Bd -literal -offset indent 468.Li # Ic cat /etc/fstab 469/dev/sd0a / ffs rw 1 1 470/dev/sd0b none swap sw 471/dev/sd0e /usr ffs rw 1 2 472/dev/sd0f /var ffs rw 1 3 473/dev/sd0g /tmp ffs rw 1 4 474/dev/sd0h /home ffs rw 1 5 475 476.Li # Ic mount 477/dev/sd0a on / type ffs (local) 478/dev/sd0e on /usr type ffs (local) 479/dev/sd0f on /var type ffs (local) 480/dev/sd0g on /tmp type ffs (local) 481/dev/sd0h on /home type ffs (local) 482 483.Li # Ic df 484Filesystem 1024-blocks Used Avail Capacity Mounted on 485/dev/sd0a 22311 14589 6606 69% / 486/dev/sd0e 203399 150221 43008 78% /usr 487/dev/sd0f 10447 682 9242 7% /var 488/dev/sd0g 18823 2 17879 0% /tmp 489/dev/sd0h 7519 5255 1888 74% /home 490 491.Li # Ic pstat -s 492Device 512-blocks Used Avail Capacity Priority 493/dev/sd0b 131072 84656 46416 65% 0 494.Ed 495.Pp 496Edit 497.Pa /etc/fstab 498and use the 499.Xr mount 8 500and 501.Xr umount 8 502commands as appropriate. 503Refer to the above example and 504.Xr fstab 5 505for information on the format of this file. 506.Pp 507You may wish to do NFS mounts now too, or you can do them later. 508.Ss Concatenated disks (ccd) 509If you are using 510.Xr ccd 4 511concatenated disks, edit 512.Pa /etc/ccd.conf . 513You may wish to take a look to 514.Xr ccdconfig 8 515for more information about this file. 516Use the 517.Ic ccdconfig -U 518command to unload and the 519.Ic ccdconfig -C 520command to create tables internal to the kernel for the concatenated disks. 521You then 522.Xr mount 8 , 523.Xr umount 8 , 524and edit 525.Pa /etc/fstab 526as needed. 527.Ss Automounter daemon (AMD) 528To use the 529.Xr amd 8 530automounter, create the 531.Pa /etc/amd 532directory, copy example config files from 533.Pa /usr/share/examples/amd 534to 535.Pa /etc/amd 536and customize them as needed. 537Alternatively, you can get your maps with YP. 538.Ss Clock synchronization 539In order to make sure the system clock is synchronized 540to that of a publicly accessible NTP server, 541make sure that 542.Pa /etc/rc.conf 543contains the following: 544.Pp 545.Dl ntpdate=yes 546.Dl ntpd=yes 547.Pp 548See 549.Xr date 1 , 550.Xr ntpdate 8 , 551.Xr ntpd 8 , 552.Xr rdate 8 , 553and 554.Xr timed 8 555for more information on setting the system's date. 556.Sh CHANGING /etc FILES 557The system should be usable now, but you may wish to do more customizing, 558such as adding users, etc. 559Many of the following sections may be skipped 560if you are not using that package (for example, skip the 561.Sx Kerberos 562section if you won't be using Kerberos). 563We suggest that you 564.Ic cd /etc 565and edit most of the files in that directory. 566.Pp 567Note that the 568.Pa /etc/motd 569file is modified by 570.Pa /etc/rc.d/motd 571whenever the system is booted. 572To keep any custom message intact, ensure that you leave two blank lines 573at the top, or your message will be overwritten. 574.Ss Add new users 575To add new users and groups, there are 576.Xr useradd 8 577and 578.Xr groupadd 8 , 579see also 580.Xr user 8 581for further programs for user and group manipulation. 582You may use 583.Xr vipw 8 584to add users to the 585.Pa /etc/passwd 586file 587and edit 588.Pa /etc/group 589by hand to add new groups. 590The manual page for 591.Xr su 1 , 592tells you to make sure to put people in 593the 594.Sq wheel 595group if they need root access (non-Kerberos). 596For example: 597.Bd -literal -offset indent 598wheel:*:0:root,myself 599.Ed 600.Pp 601Follow instructions for 602.Xr kerberos 8 603if using 604Kerberos 605for authentication. 606.Ss System boot scripts and /etc/rc.local 607.Pa /etc/rc 608and the 609.Pa /etc/rc.d/* 610scripts are invoked at boot time after single user mode has exited, 611and at shutdown. 612The whole process is controlled by the master script 613.Pa /etc/rc . 614This script should not be changed by administrators. 615.Pp 616The directory 617.Pa /etc/rc.d 618contains a serie of scripts used at startup/shutdown, called by 619.Pa /etc/rc . 620.Pa /etc/rc 621is in turn influenced by the configuration variables present in 622.Pa /etc/rc.conf . 623.Pp 624The script 625.Pa /etc/rc.local 626is run as the last thing during multiuser boot, and is provided 627to allow any other local hooks necessary for the system. 628.Ss rc.conf 629To enable or disable various services on system startup, 630corresponding entries can be made in 631.Pa /etc/rc.conf . 632You can take a look at 633.Pa /etc/defaults/rc.conf 634to see a list of default system variables, which you can override in 635.Pa /etc/rc.conf . 636Note you are 637.Em not 638supposed to change 639.Pa /etc/defaults/rc.conf 640directly, edit only 641.Pa /etc/rc.conf . 642See 643.Xr rc.conf 5 644for further information. 645.Pp 646If you've installed X, you may want to turn on 647.Xr xdm 1 , 648the X Display Manager. 649To do this, set the variable 650.Dq xdm 651to yes in 652.Pa /etc/rc.conf , 653i.e.: 654.Dq xdm=yes 655.Ss Printers 656Edit 657.Pa /etc/printcap 658and 659.Pa /etc/hosts.lpd 660to get any printers set up. 661Consult 662.Xr lpd 8 663and 664.Xr printcap 5 665if needed. 666.Ss Tighten up security 667In 668.Pa /etc/inetd.conf 669comment out any extra entries you do not need, and only add things 670that are really needed. 671Note that by default all services are disabled for security reasons. 672.Ss Kerberos 673If you are going to use Kerberos for authentication, 674see 675.Xr kerberos 8 676and 677.Dq info heimdal 678for more information. 679If you already have a Kerberos master, change directory to 680.Pa /etc/kerberosV 681and configure. 682Remember to get a 683.Pa srvtab 684from the master so that the remote commands work. 685.Ss Mail Aliases 686Check 687.Pa /etc/mail/aliases 688and update appropriately if you want e-mail to be routed 689to non-local address or to different users. 690.Pp 691Run 692.Xr newaliases 1 693after changes. 694.Ss Postfix 695.Nx 696comes also with Postfix in the base system. 697You may wish to set it up in favor of sendmail. 698Take a look to 699.Pa /etc/postfix/main.cf 700and enable the daemon in 701.Pa /etc/rc.conf 702using "postfix=yes". 703It is very important to configure 704.Pa /etc/mailer.conf 705to point to Postfix binaries. 706.Ss DHCP server 707If this is a 708DHCP 709server, edit 710.Pa /etc/dhcpd.conf 711and 712.Pa /etc/dhcpd.interfaces 713as needed. 714You will have to make sure 715.Pa /etc/rc.conf 716has "dhcpd=yes" 717or run 718.Xr dhcpd 8 719manually. 720.Ss Bootparam server 721If this is a 722Bootparam 723server, edit 724.Pa /etc/bootparams 725as needed. 726You will have to turn it on in 727.Pa /etc/rc.conf 728by adding "bootparamd=yes". 729.Ss NFS server 730If this is an NFS server, make sure 731.Pa /etc/rc.conf 732has: 733.Bd -literal -offset indent 734nfs_server=yes 735mountd=yes 736rpcbind=yes 737.Ed 738.Pp 739Edit 740.Pa /etc/exports 741and get it correct. 742After this, you can start the server by issuing: 743.Bd -literal -offset indent 744.Ic /etc/rc.d/rpcbind start 745.Ic /etc/rc.d/mountd start 746.Ic /etc/rc.d/nfsd start 747.Ed 748which will also start dependencies. 749.Ss HP remote boot server 750Edit 751.Pa /etc/rbootd.conf 752if needed for remote booting. 753If you do not have HP computers doing remote booting, do not enable this. 754.Ss Daily, weekly, monthly scripts 755Look at and possibly edit the 756.Pa /etc/daily.conf , /etc/weekly.conf , 757and 758.Pa /etc/monthly.conf 759configuration files. 760You can check which values you can set by looking 761to their matching files in 762.Pa /etc/defaults . 763Your site specific things should go into 764.Pa /etc/daily.local , /etc/weekly.local , 765and 766.Pa /etc/monthly.local . 767.Pp 768These scripts have been limited so as to keep the system running without 769filling up disk space from normal running processes and database updates. 770(You probably do not need to understand them.) 771.Ss Other files in /etc 772Look at the other files in 773.Pa /etc 774and edit them as needed. 775(Do not edit files ending in 776.Pa .db 777\(em like 778.Pa pwd.db , spwd.db , 779nor 780.Pa localtime , 781nor 782.Pa rmt , 783nor any directories.) 784.Ss Crontab (background running processes) 785Check what is running by typing 786.Ic crontab -l 787as root 788and see if anything unexpected is present. 789Do you need anything else? 790Do you wish to change things? 791For example, if you do not 792like root getting standard output of the daily scripts, and want only 793the security scripts that are mailed internally, you can type 794.Ic crontab -e 795and change some of the lines to read: 796.Bd -literal -offset indent 79730 1 * * * /bin/sh /etc/daily 2\*[Gt]\*[Am]1 \*[Gt] /var/log/daily.out 79830 3 * * 6 /bin/sh /etc/weekly 2\*[Gt]\*[Am]1 \*[Gt] /var/log/weekly.out 79930 5 1 * * /bin/sh /etc/monthly 2\*[Gt]\*[Am]1 \*[Gt] /var/log/monthly.out 800.Ed 801.Pp 802See 803.Xr crontab 5 . 804.Ss Next day cleanup 805After the first night's security run, change ownerships and permissions 806on files, directories, and devices; root should have received mail 807with subject: "\*[Lt]hostname\*[Gt] daily insecurity output.". 808This mail contains 809a set of security recommendations, presented as a list looking like this: 810.Bd -literal -offset indent 811var/mail: 812 permissions (0755, 0775) 813etc/daily: 814 user (0, 3) 815.Ed 816.Pp 817The best bet is to follow the advice in that list. 818The recommended setting is the first item in parentheses, while 819the current setting is the second one. 820This list is generated by 821.Xr mtree 8 822using 823.Pa /etc/mtree/special . 824Use 825.Xr chmod 1 , 826.Xr chgrp 1 , 827and 828.Xr chown 8 829as needed. 830.Ss Packages 831Install your own packages. 832The 833.Nx 834packages collection, pkgsrc, includes a large set of third-party software. 835A lot of it is available as binary packages that you can download from 836.Pa ftp://ftp.NetBSD.org/pub/NetBSD/packages/ 837or a mirror, and install using 838.Xr pkg_add 1 . 839See 840.Pa http://www.NetBSD.org/docs/pkgsrc/ 841and 842.Pa pkgsrc/doc/pkgsrc.txt 843for more details. 844.Pp 845Copy vendor binaries and install them. 846You will need to install any shared libraries, etc. 847(Hint: 848.Ic man -k compat 849to find out how to install and use compatibility mode.) 850.Pp 851There is also other third-party software that is available 852in source form only, either because it has not been ported to 853.Nx 854yet, because licensing restrictions make binary redistribution 855impossible, or simply because you want to build your own binaries. 856Sometimes checking the mailing lists for 857past problems that people have encountered will result in a fix posted. 858.Ss Check the running system 859You can use 860.Xr ps 1 , 861.Xr netstat 1 , 862and 863.Xr fstat 1 864to check on running processes, network connections, and opened files, 865respectively. 866Other tools you may find useful are 867.Xr systat 1 868and 869.Xr top 1 . 870.Sh COMPILING A KERNEL 871Note: 872The standard 873.Nx 874kernel configuration (GENERIC) is suitable for most purposes. 875.Pp 876First, review the system message buffer in 877.Pa /var/run/dmesg.boot 878and by using the 879.Xr dmesg 8 880command to find out information on your system's devices as probed by the 881kernel at boot. 882In particular, note which devices were not configured. 883This information will prove useful when editing kernel configuration files. 884.Pp 885To compile a kernel inside a writable source tree, do the following: 886.Bd -literal -offset indent 887$ cd /usr/src/sys/arch/SOMEARCH/conf 888$ cp GENERIC SOMEFILE (only the first time) 889$ vi SOMEFILE (adapt to your needs) 890$ config SOMEFILE 891$ cd ../compile/SOMEFILE 892$ make depend 893$ make 894.Ed 895.Pp 896where 897.Ar SOMEARCH 898is the architecture (e.g., i386), and 899.Ar SOMEFILE 900should be a name indicative of a particular configuration (often 901that of the hostname). 902.Pp 903If you are building your kernel again, before you do a 904.Ic make 905you should do a 906.Ic make clean 907after making changes to your kernel options. 908.Pp 909After either of these two methods, you can place the new kernel (called 910.Pa netbsd ) 911in 912.Pa / 913(i.e., 914.Pa /netbsd ) 915by issuing 916.Ic make install 917and the system will boot it next time. 918The old kernel is stored as 919.Pa /onetbsd 920so you can boot it in case of failure. 921.Pp 922If you are using toolchain to build your kernel, you will also need to 923build a new set of toolchain binaries. 924You can do it by changing into 925.Pa /usr/src 926and issuing: 927.Bd -literal -offset indent 928$ cd /usr/src 929$ K=sys/arch/`uname -m`/conf 930$ cp $K/GENERIC $K/SOMEFILE 931$ vi $K/SOMEFILE (adapt to your needs) 932$ ./build.sh tools 933$ ./build.sh kernel=SOMEFILE 934.Ed 935.Sh SYSTEM TESTING 936At this point, the system should be fully configured to your liking. 937It is now a good time to ensure that the system behaves according to 938its specifications and that it is stable on your hardware. 939You can easily do so by running the test suites available at 940.Pa /usr/tests/ , 941assuming that you installed the 942.Pa tests.tgz 943set. 944If not, you can install it now by running: 945.Bd -literal -offset indent 946# cd / 947# tar xzpf /path/to/tests.tgz 948.Ed 949.Pp 950Once done, edit the 951.Pa /etc/atf/NetBSD.conf 952file to tune the configuration of the test suite, go to 953.Pa /usr/tests/ 954hierarchy and use the 955.Xr atf-run 1 956and 957.Xr atf-report 1 958utilities to run all the tests in an automated way: 959.Bd -literal -offset indent 960# cd /usr/tests/ 961# atf-run | atf-report 962.Ed 963.Pp 964Should any problems appear when running the test suite, please let the 965.Nx 966developers know by sending a message to the appropriate mailing list or 967by sending a problem report. For more details see: 968.Bl -bullet -offset indent 969.It 970.Pa http://www.netbsd.org/mailinglists/ 971.It 972.Pa http://www.netbsd.org/support/send-pr.html 973.El 974.Sh SEE ALSO 975.Xr atf-report 1 , 976.Xr atf-run 1 , 977.Xr chgrp 1 , 978.Xr chmod 1 , 979.Xr config 1 , 980.Xr crontab 1 , 981.Xr date 1 , 982.Xr df 1 , 983.Xr domainname 1 , 984.Xr hostname 1 , 985.Xr make 1 , 986.Xr man 1 , 987.Xr netstat 1 , 988.Xr newaliases 1 , 989.Xr passwd 1 , 990.Xr su 1 , 991.Xr ccd 4 , 992.Xr aliases 5 , 993.Xr crontab 5 , 994.Xr exports 5 , 995.Xr fstab 5 , 996.Xr group 5 , 997.Xr krb.conf 5 , 998.Xr krb.realms 5 , 999.Xr mailer.conf 5 , 1000.Xr passwd 5 , 1001.Xr rc.conf 5 , 1002.Xr resolv.conf 5 , 1003.Xr hier 7 , 1004.Xr hostname 7 , 1005.Xr pkgsrc 7 , 1006.Xr adduser 8 , 1007.Xr amd 8 , 1008.Xr bootparamd 8 , 1009.Xr ccdconfig 8 , 1010.Xr chown 8 , 1011.Xr dhcpd 8 , 1012.Xr ifconfig 8 , 1013.Xr inetd 8 , 1014.Xr kerberos 8 , 1015.Xr mount 8 , 1016.Xr mrouted 8 , 1017.Xr mtree 8 , 1018.Xr named 8 , 1019.Xr rbootd 8 , 1020.Xr rc 8 , 1021.Xr rmt 8 , 1022.Xr route 8 , 1023.Xr umount 8 , 1024.Xr vipw 8 , 1025.Xr ypbind 8 1026.Sh HISTORY 1027This document first appeared in 1028.Ox 2.2 . 1029It has been adapted to 1030.Nx 1031and first appeared in 1032.Nx 2.0 . 1033