1.\" $NetBSD: afterboot.8,v 1.10 2003/10/12 11:50:29 jdolecek Exp $ 2.\" 3.\" Copyright (c) 2002-2003 The NetBSD Foundation, Inc. 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. All advertising materials mentioning features or use of this software 15.\" must display the following acknowledgement: 16.\" This product includes software developed by the NetBSD 17.\" Foundation, Inc. and its contributors. 18.\" 4. Neither the name of The NetBSD Foundation nor the names of its 19.\" contributors may be used to endorse or promote products derived 20.\" from this software without specific prior written permission. 21.\" 22.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 23.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 24.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 25.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 26.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 27.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 28.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 29.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 30.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 31.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 32.\" POSSIBILITY OF SUCH DAMAGE. 33.\" 34.\" $OpenBSD: afterboot.8,v 1.72 2002/02/22 02:02:33 miod Exp $ 35.\" 36.\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu 37.\" Adapted to NetBSD by Julio Merino -- 2002-05-10, jmmv@hispabsd.org 38.\" 39.Dd March 10, 2003 40.Dt AFTERBOOT 8 41.Os 42.Sh NAME 43.Nm afterboot 44.Nd things to check after the first complete boot 45.Sh DESCRIPTION 46.Ss Starting Out 47This document attempts to list items for the system administrator 48to check and set up after the installation and first complete boot of the 49system. 50The idea is to create a list of items that can be checked off so that you have 51a warm fuzzy feeling that something obvious has not been missed. 52A basic knowledge of 53.Ux 54is assumed. 55.Pp 56Complete instructions for correcting and fixing items is not provided. 57There are manual pages and other methodologies available for doing that. 58For example, to view the man page for the 59.Xr ls 1 60command, type: 61.Bd -literal -offset indent 62.Ic man 1 ls 63.Ed 64.Pp 65Administrators will rapidly become more familiar with 66.Nx 67if they get used to using the manual pages. 68.Ss Security alerts 69By the time that you have installed your system, it is quite likely that 70bugs in the release have been found. 71All significant and easily fixed problems will be reported at 72.Pa http://www.NetBSD.org/Security/ . 73It is recommended that you check this page regularly. 74.Ss Login 75Login as 76.Dq Ic root . 77You can do so on the console, or over the network using 78.Xr ssh 1 . 79If you wish to allow root logins over the network (if you have 80enabled the ssh daemon), edit the 81.Pa /etc/ssh/sshd_config 82file and set 83.Cm PermitRootLogin 84to 85.Dq yes 86(see 87.Xr sshd 8 ) . 88The default is to not permit root logins over the network 89after fresh install in 90.Nx . 91Note defaults on other operating systems might be different. 92.Pp 93Upon successful login on the console, you may see the message 94.Dq We recommend creating a non-root account... . 95For security reasons, it is bad practice to login as root during 96regular use and maintenance of the system. 97Instead, administrators are encouraged to add a 98.Dq regular 99user, add said user to the 100.Dq wheel 101group, then use the 102.Ic su 103and 104.Ic sudo 105commands when root privileges are required. 106This process is described in more detail later. 107.Ss Root password 108Change the password for the root user. 109(Note that throughout the documentation, the term 110.Dq superuser 111is a synonym for the root user.) 112Choose a password that has numbers, digits, and special characters (not space) 113as well as from the upper and lower case alphabet. 114Do not choose any word in any language. 115It is common for an intruder to use dictionary attacks. 116Type the command 117.Ic /usr/bin/passwd 118to change it. 119.Pp 120It is a good idea to always specify the full path name for both the 121.Xr passwd 1 122and 123.Xr su 1 124commands as this inhibits the possibility of files placed in your execution 125.Ev PATH 126for most shells. 127Furthermore, the superuser's 128.Ev PATH 129should never contain the current directory 130.Po Dq \&. 131.Pc . 132.Ss System date 133Check the system date with the 134.Xr date 1 135command. 136If needed, change the date, and/or change the symbolic link of 137.Pa /etc/localtime 138to appropriate time zone in the 139.Pa /usr/share/zoneinfo 140directory. 141.Pp 142Examples: 143.Bl -tag -width date 144.It Cm date 200205101820 145Set the current date to May 10th, 2002 6:20pm. 146.It Cm ln -fs /usr/share/zoneinfo/Europe/Helsinki /etc/localtime 147Set the time zone to Eastern Europe Summer Time. 148.El 149.Ss Console settings 150One of the first things you will likely need to do is to set up your 151keyboard map (and maybe some other aspects about the system console). 152To change your keyboard encoding, edit the 153.Dq Va encoding 154variable found in 155.Pa /etc/wscons.conf . 156.Pp 157.Xr wscons.conf 5 158contains more information about this file. 159.Ss Check hostname 160Use the 161.Ic hostname 162command to verify that the name of your machine is correct. 163See the man page for 164.Xr hostname 1 165if it needs to be changed. 166You will also need to change the contents of the 167.Dq Va hostname 168variable in 169.Pa /etc/rc.conf 170or edit the 171.Pa /etc/myname 172file 173to have it stick around for the next reboot. 174Note that hostname is supposed to be FQDN commonly and should 175not be confused with YP 176.Xr domainname 1 . 177.Ss Verify network interface configuration 178The first thing to do is an 179.Ic ifconfig -a 180to see if the network interfaces are properly configured. 181Correct by editing 182.Pa /etc/ifconfig. Ns Ar interface 183(where 184.Ar interface 185is the interface name, e.g., 186.Dq le0 ) 187and then using 188.Xr ifconfig 8 189to manually configure it 190if you do not wish to reboot. 191Read the 192.Xr ifconfig.if 5 193man page for more information on the format of 194.Pa /etc/ifconfig. Ns Ar interface 195files. 196The loopback interface will look something like: 197.Bd -literal -offset indent 198lo0: flags=8009\*[Lt]UP,LOOPBACK,MULTICAST\*[Gt] mtu 32972 199 inet 127.0.0.1 netmask 0xff000000 200 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 201 inet6 ::1 prefixlen 128 202.Ed 203.Pp 204an Ethernet interface something like: 205.Bd -literal -offset indent 206le0: flags=9863\*[Lt]UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST\*[Gt] 207 inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255 208 inet6 fe80::5ef0:f0f0%le0 prefixlen 64 scopeid 0x1 209.Ed 210.Pp 211and, a PPP interface something like: 212.Bd -literal -offset indent 213ppp0: flags=8051\*[Lt]UP,POINTOPOINT,RUNNING,MULTICAST\*[Gt] 214 inet 203.3.131.108 --\*[Gt] 198.181.0.253 netmask 0xffff0000 215.Ed 216.Pp 217See 218.Xr mrouted 8 219for instructions on configuring multicast routing. 220.Pp 221See 222.Xr dhcpd 8 223for instructions on configuring interfaces with DHCP. 224.Ss Check routing tables 225Issue a 226.Ic netstat -rn 227command. 228The output will look something like: 229.Bd -literal -offset indent 230Routing tables 231 232Internet: 233Destination Gateway Flags Refs Use Mtu Interface 234default 192.168.4.254 UGS 0 11098028 - le0 235127 127.0.0.1 UGRS 0 0 - lo0 236127.0.0.1 127.0.0.1 UH 3 24 - lo0 237192.168.4 link#1 UC 0 0 - le0 238192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - le0 239192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - le0 240 241Internet6: 242Destination Gateway Flags Refs Use Mtu Interface 243::/96 ::1 UGRS 0 0 32972 lo0 =\*[Gt] 244::1 ::1 UH 4 0 32972 lo0 245::ffff:0.0.0.0/96 ::1 UGRS 0 0 32972 lo0 246fc80::/10 ::1 UGRS 0 0 32972 lo0 247fe80::/10 ::1 UGRS 0 0 32972 lo0 248fe80::%le0/64 link#1 UC 0 0 1500 le0 249fe80::%lo0/64 fe80::1%lo0 U 0 0 32972 lo0 250ff01::/32 ::1 U 0 0 32972 lo0 251ff02::%le0/32 link#1 UC 0 0 1500 le0 252ff02::%lo0/32 fe80::1%lo0 UC 0 0 32972 lo0 253 254.Ed 255.Pp 256The default gateway address is stored in the 257.Dq Va defaultroute 258variable 259.Pa /etc/rc.conf , 260or in the file 261.Pa /etc/mygate . 262If you need to edit this file, a painless way to reconfigure the network 263afterwards is to issue 264.Bd -literal -offset indent 265.Ic /etc/rc.d/network restart 266.Ed 267.Pp 268Or, you may prefer to manually configure using a series of 269.Ic route add 270and 271.Ic route delete 272commands (see 273.Xr route 8 ) . 274If you run 275.Xr dhclient 8 276you will have to kill it by running 277.Bd -literal -offset indent 278.Ic /etc/rc.d/dhclient stop 279.Pp 280.Ed 281after you flush the routes. 282.Pp 283If you wish to route packets between interfaces, add the directive 284.Dl net.inet.ip.forwarding=1 285and/or 286.Dl net.inet6.ip6.forwarding=1 287.Pp 288to 289.Pa /etc/sysctl.conf , 290or compile a new kernel with the 291.Cm GATEWAY 292option. 293Packets are not forwarded by default, due to RFC requirements. 294.Pp 295You can add new 296.Dq virtual interfaces 297by adding the required entries to 298.Pa /etc/ifconfig.if . 299.Ss Secure Shell (ssh) 300By default, all services are disabled (and ssh is no exception). 301You may wish to enable it so you can remotely control your system. 302Set "sshd=yes" in 303.Pa /etc/rc.conf 304and then starting the server with the command 305.Bd -literal -offset indent 306.Ic /etc/rc.d/sshd start 307.Ed 308.Pp 309The first time the server is started, it will generate a new keypair, 310which will be stored inside the directory 311.Pa /etc/ssh . 312.Ss BIND Name Server (DNS) 313If you are using the BIND Name Server, check the 314.Pa /etc/resolv.conf 315file. 316It may look something like: 317.Bd -literal -offset indent 318domain some.thing.dom 319nameserver 192.168.0.1 320nameserver 192.168.4.55 321search some.thing.dom. thing.dom. 322.Ed 323.Pp 324For further details, see 325.Xr resolv.conf 5 . 326Note the name service lookup order is set via 327.Xr nsswitch.conf 5 328mechanism. 329.Pp 330If using a caching name server add the line "nameserver 127.0.0.1" first. 331To get a local caching name server to run 332you will need to set "named=yes" in 333.Pa /etc/rc.conf 334and create the 335.Pa named.conf 336file in the appropriate place for 337.Xr named 8 , 338usually in 339.Pa /etc/namedb . 340The same holds true if the machine is going to be a 341name server for your domain. 342In both these cases, make sure that 343.Xr named 8 344is running 345(otherwise there are long waits for resolver timeouts). 346.Ss YP Setup 347Check the YP domain name with the 348.Xr domainname 1 349command. 350If necessary, correct it by editing the 351.Pa /etc/defaultdomain 352file or by setting the 353.Dq Va domainname 354variable in 355.Pa /etc/rc.conf . 356The 357.Pa /etc/rc.d/network 358script reads this file on bootup to determine and set the domain name. 359You may also set the running system's domain name with the 360.Xr domainname 1 361command. 362To start YP client services, simply run 363.Ic ypbind , 364then perform the remaining 365YP activation as described in 366.Xr passwd 5 367and 368.Xr group 5 . 369.Pp 370In particular, to enable YP passwd support, you'd need to update 371.Pa /etc/nsswitch.conf 372to include 373.Dq nis 374for the 375.Dq passwd 376entry. 377A traditional way to accomplish the same thing is to 378add following entry to local passwd database via 379.Xr vipw 8 : 380.Bd -literal -offset indent 381.Li +:*:::::::: 382.Pp 383.Ed 384Note this entry has to be the very last one. 385This traditional way works with the default 386.Xr nsswitch.conf 5 387setting of 388.Dq passwd , 389which is 390.Dq compat . 391.Pp 392You can find more information by starting with 393.Xr yp 8 . 394.Ss Check disk mounts 395Check that the disks are mounted correctly by 396comparing the 397.Pa /etc/fstab 398file against the output of the 399.Xr mount 8 400and 401.Xr df 1 402commands. 403Example: 404.Bd -literal -offset indent 405.Li # Ic cat /etc/fstab 406/dev/sd0a / ffs rw 1 1 407/dev/sd0b none swap sw 0 0 408/dev/sd0e /usr ffs rw 1 2 409/dev/sd0f /var ffs rw 1 3 410/dev/sd0g /tmp ffs rw 1 4 411/dev/sd0h /home ffs rw 1 5 412.Li # Ic mount 413/dev/sd0a on / type ffs (local) 414/dev/sd0e on /usr type ffs (local) 415/dev/sd0f on /var type ffs (local) 416/dev/sd0g on /tmp type ffs (local) 417/dev/sd0h on /home type ffs (local) 418.Li # Ic df 419Filesystem 1024-blocks Used Avail Capacity Mounted on 420/dev/sd0a 22311 14589 6606 69% / 421/dev/sd0e 203399 150221 43008 78% /usr 422/dev/sd0f 10447 682 9242 7% /var 423/dev/sd0g 18823 2 17879 0% /tmp 424/dev/sd0h 7519 5255 1888 74% /home 425.Li # Ic pstat -s 426Device 512-blocks Used Avail Capacity Priority 427/dev/sd0b 131072 84656 46416 65% 0 428.Ed 429.Pp 430Edit 431.Pa /etc/fstab 432and use the 433.Xr mount 8 434and 435.Xr umount 8 436commands as appropriate. 437Refer to the above example and 438.Xr fstab 5 439for information on the format of this file. 440.Pp 441You may wish to do NFS mounts now too, or you can do them later. 442.Ss Concatenated disks (ccd) 443If you are using 444.Xr ccd 4 445concatenated disks, edit 446.Pa /etc/ccd.conf . 447You may wish to take a look to 448.Xr ccdconfig 8 449for more information about this file. 450Use the 451.Ic ccdconfig -U 452command to unload and the 453.Ic ccdconfig -C 454command to create tables internal to the kernel for the concatenated disks. 455You then 456.Xr mount 8 , 457.Xr umount 8 , 458and edit 459.Pa /etc/fstab 460as needed. 461.Ss CHANGING /etc FILES 462The system should be usable now, but you may wish to do more 463customization, such as adding users, etc. 464Many of the following sections may be skipped 465if you are not using that package (for example, skip the 466.Sx Kerberos 467section if you won't be using Kerberos). 468We suggest that you 469.Ic cd /etc 470and edit most of the files in that directory. 471.Pp 472Note that the 473.Pa /etc/motd 474file is modified by 475.Pa /etc/rc.d/motd 476whenever the system is booted. 477To keep any custom message intact, ensure that you leave two blank lines 478at the top, or your message will be overwritten. 479.Ss Sushi 480Since 481.Nx 1.6 , 482a new tool for configuring the system has been 483included, called 484.Xr sushi 8 . 485It will allow you to set up many aspects of the 486system from interactive menus. 487You can launch it typing: 488.Bd -literal -offset indent 489.Ic sushi 490.Ed 491.Ss Add new users 492There are 493.Xr useradd 8 494and 495.Xr groupadd 8 496scripts. 497You may use 498.Xr vipw 8 499to add users to the 500.Pa /etc/passwd 501file 502and edit 503.Pa /etc/group 504by hand to add new groups. 505The manual page for 506.Xr su 1 , 507tells you to make sure to put people in 508the 509.Sq wheel 510group if they need root access (non-Kerberos). 511For example: 512.Bd -literal -offset indent 513wheel:*:0:root,myself 514.Ed 515.Pp 516Follow instructions for 517.Xr kerberos 8 518if using 519Kerberos 520for authentication. 521.Ss rc.conf, rc.local 522Check for any local changes needed in the files 523.Pa /etc/rc.conf , 524and 525.Pa /etc/rc.local . 526.Pp 527.Xr rc.conf 5 528contains configuration for various daemons included with 529the system. 530Script 531.Pa /etc/rc.local 532is run as the last thing during multiuser boot, and is provided 533to allow any other local hooks necessary for the system. 534.Pp 535You can take a look to 536.Pa /etc/defaults/rc.conf 537to see a list of default system variables, which you can override in 538.Pa /etc/rc.conf . 539Note you are 540.Em not 541supposed to change 542.Pa /etc/defaults/rc.conf 543directly, edit only 544.Pa /etc/rc.conf . 545See 546.Xr rc.conf 5 547for further information. 548.Pp 549The directory 550.Pa /etc/rc.d 551contains a serie of scripts used at startup/shutdown, called by 552.Pa /etc/rc . 553.Pp 554If you've installed X, you may want to turn on 555.Xr xdm 1 , 556the X Display Manager. 557To do this, set the variable xdm to yes, i.e., "xdm=yes", in 558.Pa /etc/rc.conf . 559.Ss Printers 560Edit 561.Pa /etc/printcap 562and 563.Pa /etc/hosts.lpd 564to get any printers set up. 565Consult 566.Xr lpd 8 567and 568.Xr printcap 5 569if needed. 570.Ss Tighten up security 571In 572.Pa /etc/inetd.conf 573comment out any extra entries you do not need, and only add things 574that are really needed. 575Note that by default all services are disabled for security reasons. 576.Ss Kerberos 577If you are going to use 578.Xr kerberos 8 579for authentication, and you already have a 580Kerberos 581master, change directory to 582.Pa /etc/kerberosIV 583or 584.Pa /etc/kerberosV 585and configure. 586Remember to get a 587.Pa srvtab 588from the master so that the remote commands work. 589.Ss Mail Aliases 590Check 591.Pa /etc/mail/aliases 592and update appropriately if you want e-mail to be routed 593to non-local address or to different users. 594.Pp 595Run 596.Xr newaliases 1 597after changes. 598.Ss Sendmail 599.Nx 600ships with a default 601.Pa /etc/mail/sendmail.cf 602file that will work for simple installations; it was generated from 603.Pa netbsd-proto.mc 604in 605.Pa /usr/share/sendmail/cf . 606Please see 607.Pa /usr/share/sendmail/README 608and 609.Pa /usr/share/doc/smm/08.sendmailop/op.me 610for information on generating your own sendmail configuration files. 611.Pa /etc/mailer.conf 612is configured to use Sendmail binaries by default. 613.Ss Postfix 614.Nx 615comes also with Postfix in the base system. 616You may wish to set it up in favor of sendmail. 617Take a look to 618.Pa /etc/postfix/main.cf 619and enable the daemon in 620.Pa /etc/rc.conf 621using "postfix=yes". 622It is very important to configure 623.Pa /etc/mailer.conf 624to point to Postfix binaries. 625.Ss DHCP server 626If this is a 627DHCP 628server, edit 629.Pa /etc/dhcpd.conf 630and 631.Pa /etc/dhcpd.interfaces 632as needed. 633You will have to make sure 634.Pa /etc/rc.conf 635has "dhcpd=yes" 636or run 637.Xr dhcpd 8 638manually. 639.Ss Bootparam server 640If this is a 641Bootparam 642server, edit 643.Pa /etc/bootparams 644as needed. 645You will have to turn it on in 646.Pa /etc/rc.conf 647by adding "bootparamd=yes". 648.Ss NFS server 649If this is an NFS server, make sure 650.Pa /etc/rc.conf 651has: 652.Bd -literal -offset indent 653nfs_server=yes 654mountd=yes 655rpcbind=yes 656.Ed 657.Pp 658Edit 659.Pa /etc/exports 660and get it correct. 661After this, you can start the server by issuing: 662.Bd -literal -offset indent 663.Ic /etc/rc.d/nfsd start 664.Ed 665which will also start dependancies. 666.Ss HP remote boot server 667Edit 668.Pa /etc/rbootd.conf 669if needed for remote booting. 670If you do not have HP computers doing remote booting, do not enable this. 671.Ss Daily, weekly, monthly scripts 672Look at and possibly edit the 673.Pa /etc/daily.conf , /etc/weekly.conf , 674and 675.Pa /etc/monthly.conf 676configuration files. 677You can check which values you can set by looking 678to their matching files in 679.Pa /etc/defaults . 680Your site specific things should go into 681.Pa /etc/daily.local , /etc/weekly.local , 682and 683.Pa /etc/monthly.local . 684.Pp 685These scripts have been limited so as to keep the system running without 686filling up disk space from normal running processes and database updates. 687(You probably do not need to understand them.) 688.Ss Other files in /etc 689Look at the other files in 690.Pa /etc 691and edit them as needed. 692(Do not edit files ending in 693.Pa .db 694\(em like 695.Pa pwd.db , spwd.db , 696nor 697.Pa localtime , 698nor 699.Pa rmt , 700nor any directories.) 701.Ss Crontab (background running processes) 702Check what is running by typing 703.Ic crontab -l 704as root 705and see if anything unexpected is present. 706Do you need anything else? 707Do you wish to change things? 708e.g., if you do not 709like root getting standard output of the daily scripts, and want only 710the security scripts that are mailed internally, you can type 711.Ic crontab -e 712and change some of the lines to read: 713.Bd -literal -offset indent 71430 1 * * * /bin/sh /etc/daily 2\*[Gt]\*[Am]1 \*[Gt] /var/log/daily.out 71530 3 * * 6 /bin/sh /etc/weekly 2\*[Gt]\*[Am]1 \*[Gt] /var/log/weekly.out 71630 5 1 * * /bin/sh /etc/monthly 2\*[Gt]\*[Am]1 \*[Gt] /var/log/monthly.out 717.Ed 718.Pp 719See 720.Xr crontab 5 . 721.Ss Next day cleanup 722After the first night's security run, change ownerships and permissions 723on files, directories, and devices; root should have received mail 724with subject: "\*[Lt]hostname\*[Gt] daily insecurity output.". 725This mail contains 726a set of security recommendations, presented as a list looking like this: 727.Bd -literal -offset indent 728var/mail: 729 permissions (0755, 0775) 730etc/daily: 731 user (0, 3) 732.Ed 733.Pp 734The best bet is to follow the advice in that list. 735The recommended setting is the first item in parentheses, while 736the current setting is the second one. 737This list is generated by 738.Xr mtree 8 739using 740.Pa /etc/mtree/special . 741Use 742.Xr chmod 1 , 743.Xr chgrp 1 , 744and 745.Xr chown 8 746as needed. 747.Ss Packages 748Install your own packages. 749The 750.Nx 751package collection includes a large set of Third-Party software. 752A lot of it is available as binary packages that you can download from 753.Pa ftp://ftp.NetBSD.org/ 754or a mirror, and install using 755.Xr pkg_add 1 . 756See 757.Pa http://www.NetBSD.org/Documentation/software/ 758and 759.Xr packages 7 760for more details. 761.Pp 762Copy vendor binaries and install them. 763You will need to install any shared libraries, etc. 764(Hint: 765.Ic man -k compat 766to find out how to install and use compatibility mode.) 767.Pp 768There is also other Third-Party Software that is available 769in source form only, either because it has not been ported to 770.Nx 771yet, because licensing restrictions make binary redistribution 772impossible, or simply because you want to build your own binaries. 773This group is called pkgsrc. 774Sometimes checking the mailing lists for 775past problems that people have encountered will result in a fix posted. 776.Ss COMPILING A KERNEL 777First, review the system message buffer using the 778.Xr dmesg 8 779command to find out information on your system's devices as probed by the 780kernel at boot. 781In particular, note which devices were not configured. 782This information will prove useful when editing kernel configuration files. 783.Pp 784To compile a kernel inside a writable source tree, do the following: 785.Bd -literal -offset indent 786# cd /usr/src/sys/arch/SOMEARCH/conf 787# cp GENERIC SOMEFILE (only the first time) 788# vi SOMEFILE (adapt to your needs) 789# config SOMEFILE 790# cd ../compile/SOMEFILE 791# make depend 792# make 793.Ed 794.Pp 795where 796.Ar SOMEARCH 797is the architecture (e.g., i386), and 798.Ar SOMEFILE 799should be a name indicative of a particular configuration (often 800that of the hostname). 801.Pp 802If you are building your kernel again, before you do a 803.Ic make 804you should do a 805.Ic make clean 806after making changes to your kernel options. 807.Pp 808After either of these two methods, you can place the new kernel (called 809.Pa netbsd ) 810in 811.Pa / 812(i.e., 813.Pa /netbsd ) 814by issuing 815.Ic make install 816and the system will boot it next time. 817The old kernel is stored as 818.Pa /onetbsd 819so you can boot it in case of failure. 820.Pp 821If you are using toolchain to build your kernel, you will also need to 822build a new set of toolchain binaries. 823You can do it by entering 824.Pa /usr/src 825and issuing 826.Ic ./build.sh tools 827.Sh SEE ALSO 828.Xr chgrp 1 , 829.Xr chmod 1 , 830.Xr crontab 1 , 831.Xr date 1 , 832.Xr df 1 , 833.Xr domainname 1 , 834.Xr hostname 1 , 835.Xr make 1 , 836.Xr man 1 , 837.Xr netstat 1 , 838.Xr newaliases 1 , 839.Xr passwd 1 , 840.Xr su 1 , 841.Xr ccd 4 , 842.Xr aliases 5 , 843.Xr crontab 5 , 844.Xr exports 5 , 845.Xr fstab 5 , 846.Xr group 5 , 847.Xr krb.conf 5 , 848.Xr krb.realms 5 , 849.Xr mailer.conf 5 , 850.Xr passwd 5 , 851.Xr rc.conf 5 , 852.Xr resolv.conf 5 , 853.Xr hostname 7 , 854.Xr packages 7 , 855.Xr adduser 8 , 856.Xr amd 8 , 857.Xr bootparamd 8 , 858.Xr ccdconfig 8 , 859.Xr chown 8 , 860.Xr config 8 , 861.Xr dhcpd 8 , 862.Xr ifconfig 8 , 863.Xr inetd 8 , 864.Xr kerberos 8 , 865.Xr mount 8 , 866.Xr mrouted 8 , 867.Xr mtree 8 , 868.Xr named 8 , 869.Xr rbootd 8 , 870.Xr rc 8 , 871.Xr rmt 8 , 872.Xr route 8 , 873.Xr sushi 8 , 874.Xr umount 8 , 875.Xr vipw 8 , 876.Xr ypbind 8 877.Sh HISTORY 878This document first appeared in 879.Ox 2.2 . 880It has been adapted to 881.Nx 882and first appeared in 883.Nx 2.0 . 884