1.\" $NetBSD: afterboot.8,v 1.43 2010/01/20 22:24:18 jmmv Exp $ 2.\" $OpenBSD: afterboot.8,v 1.72 2002/02/22 02:02:33 miod Exp $ 3.\" 4.\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu 5.\" Adapted to NetBSD by Julio Merino -- 2002-05-10, jmmv@NetBSD.org 6.\" 7.\" 8.\" Copyright (c) 2002-2008 The NetBSD Foundation, Inc. 9.\" All rights reserved. 10.\" 11.\" Redistribution and use in source and binary forms, with or without 12.\" modification, are permitted provided that the following conditions 13.\" are met: 14.\" 1. Redistributions of source code must retain the above copyright 15.\" notice, this list of conditions and the following disclaimer. 16.\" 2. Redistributions in binary form must reproduce the above copyright 17.\" notice, this list of conditions and the following disclaimer in the 18.\" documentation and/or other materials provided with the distribution. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 21.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 24.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30.\" POSSIBILITY OF SUCH DAMAGE. 31.\" 32.\" 33.\" Copyright (c) 1997 Marshall M. Midden 34.\" All rights reserved. 35.\" 36.\" Redistribution and use in source and binary forms, with or without 37.\" modification, are permitted provided that the following conditions 38.\" are met: 39.\" 40.\" 1. Redistributions of source code must retain the above copyright 41.\" notice, this list of conditions and the following disclaimer. 42.\" 2. Redistributions in binary form must reproduce the above copyright 43.\" notice, this list of conditions and the following disclaimer in the 44.\" documentation and/or other materials provided with the distribution. 45.\" 3. All advertising materials mentioning features or use of this software 46.\" must display the following acknowledgement: 47.\" This product includes software developed by Marshall M. Midden. 48.\" 4. The name of the author may not be used to endorse or promote products 49.\" derived from this software without specific prior written permission. 50.\" 51.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 52.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 53.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 54.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 55.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 56.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 57.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 58.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 59.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 60.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 61.\" 62.Dd January 20, 2010 63.Dt AFTERBOOT 8 64.Os 65.Sh NAME 66.Nm afterboot 67.Nd things to check after the first complete boot 68.Sh DESCRIPTION 69.Ss Starting Out 70This document attempts to list items for the system administrator 71to check and set up after the installation and first complete boot of the 72system. 73The idea is to create a list of items that can be checked off so that you have 74a warm fuzzy feeling that something obvious has not been missed. 75A basic knowledge of 76.Ux 77is assumed. 78.Pp 79Complete instructions for correcting and fixing items is not provided. 80There are manual pages and other methodologies available for doing that. 81For example, to view the man page for the 82.Xr ls 1 83command, type: 84.Bd -literal -offset indent 85.Ic man 1 ls 86.Ed 87.Pp 88Administrators will rapidly become more familiar with 89.Nx 90if they get used to using the manual pages. 91.Ss Security alerts 92By the time that you have installed your system, it is quite likely that 93bugs in the release have been found. 94All significant and easily fixed problems will be reported at 95.Pa http://www.NetBSD.org/support/security/ . 96It is recommended that you check this page regularly. 97.Pp 98Additionally, you should set 99.Dq fetch_pkg_vulnerabilities=YES 100in 101.Pa /etc/daily.conf 102to allow your system to automatically update the local database of known 103vulnerable packages to the latest version available on-line. 104The system will later check, on a daily basis, if any of your installed 105packages are vulnerable based on the contents of this database. 106See 107.Xr daily.conf 5 108and 109.Xr security.conf 5 110for more details. 111.Ss Login 112Login as 113.Dq Ic root . 114You can do so on the console, or over the network using 115.Xr ssh 1 . 116If you have enabled the ssh daemon and wish to allow root logins over 117the network, edit the 118.Pa /etc/ssh/sshd_config 119file and set 120.Cm PermitRootLogin 121to 122.Dq yes 123(see 124.Xr sshd_config 5 ) . 125The default is to not permit root logins over the network 126after fresh install in 127.Nx . 128.Pp 129Upon successful login on the console, you may see the message 130.Dq We recommend creating a non-root account... . 131For security reasons, it is bad practice to login as root during 132regular use and maintenance of the system. 133In fact, the system will only let you login as root on a secure 134terminal. 135By default, only the console is considered to be a secure terminal. 136Instead, administrators are encouraged to add a 137.Dq regular 138user, add said user to the 139.Dq wheel 140group, then use the 141.Xr su 1 142command when root privileges are required. 143This process is described in more detail later. 144.Ss Root password 145Change the password for the root user. 146(Note that throughout the documentation, the term 147.Dq superuser 148is a synonym for the root user.) 149Choose a password that has numbers, digits, and special characters (not space) 150as well as from the upper and lower case alphabet. 151Do not choose any word in any language. 152It is common for an intruder to use dictionary attacks. 153Type the command 154.Ic /usr/bin/passwd 155to change it. 156.Pp 157It is a good idea to always specify the full path name for both the 158.Xr passwd 1 159and 160.Xr su 1 161commands as this inhibits the possibility of files placed in your execution 162.Ev PATH 163for most shells. 164Furthermore, the superuser's 165.Ev PATH 166should never contain the current directory 167.Po Dq \&. 168.Pc . 169.Ss System date 170Check the system date with the 171.Xr date 1 172command. 173If needed, change the date, and/or change the symbolic link of 174.Pa /etc/localtime 175to the correct time zone in the 176.Pa /usr/share/zoneinfo 177directory. 178.Pp 179Examples: 180.Bl -tag -width date 181.It Cm date 200205101820 182Set the current date to May 10th, 2002 6:20pm. 183.It Cm ln -fs /usr/share/zoneinfo/Europe/Helsinki /etc/localtime 184Set the time zone to Eastern Europe Summer Time. 185.El 186.Ss Console settings 187One of the first things you will likely need to do is to set up your 188keyboard map (and maybe some other aspects about the system console). 189To change your keyboard encoding, edit the 190.Dq Va encoding 191variable found in 192.Pa /etc/wscons.conf . 193.Pp 194.Xr wscons.conf 5 195contains more information about this file. 196.Ss Check hostname 197Use the 198.Ic hostname 199command to verify that the name of your machine is correct. 200See the man page for 201.Xr hostname 1 202if it needs to be changed. 203You will also need to change the contents of the 204.Dq Va hostname 205variable in 206.Pa /etc/rc.conf 207or edit the 208.Pa /etc/myname 209file to have it stick around for the next reboot. 210Note that 211.Dq Va hostname 212is supposed include a domainname, and that this should 213not be confused with YP (NIS) 214.Xr domainname 1 . 215If you are using 216.Xr dhclient 8 217to configure network interfaces, it might override these local hostname 218settings if your DHCP server specifies client's hostname with other network 219configurations. 220.Ss Verify network interface configuration 221The first thing to do is an 222.Ic ifconfig -a 223to see if the network interfaces are properly configured. 224Correct by editing 225.Pa /etc/ifconfig. Ns Ar interface 226or the corresponding 227.Dq Va ifconfig_ Ns Ar interface 228variable in 229.Xr rc.conf 5 230(where 231.Ar interface 232is the interface name, e.g., 233.Dq le0 ) 234and then using 235.Xr ifconfig 8 236to manually configure it 237if you do not wish to reboot. 238.Pp 239Alternatively, you can configure interfaces automatically via DHCP with 240.Xr dhclient 8 241if you have a DHCP server running somewhere on your network. 242To get 243.Xr dhclient 8 244to start automatically on boot, 245you will need to have this line in 246.Pa /etc/rc.conf : 247.Pp 248.Dl dhclient=YES 249.Pp 250See 251.Xr dhclient 8 252and 253.Xr dhclient.conf 5 254for more information on setting up a DHCP client. 255.Pp 256You can add new 257.Dq virtual interfaces 258by adding the required entries to 259.Pa /etc/ifconfig. Ns Ar interface . 260Read the 261.Xr ifconfig.if 5 262man page for more information on the format of 263.Pa /etc/ifconfig. Ns Ar interface 264files. 265The loopback interface will look something like: 266.Bd -literal -offset indent 267lo0: flags=8009\*[Lt]UP,LOOPBACK,MULTICAST\*[Gt] mtu 32972 268 inet 127.0.0.1 netmask 0xff000000 269 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 270 inet6 ::1 prefixlen 128 271.Ed 272.Pp 273an Ethernet interface something like: 274.Bd -literal -offset indent 275le0: flags=9863\*[Lt]UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST\*[Gt] 276 inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255 277 inet6 fe80::5ef0:f0f0%le0 prefixlen 64 scopeid 0x1 278.Ed 279.Pp 280and a PPP interface something like: 281.Bd -literal -offset indent 282ppp0: flags=8051\*[Lt]UP,POINTOPOINT,RUNNING,MULTICAST\*[Gt] 283 inet 203.3.131.108 --\*[Gt] 198.181.0.253 netmask 0xffff0000 284.Ed 285.Pp 286See 287.Xr mrouted 8 288for instructions on configuring multicast routing. 289.Ss Check routing tables 290Issue a 291.Ic netstat -rn 292command. 293The output will look something like: 294.Bd -literal -offset indent 295Routing tables 296 297Internet: 298Destination Gateway Flags Refs Use Mtu Interface 299default 192.168.4.254 UGS 0 11098028 - le0 300127 127.0.0.1 UGRS 0 0 - lo0 301127.0.0.1 127.0.0.1 UH 3 24 - lo0 302192.168.4 link#1 UC 0 0 - le0 303192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - le0 304192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - le0 305 306Internet6: 307Destination Gateway Flags Refs Use Mtu Interface 308::/96 ::1 UGRS 0 0 32972 lo0 =\*[Gt] 309::1 ::1 UH 4 0 32972 lo0 310::ffff:0.0.0.0/96 ::1 UGRS 0 0 32972 lo0 311fc80::/10 ::1 UGRS 0 0 32972 lo0 312fe80::/10 ::1 UGRS 0 0 32972 lo0 313fe80::%le0/64 link#1 UC 0 0 1500 le0 314fe80::%lo0/64 fe80::1%lo0 U 0 0 32972 lo0 315ff01::/32 ::1 U 0 0 32972 lo0 316ff02::%le0/32 link#1 UC 0 0 1500 le0 317ff02::%lo0/32 fe80::1%lo0 UC 0 0 32972 lo0 318.Ed 319.Pp 320The default gateway address is stored in the 321.Dq Va defaultroute 322variable in 323.Pa /etc/rc.conf , 324or in the file 325.Pa /etc/mygate . 326If you need to edit this file, a painless way to reconfigure the network 327afterwards is to issue 328.Bd -literal -offset indent 329.Ic /etc/rc.d/network restart 330.Ed 331.Pp 332Or, you may prefer to manually configure using a series of 333.Ic route add 334and 335.Ic route delete 336commands (see 337.Xr route 8 ) . 338If you run 339.Xr dhclient 8 340you will have to kill it by running 341.Bd -literal -offset indent 342.Ic /etc/rc.d/dhclient stop 343.Pp 344.Ed 345after you flush the routes. 346.Pp 347If you wish to route packets between interfaces, add one or both 348of the following directives (depending on whether IPv4 or IPv6 routing 349is required) to 350.Pa /etc/sysctl.conf : 351.Pp 352.Dl net.inet.ip.forwarding=1 353.Dl net.inet6.ip6.forwarding=1 354.Pp 355As an alternative, compile a new kernel with the 356.Cm GATEWAY 357option. 358Packets are not forwarded by default, due to RFC requirements. 359.Ss Secure Shell (ssh) 360By default, all services are disabled in a fresh 361.Nx 362installation, and ssh is no exception. 363You may wish to enable it so you can remotely control your system. 364Set 365.Dq Va sshd=yes 366in 367.Pa /etc/rc.conf 368and then starting the server with the command 369.Bd -literal -offset indent 370.Ic /etc/rc.d/sshd start 371.Ed 372.Pp 373The first time the server is started, it will generate a new keypair, 374which will be stored inside the directory 375.Pa /etc/ssh . 376.Ss BIND Name Server (DNS) 377If you are using the BIND Name Server, check the 378.Pa /etc/resolv.conf 379file. 380It may look something like: 381.Bd -literal -offset indent 382domain some.thing.dom 383nameserver 192.168.0.1 384nameserver 192.168.4.55 385search some.thing.dom. thing.dom. 386.Ed 387.Pp 388For further details, see 389.Xr resolv.conf 5 . 390Note the name service lookup order is set via 391.Xr nsswitch.conf 5 392mechanism. 393.Pp 394If using a caching name server add the line "nameserver 127.0.0.1" first. 395To get a local caching name server to run 396you will need to set "named=yes" in 397.Pa /etc/rc.conf 398and create the 399.Pa named.conf 400file in the appropriate place for 401.Xr named 8 , 402usually in 403.Pa /etc/namedb . 404The same holds true if the machine is going to be a 405name server for your domain. 406In both these cases, make sure that 407.Xr named 8 408is running 409(otherwise there are long waits for resolver timeouts). 410.Ss RPC-based network services 411Several services depend on the RPC portmapper 412.Xr rpcbind 8 413- formerly known as 414.Ic portmap 415- being running for proper operation. 416This includes YP (NIS) and NFS exports, among other services. 417To get the RPC portmapper to start automatically on boot, 418you will need to have this line in 419.Pa /etc/rc.conf : 420.Pp 421.Dl rpcbind=YES 422.Ss YP (NIS) Setup 423Check the YP domain name with the 424.Xr domainname 1 425command. 426If necessary, correct it by editing the 427.Pa /etc/defaultdomain 428file or by setting the 429.Dq Va domainname 430variable in 431.Pa /etc/rc.conf . 432The 433.Pa /etc/rc.d/network 434script reads this file on bootup to determine and set the domain name. 435You may also set the running system's domain name with the 436.Xr domainname 1 437command. 438To start YP client services, simply run 439.Ic ypbind , 440then perform the remaining 441YP activation as described in 442.Xr passwd 5 443and 444.Xr group 5 . 445.Pp 446In particular, to enable YP passwd support, you'll need to update 447.Pa /etc/nsswitch.conf 448to include 449.Dq nis 450for the 451.Dq passwd 452and 453.Dq group 454entries. 455A traditional way to accomplish the same thing is to 456add following entry to local passwd database via 457.Xr vipw 8 : 458.Bd -literal -offset indent 459.Li +:*:::::::: 460.Pp 461.Ed 462Note this entry has to be the very last one. 463This traditional way works with the default 464.Xr nsswitch.conf 5 465setting of 466.Dq passwd , 467which is 468.Dq compat . 469.Pp 470There are many more YP man pages available to help you. 471You can find more information by starting with 472.Xr nis 8 . 473.Ss Check disk mounts 474Check that the disks are mounted correctly by 475comparing the 476.Pa /etc/fstab 477file against the output of the 478.Xr mount 8 479and 480.Xr df 1 481commands. 482Example: 483.Bd -literal -offset indent 484.Li # Ic cat /etc/fstab 485/dev/sd0a / ffs rw 1 1 486/dev/sd0b none swap sw 487/dev/sd0e /usr ffs rw 1 2 488/dev/sd0f /var ffs rw 1 3 489/dev/sd0g /tmp ffs rw 1 4 490/dev/sd0h /home ffs rw 1 5 491 492.Li # Ic mount 493/dev/sd0a on / type ffs (local) 494/dev/sd0e on /usr type ffs (local) 495/dev/sd0f on /var type ffs (local) 496/dev/sd0g on /tmp type ffs (local) 497/dev/sd0h on /home type ffs (local) 498 499.Li # Ic df 500Filesystem 1024-blocks Used Avail Capacity Mounted on 501/dev/sd0a 22311 14589 6606 69% / 502/dev/sd0e 203399 150221 43008 78% /usr 503/dev/sd0f 10447 682 9242 7% /var 504/dev/sd0g 18823 2 17879 0% /tmp 505/dev/sd0h 7519 5255 1888 74% /home 506 507.Li # Ic pstat -s 508Device 512-blocks Used Avail Capacity Priority 509/dev/sd0b 131072 84656 46416 65% 0 510.Ed 511.Pp 512Edit 513.Pa /etc/fstab 514and use the 515.Xr mount 8 516and 517.Xr umount 8 518commands as appropriate. 519Refer to the above example and 520.Xr fstab 5 521for information on the format of this file. 522.Pp 523You may wish to do NFS mounts now too, or you can do them later. 524.Ss Concatenated disks (ccd) 525If you are using 526.Xr ccd 4 527concatenated disks, edit 528.Pa /etc/ccd.conf . 529You may wish to take a look to 530.Xr ccdconfig 8 531for more information about this file. 532Use the 533.Ic ccdconfig -U 534command to unload and the 535.Ic ccdconfig -C 536command to create tables internal to the kernel for the concatenated disks. 537You then 538.Xr mount 8 , 539.Xr umount 8 , 540and edit 541.Pa /etc/fstab 542as needed. 543.Ss Automounter daemon (AMD) 544To use the 545.Xr amd 8 546automounter, create the 547.Pa /etc/amd 548directory, copy example config files from 549.Pa /usr/share/examples/amd 550to 551.Pa /etc/amd 552and customize them as needed. 553Alternatively, you can get your maps with YP. 554.Ss Clock synchronization 555In order to make sure the system clock is synchronized 556to that of a publicly accessible NTP server, 557make sure that 558.Pa /etc/rc.conf 559contains the following: 560.Pp 561.Dl ntpdate=yes 562.Dl ntpd=yes 563.Pp 564See 565.Xr date 1 , 566.Xr ntpdate 8 , 567.Xr ntpd 8 , 568.Xr rdate 8 , 569and 570.Xr timed 8 571for more information on setting the system's date. 572.Sh CHANGING /etc FILES 573The system should be usable now, but you may wish to do more customizing, 574such as adding users, etc. 575Many of the following sections may be skipped 576if you are not using that package (for example, skip the 577.Sx Kerberos 578section if you won't be using Kerberos). 579We suggest that you 580.Ic cd /etc 581and edit most of the files in that directory. 582.Pp 583Note that the 584.Pa /etc/motd 585file is modified by 586.Pa /etc/rc.d/motd 587whenever the system is booted. 588To keep any custom message intact, ensure that you leave two blank lines 589at the top, or your message will be overwritten. 590.Ss Add new users 591To add new users and groups, there are 592.Xr useradd 8 593and 594.Xr groupadd 8 , 595see also 596.Xr user 8 597for further programs for user and group manipulation. 598You may use 599.Xr vipw 8 600to add users to the 601.Pa /etc/passwd 602file 603and edit 604.Pa /etc/group 605by hand to add new groups. 606The manual page for 607.Xr su 1 , 608tells you to make sure to put people in 609the 610.Sq wheel 611group if they need root access (non-Kerberos). 612For example: 613.Bd -literal -offset indent 614wheel:*:0:root,myself 615.Ed 616.Pp 617Follow instructions for 618.Xr kerberos 8 619if using 620Kerberos 621for authentication. 622.Ss System boot scripts and /etc/rc.local 623.Pa /etc/rc 624and the 625.Pa /etc/rc.d/* 626scripts are invoked at boot time after single user mode has exited, 627and at shutdown. 628The whole process is controlled by the master script 629.Pa /etc/rc . 630This script should not be changed by administrators. 631.Pp 632The directory 633.Pa /etc/rc.d 634contains a series of scripts used at startup/shutdown, called by 635.Pa /etc/rc . 636.Pa /etc/rc 637is in turn influenced by the configuration variables present in 638.Pa /etc/rc.conf . 639.Pp 640The script 641.Pa /etc/rc.local 642is run as the last thing during multiuser boot, and is provided 643to allow any other local hooks necessary for the system. 644.Ss rc.conf 645To enable or disable various services on system startup, 646corresponding entries can be made in 647.Pa /etc/rc.conf . 648You can take a look at 649.Pa /etc/defaults/rc.conf 650to see a list of default system variables, which you can override in 651.Pa /etc/rc.conf . 652Note you are 653.Em not 654supposed to change 655.Pa /etc/defaults/rc.conf 656directly, edit only 657.Pa /etc/rc.conf . 658See 659.Xr rc.conf 5 660for further information. 661.Pp 662If you've installed X, you may want to turn on 663.Xr xdm 1 , 664the X Display Manager. 665To do this, set the variable 666.Dq xdm 667to yes in 668.Pa /etc/rc.conf , 669i.e.: 670.Dq xdm=yes 671.Ss Printers 672Edit 673.Pa /etc/printcap 674and 675.Pa /etc/hosts.lpd 676to get any printers set up. 677Consult 678.Xr lpd 8 679and 680.Xr printcap 5 681if needed. 682.Ss Tighten up security 683In 684.Pa /etc/inetd.conf 685comment out any extra entries you do not need, and only add things 686that are really needed. 687Note that by default all services are disabled for security reasons. 688.Ss Kerberos 689If you are going to use Kerberos for authentication, 690see 691.Xr kerberos 8 692and 693.Dq info heimdal 694for more information. 695If you already have a Kerberos master, change directory to 696.Pa /etc/kerberosV 697and configure. 698Remember to get a 699.Pa srvtab 700from the master so that the remote commands work. 701.Ss Mail Aliases 702Check 703.Pa /etc/mail/aliases 704and update appropriately if you want e-mail to be routed 705to non-local addresses or to different users. 706.Pp 707Run 708.Xr newaliases 1 709after changes. 710.Ss Postfix 711.Nx 712uses Postfix as its MTA. 713Postfix is started by default, but its initial configuration does not 714cause it to listen on the network for incoming connections. 715To configure Postfix, see 716.Pa /etc/postfix/main.cf 717and 718.Pa /etc/postfix/master.cf . 719If you wish to use a different MTA (e.g., sendmail), install your MTA of 720choice and edit 721.Pa /etc/mailer.conf 722to point to the proper binaries. 723.Ss DHCP server 724If this is a 725DHCP 726server, edit 727.Pa /etc/dhcpd.conf 728and 729.Pa /etc/dhcpd.interfaces 730as needed. 731You will have to make sure 732.Pa /etc/rc.conf 733has "dhcpd=yes" 734or run 735.Xr dhcpd 8 736manually. 737.Ss Bootparam server 738If this is a 739Bootparam 740server, edit 741.Pa /etc/bootparams 742as needed. 743You will have to turn it on in 744.Pa /etc/rc.conf 745by adding "bootparamd=yes". 746.Ss NFS server 747If this is an NFS server, make sure 748.Pa /etc/rc.conf 749has: 750.Bd -literal -offset indent 751nfs_server=yes 752mountd=yes 753rpcbind=yes 754.Ed 755.Pp 756Edit 757.Pa /etc/exports 758and get it correct. 759After this, you can start the server by issuing: 760.Bd -literal -offset indent 761.Ic /etc/rc.d/rpcbind start 762.Ic /etc/rc.d/mountd start 763.Ic /etc/rc.d/nfsd start 764.Ed 765which will also start dependencies. 766.Ss HP remote boot server 767Edit 768.Pa /etc/rbootd.conf 769if needed for remote booting. 770If you do not have HP computers doing remote booting, do not enable this. 771.Ss Daily, weekly, monthly scripts 772Look at and possibly edit the 773.Pa /etc/daily.conf , /etc/weekly.conf , 774and 775.Pa /etc/monthly.conf 776configuration files. 777You can check which values you can set by looking 778to their matching files in 779.Pa /etc/defaults . 780Your site specific things should go into 781.Pa /etc/daily.local , /etc/weekly.local , 782and 783.Pa /etc/monthly.local . 784.Pp 785These scripts have been limited so as to keep the system running without 786filling up disk space from normal running processes and database updates. 787(You probably do not need to understand them.) 788.Ss Other files in /etc 789Look at the other files in 790.Pa /etc 791and edit them as needed. 792(Do not edit files ending in 793.Pa .db 794\(em like 795.Pa pwd.db , spwd.db , 796nor 797.Pa localtime , 798nor 799.Pa rmt , 800nor any directories.) 801.Ss Crontab (background running processes) 802Check what is running by typing 803.Ic crontab -l 804as root 805and see if anything unexpected is present. 806Do you need anything else? 807Do you wish to change things? 808For example, if you do not 809like root getting standard output of the daily scripts, and want only 810the security scripts that are mailed internally, you can type 811.Ic crontab -e 812and change some of the lines to read: 813.Bd -literal -offset indent 81430 1 * * * /bin/sh /etc/daily 2\*[Gt]\*[Am]1 \*[Gt] /var/log/daily.out 81530 3 * * 6 /bin/sh /etc/weekly 2\*[Gt]\*[Am]1 \*[Gt] /var/log/weekly.out 81630 5 1 * * /bin/sh /etc/monthly 2\*[Gt]\*[Am]1 \*[Gt] /var/log/monthly.out 817.Ed 818.Pp 819See 820.Xr crontab 5 . 821.Ss Next day cleanup 822After the first night's security run, change ownerships and permissions 823on files, directories, and devices; root should have received mail 824with subject: "\*[Lt]hostname\*[Gt] daily insecurity output.". 825This mail contains 826a set of security recommendations, presented as a list looking like this: 827.Bd -literal -offset indent 828var/mail: 829 permissions (0755, 0775) 830etc/daily: 831 user (0, 3) 832.Ed 833.Pp 834The best bet is to follow the advice in that list. 835The recommended setting is the first item in parentheses, while 836the current setting is the second one. 837This list is generated by 838.Xr mtree 8 839using 840.Pa /etc/mtree/special . 841Use 842.Xr chmod 1 , 843.Xr chgrp 1 , 844and 845.Xr chown 8 846as needed. 847.Ss Packages 848Install your own packages. 849The 850.Nx 851packages collection, pkgsrc, includes a large set of third-party software. 852A lot of it is available as binary packages that you can download from 853.Pa ftp://ftp.NetBSD.org/pub/NetBSD/packages/ 854or a mirror, and install using 855.Xr pkg_add 1 . 856See 857.Pa http://www.NetBSD.org/docs/pkgsrc/ 858and 859.Pa pkgsrc/doc/pkgsrc.txt 860for more details. 861.Pp 862Copy vendor binaries and install them. 863You will need to install any shared libraries, etc. 864(Hint: 865.Ic man -k compat 866to find out how to install and use compatibility mode.) 867.Pp 868There is also other third-party software that is available 869in source form only, either because it has not been ported to 870.Nx 871yet, because licensing restrictions make binary redistribution 872impossible, or simply because you want to build your own binaries. 873Sometimes checking the mailing lists for 874past problems that people have encountered will result in a fix posted. 875.Ss Check the running system 876You can use 877.Xr ps 1 , 878.Xr netstat 1 , 879and 880.Xr fstat 1 881to check on running processes, network connections, and opened files, 882respectively. 883Other tools you may find useful are 884.Xr systat 1 885and 886.Xr top 1 . 887.Sh COMPILING A KERNEL 888Note: 889The standard 890.Nx 891kernel configuration (GENERIC) is suitable for most purposes. 892.Pp 893First, review the system message buffer in 894.Pa /var/run/dmesg.boot 895and by using the 896.Xr dmesg 8 897command to find out information on your system's devices as probed by the 898kernel at boot. 899In particular, note which devices were not configured. 900This information will prove useful when editing kernel configuration files. 901.Pp 902To compile a kernel inside a writable source tree, do the following: 903.Bd -literal -offset indent 904$ cd /usr/src/sys/arch/SOMEARCH/conf 905$ cp GENERIC SOMEFILE (only the first time) 906$ vi SOMEFILE (adapt to your needs) 907$ config SOMEFILE 908$ cd ../compile/SOMEFILE 909$ make depend 910$ make 911.Ed 912.Pp 913where 914.Ar SOMEARCH 915is the architecture (e.g., i386), and 916.Ar SOMEFILE 917should be a name indicative of a particular configuration (often 918that of the hostname). 919.Pp 920If you are building your kernel again, before you do a 921.Ic make 922you should do a 923.Ic make clean 924after making changes to your kernel options. 925.Pp 926After either of these two methods, you can place the new kernel (called 927.Pa netbsd ) 928in 929.Pa / 930(i.e., 931.Pa /netbsd ) 932by issuing 933.Ic make install 934and the system will boot it next time. 935The old kernel is stored as 936.Pa /onetbsd 937so you can boot it in case of failure. 938.Pp 939If you are using toolchain to build your kernel, you will also need to 940build a new set of toolchain binaries. 941You can do it by changing into 942.Pa /usr/src 943and issuing: 944.Bd -literal -offset indent 945$ cd /usr/src 946$ K=sys/arch/`uname -m`/conf 947$ cp $K/GENERIC $K/SOMEFILE 948$ vi $K/SOMEFILE (adapt to your needs) 949$ ./build.sh tools 950$ ./build.sh kernel=SOMEFILE 951.Ed 952.Sh SYSTEM TESTING 953At this point, the system should be fully configured to your liking. 954It is now a good time to ensure that the system behaves according to 955its specifications and that it is stable on your hardware. 956You can easily do so by running the test suites available at 957.Pa /usr/tests/ , 958assuming that you installed the 959.Pa tests.tgz 960set. 961If not, you can install it now by running: 962.Bd -literal -offset indent 963# cd / 964# tar xzpf /path/to/tests.tgz 965.Ed 966.Pp 967Once done, edit the 968.Pa /etc/atf/NetBSD.conf 969file to tune the configuration of the test suite, go to 970.Pa /usr/tests/ 971hierarchy and use the 972.Xr atf-run 1 973and 974.Xr atf-report 1 975utilities to run all the tests in an automated way: 976.Bd -literal -offset indent 977# cd /usr/tests/ 978# atf-run | atf-report 979.Ed 980.Pp 981Should any problems appear when running the test suite, please let the 982.Nx 983developers know by sending a message to the appropriate mailing list or 984by sending a problem report. 985For more details see: 986.Bl -bullet -offset indent 987.It 988.Pa http://www.netbsd.org/mailinglists/ 989.It 990.Pa http://www.netbsd.org/support/send-pr.html 991.El 992.Sh SEE ALSO 993.Xr atf-report 1 , 994.Xr atf-run 1 , 995.Xr chgrp 1 , 996.Xr chmod 1 , 997.Xr config 1 , 998.Xr crontab 1 , 999.Xr date 1 , 1000.Xr df 1 , 1001.Xr domainname 1 , 1002.Xr hostname 1 , 1003.Xr make 1 , 1004.Xr man 1 , 1005.Xr netstat 1 , 1006.Xr newaliases 1 , 1007.Xr passwd 1 , 1008.Xr su 1 , 1009.Xr ccd 4 , 1010.Xr aliases 5 , 1011.Xr crontab 5 , 1012.Xr exports 5 , 1013.Xr fstab 5 , 1014.Xr group 5 , 1015.Xr mailer.conf 5 , 1016.Xr passwd 5 , 1017.Xr rc.conf 5 , 1018.Xr resolv.conf 5 , 1019.Xr hier 7 , 1020.Xr hostname 7 , 1021.Xr pkgsrc 7 , 1022.Xr amd 8 , 1023.Xr ccdconfig 8 , 1024.Xr chown 8 , 1025.Xr dhcpd 8 , 1026.Xr ifconfig 8 , 1027.Xr inetd 8 , 1028.Xr kerberos 8 , 1029.Xr mount 8 , 1030.Xr mrouted 8 , 1031.Xr mtree 8 , 1032.Xr named 8 , 1033.Xr nis 8 . 1034.Xr rbootd 8 , 1035.Xr rc 8 , 1036.Xr rmt 8 , 1037.Xr route 8 , 1038.Xr rpc.bootparamd 8 , 1039.Xr umount 8 , 1040.Xr useradd 8 , 1041.Xr vipw 8 , 1042.Xr ypbind 8 1043.Sh HISTORY 1044This document first appeared in 1045.Ox 2.2 . 1046It has been adapted to 1047.Nx 1048and first appeared in 1049.Nx 2.0 . 1050