1.\" $NetBSD: afterboot.8,v 1.34 2007/12/14 21:16:01 pavel Exp $ 2.\" $OpenBSD: afterboot.8,v 1.72 2002/02/22 02:02:33 miod Exp $ 3.\" 4.\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu 5.\" Adapted to NetBSD by Julio Merino -- 2002-05-10, jmmv@NetBSD.org 6.\" 7.\" 8.\" Copyright (c) 2002-2005 The NetBSD Foundation, Inc. 9.\" All rights reserved. 10.\" 11.\" Redistribution and use in source and binary forms, with or without 12.\" modification, are permitted provided that the following conditions 13.\" are met: 14.\" 1. Redistributions of source code must retain the above copyright 15.\" notice, this list of conditions and the following disclaimer. 16.\" 2. Redistributions in binary form must reproduce the above copyright 17.\" notice, this list of conditions and the following disclaimer in the 18.\" documentation and/or other materials provided with the distribution. 19.\" 3. All advertising materials mentioning features or use of this software 20.\" must display the following acknowledgement: 21.\" This product includes software developed by the NetBSD 22.\" Foundation, Inc. and its contributors. 23.\" 4. Neither the name of The NetBSD Foundation nor the names of its 24.\" contributors may be used to endorse or promote products derived 25.\" from this software without specific prior written permission. 26.\" 27.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 28.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 29.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 30.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 31.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 32.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 33.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 34.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 35.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 36.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 37.\" POSSIBILITY OF SUCH DAMAGE. 38.\" 39.\" 40.\" Copyright (c) 1997 Marshall M. Midden 41.\" All rights reserved. 42.\" 43.\" Redistribution and use in source and binary forms, with or without 44.\" modification, are permitted provided that the following conditions 45.\" are met: 46.\" 47.\" 1. Redistributions of source code must retain the above copyright 48.\" notice, this list of conditions and the following disclaimer. 49.\" 2. Redistributions in binary form must reproduce the above copyright 50.\" notice, this list of conditions and the following disclaimer in the 51.\" documentation and/or other materials provided with the distribution. 52.\" 3. All advertising materials mentioning features or use of this software 53.\" must display the following acknowledgement: 54.\" This product includes software developed by Marshall M. Midden. 55.\" 4. The name of the author may not be used to endorse or promote products 56.\" derived from this software without specific prior written permission. 57.\" 58.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 59.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 60.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 61.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 62.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 63.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 64.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 65.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 66.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 67.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 68.\" 69.Dd August 19, 2007 70.Dt AFTERBOOT 8 71.Os 72.Sh NAME 73.Nm afterboot 74.Nd things to check after the first complete boot 75.Sh DESCRIPTION 76.Ss Starting Out 77This document attempts to list items for the system administrator 78to check and set up after the installation and first complete boot of the 79system. 80The idea is to create a list of items that can be checked off so that you have 81a warm fuzzy feeling that something obvious has not been missed. 82A basic knowledge of 83.Ux 84is assumed. 85.Pp 86Complete instructions for correcting and fixing items is not provided. 87There are manual pages and other methodologies available for doing that. 88For example, to view the man page for the 89.Xr ls 1 90command, type: 91.Bd -literal -offset indent 92.Ic man 1 ls 93.Ed 94.Pp 95Administrators will rapidly become more familiar with 96.Nx 97if they get used to using the manual pages. 98.Ss Security alerts 99By the time that you have installed your system, it is quite likely that 100bugs in the release have been found. 101All significant and easily fixed problems will be reported at 102.Pa http://www.NetBSD.org/support/security/ . 103It is recommended that you check this page regularly. 104.Ss Login 105Login as 106.Dq Ic root . 107You can do so on the console, or over the network using 108.Xr ssh 1 . 109If you have enabled the ssh daemon and wish to allow root logins over 110the network, edit the 111.Pa /etc/ssh/sshd_config 112file and set 113.Cm PermitRootLogin 114to 115.Dq yes 116(see 117.Xr sshd 8 ) . 118The default is to not permit root logins over the network 119after fresh install in 120.Nx . 121.Pp 122Upon successful login on the console, you may see the message 123.Dq We recommend creating a non-root account... . 124For security reasons, it is bad practice to login as root during 125regular use and maintenance of the system. 126In fact, the system will only let you login as root on a secure 127terminal. 128By default, only the console is considered to be a secure terminal. 129Instead, administrators are encouraged to add a 130.Dq regular 131user, add said user to the 132.Dq wheel 133group, then use the 134.Xr su 1 135command when root privileges are required. 136This process is described in more detail later. 137.Ss Root password 138Change the password for the root user. 139(Note that throughout the documentation, the term 140.Dq superuser 141is a synonym for the root user.) 142Choose a password that has numbers, digits, and special characters (not space) 143as well as from the upper and lower case alphabet. 144Do not choose any word in any language. 145It is common for an intruder to use dictionary attacks. 146Type the command 147.Ic /usr/bin/passwd 148to change it. 149.Pp 150It is a good idea to always specify the full path name for both the 151.Xr passwd 1 152and 153.Xr su 1 154commands as this inhibits the possibility of files placed in your execution 155.Ev PATH 156for most shells. 157Furthermore, the superuser's 158.Ev PATH 159should never contain the current directory 160.Po Dq \&. 161.Pc . 162.Ss System date 163Check the system date with the 164.Xr date 1 165command. 166If needed, change the date, and/or change the symbolic link of 167.Pa /etc/localtime 168to the correct time zone in the 169.Pa /usr/share/zoneinfo 170directory. 171.Pp 172Examples: 173.Bl -tag -width date 174.It Cm date 200205101820 175Set the current date to May 10th, 2002 6:20pm. 176.It Cm ln -fs /usr/share/zoneinfo/Europe/Helsinki /etc/localtime 177Set the time zone to Eastern Europe Summer Time. 178.El 179.Ss Console settings 180One of the first things you will likely need to do is to set up your 181keyboard map (and maybe some other aspects about the system console). 182To change your keyboard encoding, edit the 183.Dq Va encoding 184variable found in 185.Pa /etc/wscons.conf . 186.Pp 187.Xr wscons.conf 5 188contains more information about this file. 189.Ss Check hostname 190Use the 191.Ic hostname 192command to verify that the name of your machine is correct. 193See the man page for 194.Xr hostname 1 195if it needs to be changed. 196You will also need to change the contents of the 197.Dq Va hostname 198variable in 199.Pa /etc/rc.conf 200or edit the 201.Pa /etc/myname 202file to have it stick around for the next reboot. 203Note that hostname is supposed include a domainname, and that this should 204not be confused with YP (NIS) 205.Xr domainname 1 . 206.Ss Verify network interface configuration 207The first thing to do is an 208.Ic ifconfig -a 209to see if the network interfaces are properly configured. 210Correct by editing 211.Pa /etc/ifconfig. Ns Ar interface 212or the corresponding 213.Dq Va ifconfig_ Ns Ar interface 214variable in 215.Xr rc.conf 5 216(where 217.Ar interface 218is the interface name, e.g., 219.Dq le0 ) 220and then using 221.Xr ifconfig 8 222to manually configure it 223if you do not wish to reboot. 224.Pp 225You can add new 226.Dq virtual interfaces 227by adding the required entries to 228.Pa /etc/ifconfig. Ns Ar interface . 229Read the 230.Xr ifconfig.if 5 231man page for more information on the format of 232.Pa /etc/ifconfig. Ns Ar interface 233files. 234The loopback interface will look something like: 235.Bd -literal -offset indent 236lo0: flags=8009\*[Lt]UP,LOOPBACK,MULTICAST\*[Gt] mtu 32972 237 inet 127.0.0.1 netmask 0xff000000 238 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 239 inet6 ::1 prefixlen 128 240.Ed 241.Pp 242an Ethernet interface something like: 243.Bd -literal -offset indent 244le0: flags=9863\*[Lt]UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST\*[Gt] 245 inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255 246 inet6 fe80::5ef0:f0f0%le0 prefixlen 64 scopeid 0x1 247.Ed 248.Pp 249and a PPP interface something like: 250.Bd -literal -offset indent 251ppp0: flags=8051\*[Lt]UP,POINTOPOINT,RUNNING,MULTICAST\*[Gt] 252 inet 203.3.131.108 --\*[Gt] 198.181.0.253 netmask 0xffff0000 253.Ed 254.Pp 255See 256.Xr mrouted 8 257for instructions on configuring multicast routing. 258.Pp 259See 260.Xr dhcpd 8 261for instructions on configuring interfaces with DHCP. 262.Ss Check routing tables 263Issue a 264.Ic netstat -rn 265command. 266The output will look something like: 267.Bd -literal -offset indent 268Routing tables 269 270Internet: 271Destination Gateway Flags Refs Use Mtu Interface 272default 192.168.4.254 UGS 0 11098028 - le0 273127 127.0.0.1 UGRS 0 0 - lo0 274127.0.0.1 127.0.0.1 UH 3 24 - lo0 275192.168.4 link#1 UC 0 0 - le0 276192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - le0 277192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - le0 278 279Internet6: 280Destination Gateway Flags Refs Use Mtu Interface 281::/96 ::1 UGRS 0 0 32972 lo0 =\*[Gt] 282::1 ::1 UH 4 0 32972 lo0 283::ffff:0.0.0.0/96 ::1 UGRS 0 0 32972 lo0 284fc80::/10 ::1 UGRS 0 0 32972 lo0 285fe80::/10 ::1 UGRS 0 0 32972 lo0 286fe80::%le0/64 link#1 UC 0 0 1500 le0 287fe80::%lo0/64 fe80::1%lo0 U 0 0 32972 lo0 288ff01::/32 ::1 U 0 0 32972 lo0 289ff02::%le0/32 link#1 UC 0 0 1500 le0 290ff02::%lo0/32 fe80::1%lo0 UC 0 0 32972 lo0 291.Ed 292.Pp 293The default gateway address is stored in the 294.Dq Va defaultroute 295variable in 296.Pa /etc/rc.conf , 297or in the file 298.Pa /etc/mygate . 299If you need to edit this file, a painless way to reconfigure the network 300afterwards is to issue 301.Bd -literal -offset indent 302.Ic /etc/rc.d/network restart 303.Ed 304.Pp 305Or, you may prefer to manually configure using a series of 306.Ic route add 307and 308.Ic route delete 309commands (see 310.Xr route 8 ) . 311If you run 312.Xr dhclient 8 313you will have to kill it by running 314.Bd -literal -offset indent 315.Ic /etc/rc.d/dhclient stop 316.Pp 317.Ed 318after you flush the routes. 319.Pp 320If you wish to route packets between interfaces, add one or both 321of the following directives (depending on whether IPv4 or IPv6 routing 322is required) to 323.Pa /etc/sysctl.conf : 324.Pp 325.Dl net.inet.ip.forwarding=1 326.Dl net.inet6.ip6.forwarding=1 327.Pp 328As an alternative, compile a new kernel with the 329.Cm GATEWAY 330option. 331Packets are not forwarded by default, due to RFC requirements. 332.Ss Secure Shell (ssh) 333By default, all services are disabled in a fresh 334.Nx 335installation, and ssh is no exception. 336You may wish to enable it so you can remotely control your system. 337Set 338.Dq Va sshd=yes 339in 340.Pa /etc/rc.conf 341and then starting the server with the command 342.Bd -literal -offset indent 343.Ic /etc/rc.d/sshd start 344.Ed 345.Pp 346The first time the server is started, it will generate a new keypair, 347which will be stored inside the directory 348.Pa /etc/ssh . 349.Ss BIND Name Server (DNS) 350If you are using the BIND Name Server, check the 351.Pa /etc/resolv.conf 352file. 353It may look something like: 354.Bd -literal -offset indent 355domain some.thing.dom 356nameserver 192.168.0.1 357nameserver 192.168.4.55 358search some.thing.dom. thing.dom. 359.Ed 360.Pp 361For further details, see 362.Xr resolv.conf 5 . 363Note the name service lookup order is set via 364.Xr nsswitch.conf 5 365mechanism. 366.Pp 367If using a caching name server add the line "nameserver 127.0.0.1" first. 368To get a local caching name server to run 369you will need to set "named=yes" in 370.Pa /etc/rc.conf 371and create the 372.Pa named.conf 373file in the appropriate place for 374.Xr named 8 , 375usually in 376.Pa /etc/namedb . 377The same holds true if the machine is going to be a 378name server for your domain. 379In both these cases, make sure that 380.Xr named 8 381is running 382(otherwise there are long waits for resolver timeouts). 383.Ss RPC-based network services 384Several services depend on the RPC portmapper 385.Xr rpcbind 8 386- formerly known as 387.Ic portmap 388- being running for proper operation. 389This includes YP (NIS) and NFS exports, among other services. 390To get the RPC portmapper to start automatically on boot, 391you will need to have this line in 392.Pa /etc/rc.conf : 393.Pp 394.Dl rpcbind=YES 395.Ss YP (NIS) Setup 396Check the YP domain name with the 397.Xr domainname 1 398command. 399If necessary, correct it by editing the 400.Pa /etc/defaultdomain 401file or by setting the 402.Dq Va domainname 403variable in 404.Pa /etc/rc.conf . 405The 406.Pa /etc/rc.d/network 407script reads this file on bootup to determine and set the domain name. 408You may also set the running system's domain name with the 409.Xr domainname 1 410command. 411To start YP client services, simply run 412.Ic ypbind , 413then perform the remaining 414YP activation as described in 415.Xr passwd 5 416and 417.Xr group 5 . 418.Pp 419In particular, to enable YP passwd support, you'll need to update 420.Pa /etc/nsswitch.conf 421to include 422.Dq nis 423for the 424.Dq passwd 425and 426.Dq group 427entries. 428A traditional way to accomplish the same thing is to 429add following entry to local passwd database via 430.Xr vipw 8 : 431.Bd -literal -offset indent 432.Li +:*:::::::: 433.Pp 434.Ed 435Note this entry has to be the very last one. 436This traditional way works with the default 437.Xr nsswitch.conf 5 438setting of 439.Dq passwd , 440which is 441.Dq compat . 442.Pp 443There are many more YP man pages available to help you. 444You can find more information by starting with 445.Xr yp 8 . 446.Ss Check disk mounts 447Check that the disks are mounted correctly by 448comparing the 449.Pa /etc/fstab 450file against the output of the 451.Xr mount 8 452and 453.Xr df 1 454commands. 455Example: 456.Bd -literal -offset indent 457.Li # Ic cat /etc/fstab 458/dev/sd0a / ffs rw 1 1 459/dev/sd0b none swap sw 460/dev/sd0e /usr ffs rw 1 2 461/dev/sd0f /var ffs rw 1 3 462/dev/sd0g /tmp ffs rw 1 4 463/dev/sd0h /home ffs rw 1 5 464 465.Li # Ic mount 466/dev/sd0a on / type ffs (local) 467/dev/sd0e on /usr type ffs (local) 468/dev/sd0f on /var type ffs (local) 469/dev/sd0g on /tmp type ffs (local) 470/dev/sd0h on /home type ffs (local) 471 472.Li # Ic df 473Filesystem 1024-blocks Used Avail Capacity Mounted on 474/dev/sd0a 22311 14589 6606 69% / 475/dev/sd0e 203399 150221 43008 78% /usr 476/dev/sd0f 10447 682 9242 7% /var 477/dev/sd0g 18823 2 17879 0% /tmp 478/dev/sd0h 7519 5255 1888 74% /home 479 480.Li # Ic pstat -s 481Device 512-blocks Used Avail Capacity Priority 482/dev/sd0b 131072 84656 46416 65% 0 483.Ed 484.Pp 485Edit 486.Pa /etc/fstab 487and use the 488.Xr mount 8 489and 490.Xr umount 8 491commands as appropriate. 492Refer to the above example and 493.Xr fstab 5 494for information on the format of this file. 495.Pp 496You may wish to do NFS mounts now too, or you can do them later. 497.Ss Concatenated disks (ccd) 498If you are using 499.Xr ccd 4 500concatenated disks, edit 501.Pa /etc/ccd.conf . 502You may wish to take a look to 503.Xr ccdconfig 8 504for more information about this file. 505Use the 506.Ic ccdconfig -U 507command to unload and the 508.Ic ccdconfig -C 509command to create tables internal to the kernel for the concatenated disks. 510You then 511.Xr mount 8 , 512.Xr umount 8 , 513and edit 514.Pa /etc/fstab 515as needed. 516.Ss Automounter daemon (AMD) 517To use the 518.Xr amd 8 519automounter, create the 520.Pa /etc/amd 521directory, copy example config files from 522.Pa /usr/share/examples/amd 523to 524.Pa /etc/amd 525and customize them as needed. 526Alternatively, you can get your maps with YP. 527.Ss Clock synchronization 528In order to make sure the system clock is synchronized 529to that of a publicly accessible NTP server, 530make sure that 531.Pa /etc/rc.conf 532contains the following: 533.Pp 534.Dl ntpdate=yes 535.Dl ntpd=yes 536.Pp 537See 538.Xr date 1 , 539.Xr ntpdate 8 , 540.Xr ntpd 8 , 541.Xr rdate 8 , 542and 543.Xr timed 8 544for more information on setting the system's date. 545.Sh CHANGING /etc FILES 546The system should be usable now, but you may wish to do more customizing, 547such as adding users, etc. 548Many of the following sections may be skipped 549if you are not using that package (for example, skip the 550.Sx Kerberos 551section if you won't be using Kerberos). 552We suggest that you 553.Ic cd /etc 554and edit most of the files in that directory. 555.Pp 556Note that the 557.Pa /etc/motd 558file is modified by 559.Pa /etc/rc.d/motd 560whenever the system is booted. 561To keep any custom message intact, ensure that you leave two blank lines 562at the top, or your message will be overwritten. 563.Ss Add new users 564To add new users and groups, there are 565.Xr useradd 8 566and 567.Xr groupadd 8 , 568see also 569.Xr user 8 570for further programs for user and group manipulation. 571You may use 572.Xr vipw 8 573to add users to the 574.Pa /etc/passwd 575file 576and edit 577.Pa /etc/group 578by hand to add new groups. 579The manual page for 580.Xr su 1 , 581tells you to make sure to put people in 582the 583.Sq wheel 584group if they need root access (non-Kerberos). 585For example: 586.Bd -literal -offset indent 587wheel:*:0:root,myself 588.Ed 589.Pp 590Follow instructions for 591.Xr kerberos 8 592if using 593Kerberos 594for authentication. 595.Ss System boot scripts and /etc/rc.local 596.Pa /etc/rc 597and the 598.Pa /etc/rc.d/* 599scripts are invoked at boot time after single user mode has exited, 600and at shutdown. 601The whole process is controlled by the master script 602.Pa /etc/rc . 603This script should not be changed by administrators. 604.Pp 605The directory 606.Pa /etc/rc.d 607contains a serie of scripts used at startup/shutdown, called by 608.Pa /etc/rc . 609.Pa /etc/rc 610is in turn influenced by the configuration variables present in 611.Pa /etc/rc.conf . 612.Pp 613The script 614.Pa /etc/rc.local 615is run as the last thing during multiuser boot, and is provided 616to allow any other local hooks necessary for the system. 617.Ss rc.conf 618To enable or disable various services on system startup, 619corresponding entries can be made in 620.Pa /etc/rc.conf . 621You can take a look at 622.Pa /etc/defaults/rc.conf 623to see a list of default system variables, which you can override in 624.Pa /etc/rc.conf . 625Note you are 626.Em not 627supposed to change 628.Pa /etc/defaults/rc.conf 629directly, edit only 630.Pa /etc/rc.conf . 631See 632.Xr rc.conf 5 633for further information. 634.Pp 635If you've installed X, you may want to turn on 636.Xr xdm 1 , 637the X Display Manager. 638To do this, set the variable 639.Dq xdm 640to yes in 641.Pa /etc/rc.conf , 642i.e.: 643.Dq xdm=yes 644.Ss Printers 645Edit 646.Pa /etc/printcap 647and 648.Pa /etc/hosts.lpd 649to get any printers set up. 650Consult 651.Xr lpd 8 652and 653.Xr printcap 5 654if needed. 655.Ss Tighten up security 656In 657.Pa /etc/inetd.conf 658comment out any extra entries you do not need, and only add things 659that are really needed. 660Note that by default all services are disabled for security reasons. 661.Ss Kerberos 662If you are going to use Kerberos for authentication, 663see 664.Xr kerberos 8 665and 666.Dq info heimdal 667for more information. 668If you already have a Kerberos master, change directory to 669.Pa /etc/kerberosV 670and configure. 671Remember to get a 672.Pa srvtab 673from the master so that the remote commands work. 674.Ss Mail Aliases 675Check 676.Pa /etc/mail/aliases 677and update appropriately if you want e-mail to be routed 678to non-local address or to different users. 679.Pp 680Run 681.Xr newaliases 1 682after changes. 683.Ss Postfix 684.Nx 685comes also with Postfix in the base system. 686You may wish to set it up in favor of sendmail. 687Take a look to 688.Pa /etc/postfix/main.cf 689and enable the daemon in 690.Pa /etc/rc.conf 691using "postfix=yes". 692It is very important to configure 693.Pa /etc/mailer.conf 694to point to Postfix binaries. 695.Ss DHCP server 696If this is a 697DHCP 698server, edit 699.Pa /etc/dhcpd.conf 700and 701.Pa /etc/dhcpd.interfaces 702as needed. 703You will have to make sure 704.Pa /etc/rc.conf 705has "dhcpd=yes" 706or run 707.Xr dhcpd 8 708manually. 709.Ss Bootparam server 710If this is a 711Bootparam 712server, edit 713.Pa /etc/bootparams 714as needed. 715You will have to turn it on in 716.Pa /etc/rc.conf 717by adding "bootparamd=yes". 718.Ss NFS server 719If this is an NFS server, make sure 720.Pa /etc/rc.conf 721has: 722.Bd -literal -offset indent 723nfs_server=yes 724mountd=yes 725rpcbind=yes 726.Ed 727.Pp 728Edit 729.Pa /etc/exports 730and get it correct. 731After this, you can start the server by issuing: 732.Bd -literal -offset indent 733.Ic /etc/rc.d/rpcbind start 734.Ic /etc/rc.d/mountd start 735.Ic /etc/rc.d/nfsd start 736.Ed 737which will also start dependencies. 738.Ss HP remote boot server 739Edit 740.Pa /etc/rbootd.conf 741if needed for remote booting. 742If you do not have HP computers doing remote booting, do not enable this. 743.Ss Daily, weekly, monthly scripts 744Look at and possibly edit the 745.Pa /etc/daily.conf , /etc/weekly.conf , 746and 747.Pa /etc/monthly.conf 748configuration files. 749You can check which values you can set by looking 750to their matching files in 751.Pa /etc/defaults . 752Your site specific things should go into 753.Pa /etc/daily.local , /etc/weekly.local , 754and 755.Pa /etc/monthly.local . 756.Pp 757These scripts have been limited so as to keep the system running without 758filling up disk space from normal running processes and database updates. 759(You probably do not need to understand them.) 760.Ss Other files in /etc 761Look at the other files in 762.Pa /etc 763and edit them as needed. 764(Do not edit files ending in 765.Pa .db 766\(em like 767.Pa pwd.db , spwd.db , 768nor 769.Pa localtime , 770nor 771.Pa rmt , 772nor any directories.) 773.Ss Crontab (background running processes) 774Check what is running by typing 775.Ic crontab -l 776as root 777and see if anything unexpected is present. 778Do you need anything else? 779Do you wish to change things? 780For example, if you do not 781like root getting standard output of the daily scripts, and want only 782the security scripts that are mailed internally, you can type 783.Ic crontab -e 784and change some of the lines to read: 785.Bd -literal -offset indent 78630 1 * * * /bin/sh /etc/daily 2\*[Gt]\*[Am]1 \*[Gt] /var/log/daily.out 78730 3 * * 6 /bin/sh /etc/weekly 2\*[Gt]\*[Am]1 \*[Gt] /var/log/weekly.out 78830 5 1 * * /bin/sh /etc/monthly 2\*[Gt]\*[Am]1 \*[Gt] /var/log/monthly.out 789.Ed 790.Pp 791See 792.Xr crontab 5 . 793.Ss Next day cleanup 794After the first night's security run, change ownerships and permissions 795on files, directories, and devices; root should have received mail 796with subject: "\*[Lt]hostname\*[Gt] daily insecurity output.". 797This mail contains 798a set of security recommendations, presented as a list looking like this: 799.Bd -literal -offset indent 800var/mail: 801 permissions (0755, 0775) 802etc/daily: 803 user (0, 3) 804.Ed 805.Pp 806The best bet is to follow the advice in that list. 807The recommended setting is the first item in parentheses, while 808the current setting is the second one. 809This list is generated by 810.Xr mtree 8 811using 812.Pa /etc/mtree/special . 813Use 814.Xr chmod 1 , 815.Xr chgrp 1 , 816and 817.Xr chown 8 818as needed. 819.Ss Packages 820Install your own packages. 821The 822.Nx 823packages collection, pkgsrc, includes a large set of third-party software. 824A lot of it is available as binary packages that you can download from 825.Pa ftp://ftp.NetBSD.org/pub/NetBSD/packages/ 826or a mirror, and install using 827.Xr pkg_add 1 . 828See 829.Pa http://www.NetBSD.org/docs/pkgsrc/ 830and 831.Pa pkgsrc/doc/pkgsrc.txt 832for more details. 833.Pp 834Copy vendor binaries and install them. 835You will need to install any shared libraries, etc. 836(Hint: 837.Ic man -k compat 838to find out how to install and use compatibility mode.) 839.Pp 840There is also other third-party software that is available 841in source form only, either because it has not been ported to 842.Nx 843yet, because licensing restrictions make binary redistribution 844impossible, or simply because you want to build your own binaries. 845Sometimes checking the mailing lists for 846past problems that people have encountered will result in a fix posted. 847.Ss Check the running system 848You can use 849.Xr ps 1 , 850.Xr netstat 1 , 851and 852.Xr fstat 1 853to check on running processes, network connections, and opened files, 854respectively. 855Other tools you may find useful are 856.Xr systat 1 857and 858.Xr top 1 . 859.Sh COMPILING A KERNEL 860Note: 861The standard 862.Nx 863kernel configuration (GENERIC) is suitable for most purposes. 864.Pp 865First, review the system message buffer in 866.Pa /var/run/dmesg.boot 867and by using the 868.Xr dmesg 8 869command to find out information on your system's devices as probed by the 870kernel at boot. 871In particular, note which devices were not configured. 872This information will prove useful when editing kernel configuration files. 873.Pp 874To compile a kernel inside a writable source tree, do the following: 875.Bd -literal -offset indent 876$ cd /usr/src/sys/arch/SOMEARCH/conf 877$ cp GENERIC SOMEFILE (only the first time) 878$ vi SOMEFILE (adapt to your needs) 879$ config SOMEFILE 880$ cd ../compile/SOMEFILE 881$ make depend 882$ make 883.Ed 884.Pp 885where 886.Ar SOMEARCH 887is the architecture (e.g., i386), and 888.Ar SOMEFILE 889should be a name indicative of a particular configuration (often 890that of the hostname). 891.Pp 892If you are building your kernel again, before you do a 893.Ic make 894you should do a 895.Ic make clean 896after making changes to your kernel options. 897.Pp 898After either of these two methods, you can place the new kernel (called 899.Pa netbsd ) 900in 901.Pa / 902(i.e., 903.Pa /netbsd ) 904by issuing 905.Ic make install 906and the system will boot it next time. 907The old kernel is stored as 908.Pa /onetbsd 909so you can boot it in case of failure. 910.Pp 911If you are using toolchain to build your kernel, you will also need to 912build a new set of toolchain binaries. 913You can do it by changing into 914.Pa /usr/src 915and issuing: 916.Bd -literal -offset indent 917$ cd /usr/src 918$ K=sys/arch/`uname -m`/conf 919$ cp $K/GENERIC $K/SOMEFILE 920$ vi $K/SOMEFILE (adapt to your needs) 921$ ./build.sh tools 922$ ./build.sh kernel=SOMEFILE 923.Ed 924.Sh SYSTEM TESTING 925At this point, the system should be fully configured to your liking. 926It is now a good time to ensure that the system behaves according to 927its specifications and that it is stable on your hardware. 928You can easily do so by running the test suites available at 929.Pa /usr/tests/ , 930assuming that you installed the 931.Pa tests.tgz 932set. 933If not, you can install it now by running: 934.Bd -literal -offset indent 935# cd / 936# tar xzpf /path/to/tests.tgz 937.Ed 938.Pp 939Once done, edit the 940.Pa /etc/atf/NetBSD.conf 941file to tune the configuration of the test suite, go to 942.Pa /usr/tests/ 943hierarchy and use the 944.Xr atf-run 1 945and 946.Xr atf-report 1 947utilities to run all the tests in an automated way: 948.Bd -literal -offset indent 949# cd /usr/tests/ 950# atf-run | atf-report 951.Ed 952.Pp 953Should any problems appear when running the test suite, please let the 954.Nx 955developers know by sending a message to the appropriate mailing list or 956by sending a problem report. For more details see: 957.Bl -bullet -offset indent 958.It 959.Pa http://www.netbsd.org/mailinglists/ 960.It 961.Pa http://www.netbsd.org/support/send-pr.html 962.El 963.Sh SEE ALSO 964.Xr atf-report 1 , 965.Xr atf-run 1 , 966.Xr chgrp 1 , 967.Xr chmod 1 , 968.Xr config 1 , 969.Xr crontab 1 , 970.Xr date 1 , 971.Xr df 1 , 972.Xr domainname 1 , 973.Xr hostname 1 , 974.Xr make 1 , 975.Xr man 1 , 976.Xr netstat 1 , 977.Xr newaliases 1 , 978.Xr passwd 1 , 979.Xr su 1 , 980.Xr ccd 4 , 981.Xr aliases 5 , 982.Xr crontab 5 , 983.Xr exports 5 , 984.Xr fstab 5 , 985.Xr group 5 , 986.Xr krb.conf 5 , 987.Xr krb.realms 5 , 988.Xr mailer.conf 5 , 989.Xr passwd 5 , 990.Xr rc.conf 5 , 991.Xr resolv.conf 5 , 992.Xr hier 7 , 993.Xr hostname 7 , 994.Xr pkgsrc 7 , 995.Xr adduser 8 , 996.Xr amd 8 , 997.Xr bootparamd 8 , 998.Xr ccdconfig 8 , 999.Xr chown 8 , 1000.Xr dhcpd 8 , 1001.Xr ifconfig 8 , 1002.Xr inetd 8 , 1003.Xr kerberos 8 , 1004.Xr mount 8 , 1005.Xr mrouted 8 , 1006.Xr mtree 8 , 1007.Xr named 8 , 1008.Xr rbootd 8 , 1009.Xr rc 8 , 1010.Xr rmt 8 , 1011.Xr route 8 , 1012.Xr umount 8 , 1013.Xr vipw 8 , 1014.Xr ypbind 8 1015.Sh HISTORY 1016This document first appeared in 1017.Ox 2.2 . 1018It has been adapted to 1019.Nx 1020and first appeared in 1021.Nx 2.0 . 1022