1.\" $NetBSD: afterboot.8,v 1.73 2020/08/24 12:58:16 nia Exp $ 2.\" $OpenBSD: afterboot.8,v 1.72 2002/02/22 02:02:33 miod Exp $ 3.\" 4.\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu 5.\" Adapted to NetBSD by Julio Merino -- 2002-05-10, jmmv@NetBSD.org 6.\" 7.\" 8.\" Copyright (c) 2002-2008 The NetBSD Foundation, Inc. 9.\" All rights reserved. 10.\" 11.\" Redistribution and use in source and binary forms, with or without 12.\" modification, are permitted provided that the following conditions 13.\" are met: 14.\" 1. Redistributions of source code must retain the above copyright 15.\" notice, this list of conditions and the following disclaimer. 16.\" 2. Redistributions in binary form must reproduce the above copyright 17.\" notice, this list of conditions and the following disclaimer in the 18.\" documentation and/or other materials provided with the distribution. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 21.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 24.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30.\" POSSIBILITY OF SUCH DAMAGE. 31.\" 32.\" 33.\" Copyright (c) 1997 Marshall M. Midden 34.\" All rights reserved. 35.\" 36.\" Redistribution and use in source and binary forms, with or without 37.\" modification, are permitted provided that the following conditions 38.\" are met: 39.\" 40.\" 1. Redistributions of source code must retain the above copyright 41.\" notice, this list of conditions and the following disclaimer. 42.\" 2. Redistributions in binary form must reproduce the above copyright 43.\" notice, this list of conditions and the following disclaimer in the 44.\" documentation and/or other materials provided with the distribution. 45.\" 3. All advertising materials mentioning features or use of this software 46.\" must display the following acknowledgement: 47.\" This product includes software developed by Marshall M. Midden. 48.\" 4. The name of the author may not be used to endorse or promote products 49.\" derived from this software without specific prior written permission. 50.\" 51.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 52.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 53.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 54.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 55.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 56.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 57.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 58.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 59.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 60.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 61.\" 62.Dd August 24, 2020 63.Dt AFTERBOOT 8 64.Os 65.Sh NAME 66.Nm afterboot 67.Nd things to check after the first complete boot 68.Sh DESCRIPTION 69.Ss Starting Out 70This document attempts to list items for the system administrator 71to check and set up after the installation and first complete boot of the 72system. 73The idea is to create a list of items that can be checked off so that you have 74a warm fuzzy feeling that something obvious has not been missed. 75A basic knowledge of 76.Ux 77is assumed. 78.Pp 79Complete instructions for correcting and fixing items is not provided. 80There are manual pages and other methodologies available for doing that. 81For example, to view the man page for the 82.Xr ls 1 83command, type: 84.Bd -literal -offset indent 85.Ic man 1 ls 86.Ed 87.Pp 88Administrators will rapidly become more familiar with 89.Nx 90if they get used to using the manual pages. 91.Ss Security alerts 92By the time that you have installed your system, it is quite likely that 93bugs in the release have been found. 94All significant and easily fixed problems will be reported at 95.Lk http://www.NetBSD.org/support/security/ . 96It is recommended that you check this page regularly. 97.Pp 98Additionally, you should set 99.Dq fetch_pkg_vulnerabilities=YES 100in 101.Pa /etc/daily.conf 102to allow your system to automatically update the local database of known 103vulnerable packages to the latest version available on-line. 104The system will later check, on a daily basis, if any of your installed 105packages are vulnerable based on the contents of this database. 106See 107.Xr daily.conf 5 108and 109.Xr security.conf 5 110for more details. 111.Ss Login 112On a fresh install with no other user accounts, login as 113.Dq Ic root . 114You can do so on the console, or over the network using 115.Xr ssh 1 . 116If you have enabled the SSH daemon (see 117.Xr sshd 8 ) 118and wish to allow root logins over the network, edit the 119.Pa /etc/ssh/sshd_config 120file and set 121.Dq PermitRootLogin 122to 123.Dq yes 124(see 125.Xr sshd_config 5 ) . 126The default is to not permit root logins over the network 127after fresh install in 128.Nx . 129.Pp 130Upon successful login on the console, you may see the message 131.Dq We recommend creating a non-root account... . 132For security reasons, it is bad practice to login as root during 133regular use and maintenance of the system. 134In fact, the system will only let you login as root on a secure 135terminal. 136By default, only the console is considered to be a secure terminal. 137Instead, administrators are encouraged to add a 138.Dq regular 139user, add said user to the 140.Dq wheel 141group, then use the 142.Xr su 1 143command when root privileges are required. 144This process is described in more detail later. 145.Ss Root password 146Change the password for the root user. 147(Note that throughout the documentation, the term 148.Dq superuser 149is a synonym for the root user.) 150Choose a password that has numbers, digits, and special characters (not space) 151as well as from the upper and lower case alphabet. 152Do not choose any word in any language. 153It is common for an intruder to use dictionary attacks. 154Type the command 155.Ic /usr/bin/passwd 156to change it. 157.Pp 158It is a good idea to always specify the full path name for both the 159.Xr passwd 1 160and 161.Xr su 1 162commands as this inhibits the possibility of files placed in your execution 163.Ev PATH 164for most shells. 165Furthermore, the superuser's 166.Ev PATH 167should never contain the current directory 168.Po Dq \&. 169.Pc . 170.Ss System date 171Check the system date with the 172.Xr date 1 173command. 174If needed, change the date, and/or change the symbolic link of 175.Pa /etc/localtime 176to the correct time zone in the 177.Pa /usr/share/zoneinfo 178directory. 179.Pp 180Examples: 181.Bl -tag -width date 182.It Cm date 200205101820 183Set the current date to May 10th, 2002 6:20pm. 184.It Cm ln -fs /usr/share/zoneinfo/Europe/Helsinki /etc/localtime 185Set the time zone to Eastern Europe Summer Time. 186.El 187.Ss Console settings 188One of the first things you will likely need to do is to set up your 189keyboard map (and maybe some other aspects about the system console). 190To change your keyboard encoding, edit the 191.Dq Va encoding 192variable found in 193.Pa /etc/wscons.conf . 194.Pp 195.Xr wscons.conf 5 196contains more information about this file. 197.Ss Check hostname 198Use the 199.Ic hostname 200command to verify that the name of your machine is correct. 201See the man page for 202.Xr hostname 1 203if it needs to be changed. 204You will also need to change the contents of the 205.Dq Va hostname 206variable in 207.Pa /etc/rc.conf 208or edit the 209.Pa /etc/myname 210file to have it stick around for the next reboot. 211Note that 212.Dq Va hostname 213is supposed include a domainname, and that this should 214not be confused with YP (NIS) 215.Xr domainname 1 . 216If you are using 217.Xr dhcpcd 8 218to configure network interfaces, it might override these local hostname 219settings if your DHCP server specifies client's hostname with other network 220configurations. 221.Ss Verify network interface configuration 222The first thing to do is an 223.Ic ifconfig -a 224to see if the network interfaces are properly configured. 225Correct by editing 226.Pa /etc/ifconfig. Ns Ar interface 227or the corresponding 228.Dq Va ifconfig_ Ns Ar interface 229variable in 230.Xr rc.conf 5 231(where 232.Ar interface 233is the interface name, e.g., 234.Dq le0 ) 235and then using 236.Xr ifconfig 8 237to manually configure it 238if you do not wish to reboot. 239.Pp 240Alternatively, you can configure interfaces automatically via DHCP with 241.Xr dhcpcd 8 242if you have a DHCP server running somewhere on your network. 243To get 244.Xr dhcpcd 8 245to start automatically on boot, 246you will need to have this line in 247.Pa /etc/rc.conf : 248.Pp 249.Dl dhcpcd=YES 250.Pp 251See 252.Xr dhcpcd 8 253and 254.Xr dhcpcd.conf 5 255for more information on setting up a DHCP client. 256.Pp 257You can add new 258.Dq virtual interfaces 259by adding the required entries to 260.Pa /etc/ifconfig. Ns Ar interface . 261Read the 262.Xr ifconfig.if 5 263man page for more information on the format of 264.Pa /etc/ifconfig. Ns Ar interface 265files. 266The loopback interface will look something like: 267.Bd -literal -offset indent 268lo0: flags=8009<UP,LOOPBACK,MULTICAST> mtu 32972 269 inet 127.0.0.1 netmask 0xff000000 270 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 271 inet6 ::1 prefixlen 128 272.Ed 273.Pp 274an Ethernet interface something like: 275.Bd -literal -offset indent 276le0: flags=9863<UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST> 277 inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255 278 inet6 fe80::5ef0:f0f0%le0 prefixlen 64 scopeid 0x1 279.Ed 280.Pp 281and a PPP interface something like: 282.Bd -literal -offset indent 283ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> 284 inet 203.3.131.108 --> 198.181.0.253 netmask 0xffff0000 285.Ed 286.Pp 287See 288.Xr mrouted 8 289for instructions on configuring multicast routing. 290.Ss Check routing tables 291Issue a 292.Ic netstat -rn 293command. 294The output will look something like: 295.Bd -literal -offset indent 296Routing tables 297 298Internet: 299Destination Gateway Flags Refs Use Mtu Interface 300default 192.168.4.254 UGS 0 11098028 - le0 301127 127.0.0.1 UGRS 0 0 - lo0 302127.0.0.1 127.0.0.1 UH 3 24 - lo0 303192.168.4 link#1 UC 0 0 - le0 304192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - le0 305192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - le0 306 307Internet6: 308Destination Gateway Flags Refs Use Mtu Interface 309::/96 ::1 UGRS 0 0 32972 lo0 => 310::1 ::1 UH 4 0 32972 lo0 311::ffff:0.0.0.0/96 ::1 UGRS 0 0 32972 lo0 312fc80::/10 ::1 UGRS 0 0 32972 lo0 313fe80::/10 ::1 UGRS 0 0 32972 lo0 314fe80::%le0/64 link#1 UC 0 0 1500 le0 315fe80::%lo0/64 fe80::1%lo0 U 0 0 32972 lo0 316ff01::/32 ::1 U 0 0 32972 lo0 317ff02::%le0/32 link#1 UC 0 0 1500 le0 318ff02::%lo0/32 fe80::1%lo0 UC 0 0 32972 lo0 319.Ed 320.Pp 321The default gateway address is stored in the 322.Dq Va defaultroute 323variable in 324.Pa /etc/rc.conf , 325or in the file 326.Pa /etc/mygate . 327If you need to edit this file, a painless way to reconfigure the network 328afterwards is to issue 329.Bd -literal -offset indent 330.Ic service network restart 331.Ed 332.Pp 333Or, you may prefer to manually configure using a series of 334.Ic route add 335and 336.Ic route delete 337commands (see 338.Xr route 8 ) . 339If you run 340.Xr dhcpcd 8 341you will have to kill it by running 342.Bd -literal -offset indent 343.Ic service dhcpcd stop 344.Ed 345.Pp 346before you flush the routes. 347.Pp 348If you wish to route packets between interfaces, add one or both 349of the following directives (depending on whether IPv4 or IPv6 routing 350is required) to 351.Pa /etc/sysctl.conf : 352.Pp 353.Dl net.inet.ip.forwarding=1 354.Dl net.inet6.ip6.forwarding=1 355.Pp 356As an alternative, compile a new kernel with the 357.Dq GATEWAY 358option. 359Packets are not forwarded by default, due to RFC requirements. 360.Ss Device nodes 361By default, nodes are created in 362.Pa /dev 363for a fairly typical number of devices. 364.Pp 365However, if this system has a large number of devices connected 366(e.g. for large scale storage), you may want to enable 367.Xr devpubd 8 368to ensure a sufficient number of nodes are available. 369Set 370.Dq Va devpubd=YES 371in 372.Pa /etc/rc.conf 373to create nodes automatically during system runtime. 374You can also run the node creation script by hand: 375.Bd -literal -offset indent 376.Ic cd /dev && sh MAKEDEV 377.Ed 378.Ss Secure Shell (SSH) 379By default, all services are disabled in a fresh 380.Nx 381installation, and SSH is no exception. 382You may wish to enable it so you can remotely control your system. 383Set 384.Dq Va sshd=YES 385in 386.Pa /etc/rc.conf 387and then starting the server with the command 388.Bd -literal -offset indent 389.Ic service sshd start 390.Ed 391.Pp 392The first time the server is started, it will generate a new keypair, 393which will be stored inside the directory 394.Pa /etc/ssh . 395.Ss Host names and DNS 396The system resolves host names according the rules for hosts in the 397name service switch configuration at 398.Pa /etc/nsswitch.conf . 399By default, it will query 400.Pa /etc/hosts 401first, and then the DNS resolver specified in 402.Pa /etc/resolv.conf . 403.Pp 404Multicast DNS and DNS Service Discovery are usually not enabled by 405default on a fresh NetBSD system, and can be enabled by setting 406.Dq mdnsd=YES 407in 408.Pa /etc/rc.conf , 409and either rebooting or running the following command: 410.Bd -literal -offset indent 411.Ic service mdnsd start 412.Ed 413.Pp 414If your network does not have a usable DNS resolver, e.g. one provided 415by DHCP, you can run a local caching recursive resolver by setting 416.Dq named=YES 417in 418.Pa /etc/rc.conf 419and either rebooting or running the following command: 420.Bd -literal -offset indent 421.Ic service named start 422.Ed 423.Pp 424.Xr named 8 425is configured in 426.Pa /etc/named.conf 427by default to run as a local caching recursive resolver. 428Then, to make the system use it, put the following in 429.Pa /etc/resolv.conf : 430.Bd -literal -offset indent 431nameserver 127.0.0.1 432.Ed 433.Ss Wireless networking 434To configure the system to connect to a wireless network with a password 435using WPA: 436.Bd -literal -offset indent 437.Ic wpa_passphrase networkname password >> /etc/wpa_supplicant.conf 438.Ed 439.Pp 440To to configure the system to connect to an open wireless network with 441no password, edit 442.Pa /etc/wpa_supplicant.conf 443instead of using 444.Xr wpa_passphrase 8 : 445.Bd -literal -offset indent 446network={ 447 ssid="Public-WiFi" 448 key_mgmt=NONE 449 priority=100 450} 451.Ed 452.Pp 453Then start the necessary daemons: 454.Bd -literal -offset indent 455.Ic service wpa_supplicant onestart 456.Ic service dhcpcd onestart 457.Ed 458.Pp 459To automatically connect at boot, add the following to 460.Pa /etc/rc.conf : 461.Pp 462.Dl dhcpcd=YES 463.Dl wpa_supplicant=YES 464.Pp 465While using 466.Xr wpa_supplicant 8 , 467you can easily retrieve network scan results with 468.Xr wpa_cli 8 : 469.Bd -literal -offset indent 470.Ic wpa_cli scan_results 471.Ed 472.Pp 473Or trigger a rescan: 474.Bd -literal -offset indent 475.Ic wpa_cli scan 476.Ed 477.Ss RPC-based network services 478Several services depend on the RPC portmapper 479.Xr rpcbind 8 480- formerly known as 481.Ic portmap 482- being running for proper operation. 483This includes YP (NIS) and NFS exports, among other services. 484To get the RPC portmapper to start automatically on boot, 485you will need to have this line in 486.Pa /etc/rc.conf : 487.Pp 488.Dl rpcbind=YES 489.Ss YP (NIS) Setup 490Check the YP domain name with the 491.Xr domainname 1 492command. 493If necessary, correct it by editing the 494.Pa /etc/defaultdomain 495file or by setting the 496.Dq Va domainname 497variable in 498.Pa /etc/rc.conf . 499The 500.Pa /etc/rc.d/network 501script reads this file on bootup to determine and set the domain name. 502You may also set the running system's domain name with the 503.Xr domainname 1 504command. 505To start YP client services, simply run 506.Ic ypbind , 507then perform the remaining 508YP activation as described in 509.Xr passwd 5 510and 511.Xr group 5 . 512.Pp 513In particular, to enable YP passwd support, you'll need to update 514.Pa /etc/nsswitch.conf 515to include 516.Dq nis 517for the 518.Dq passwd 519and 520.Dq group 521entries. 522A traditional way to accomplish the same thing is to 523add following entry to local passwd database via 524.Xr vipw 8 : 525.Bd -literal -offset indent 526.Li +:*:::::::: 527.Ed 528.Pp 529Note this entry has to be the very last one. 530This traditional way works with the default 531.Xr nsswitch.conf 5 532setting of 533.Dq passwd , 534which is 535.Dq compat . 536.Pp 537There are many more YP man pages available to help you. 538You can find more information by starting with 539.Xr nis 8 . 540.Ss Check disk mounts 541Check that the disks are mounted correctly by 542comparing the 543.Pa /etc/fstab 544file against the output of the 545.Xr mount 8 546and 547.Xr df 1 548commands. 549Example: 550.Bd -literal -offset indent 551.Li # Ic cat /etc/fstab 552/dev/sd0a / ffs rw 1 1 553/dev/sd0b none swap sw 554/dev/sd0e /usr ffs rw 1 2 555/dev/sd0f /var ffs rw 1 3 556/dev/sd0g /tmp ffs rw 1 4 557/dev/sd0h /home ffs rw 1 5 558 559.Li # Ic mount 560/dev/sd0a on / type ffs (local) 561/dev/sd0e on /usr type ffs (local) 562/dev/sd0f on /var type ffs (local) 563/dev/sd0g on /tmp type ffs (local) 564/dev/sd0h on /home type ffs (local) 565 566.Li # Ic df 567Filesystem 1024-blocks Used Avail Capacity Mounted on 568/dev/sd0a 22311 14589 6606 69% / 569/dev/sd0e 203399 150221 43008 78% /usr 570/dev/sd0f 10447 682 9242 7% /var 571/dev/sd0g 18823 2 17879 0% /tmp 572/dev/sd0h 7519 5255 1888 74% /home 573 574.Li # Ic pstat -s 575Device 512-blocks Used Avail Capacity Priority 576/dev/sd0b 131072 84656 46416 65% 0 577.Ed 578.Pp 579Edit 580.Pa /etc/fstab 581and use the 582.Xr mount 8 583and 584.Xr umount 8 585commands as appropriate. 586Refer to the above example and 587.Xr fstab 5 588for information on the format of this file. 589.Pp 590You may wish to do NFS mounts now too, or you can do them later. 591.Ss Concatenated disks (ccd) 592If you are using 593.Xr ccd 4 594concatenated disks, edit 595.Pa /etc/ccd.conf . 596You may wish to take a look to 597.Xr ccdconfig 8 598for more information about this file. 599Use the 600.Ic ccdconfig -U 601command to unload and the 602.Ic ccdconfig -C 603command to create tables internal to the kernel for the concatenated disks. 604You then 605.Xr mount 8 , 606.Xr umount 8 , 607and edit 608.Pa /etc/fstab 609as needed. 610.Ss Automounter daemon (AMD) 611To use the 612.Xr amd 8 613automounter, create the 614.Pa /etc/amd 615directory, copy example config files from 616.Pa /usr/share/examples/amd 617to 618.Pa /etc/amd 619and customize them as needed. 620Alternatively, you can get your maps with YP. 621.Ss Clock synchronization 622In order to make sure the system clock is synchronized 623to that of a publicly accessible NTP server, 624make sure that 625.Pa /etc/rc.conf 626contains the following: 627.Pp 628.Dl ntpdate=YES 629.Dl ntpd=YES 630.Pp 631See 632.Xr date 1 , 633.Xr ntpdate 8 , 634.Xr ntpd 8 , 635.Xr rdate 8 , 636and 637.Xr timed 8 638for more information on setting the system's date. 639.Sh CHANGING /etc FILES 640The system should be usable now, but you may wish to do more customizing, 641such as adding users, etc. 642Many of the following sections may be skipped 643if you are not using that package (for example, skip the 644.Sx Kerberos 645section if you won't be using Kerberos). 646We suggest that you 647.Ic cd /etc 648and edit most of the files in that directory. 649.Pp 650Note that the 651.Pa /etc/motd 652file is modified by 653.Pa /etc/rc.d/motd 654whenever the system is booted. 655To keep any custom message intact, ensure that you leave two blank lines 656at the top, or your message will be overwritten. 657.Ss Add new users 658To add new users and groups, there are 659.Xr useradd 8 660and 661.Xr groupadd 8 ; 662see also 663.Xr user 8 664for further programs for user and group manipulation. 665You may use 666.Xr vipw 8 667to add users to the 668.Pa /etc/passwd 669file 670and edit 671.Pa /etc/group 672by hand to add new groups. 673The manual page for 674.Xr su 1 , 675tells you to make sure to put people in 676the 677.Sq wheel 678group if they need root access (non-Kerberos). 679For example: 680.Bd -literal -offset indent 681wheel:*:0:root,myself 682.Ed 683.Pp 684Follow instructions for 685.Xr kerberos 8 686if using 687Kerberos 688for authentication. 689.Ss System boot scripts and /etc/rc.local 690.Pa /etc/rc 691and the 692.Pa /etc/rc.d/* 693scripts are invoked at boot time after single user mode has exited, 694and at shutdown. 695The whole process is controlled by the master script 696.Pa /etc/rc . 697This script should not be changed by administrators. 698.Pp 699The directory 700.Pa /etc/rc.d 701contains a series of scripts used at startup/shutdown, called by 702.Pa /etc/rc . 703.Pa /etc/rc 704is in turn influenced by the configuration variables present in 705.Pa /etc/rc.conf . 706.Pp 707The script 708.Pa /etc/rc.local 709is run as the last thing during multiuser boot, and is provided 710to allow any other local hooks necessary for the system. 711.Ss rc.conf 712To enable or disable various services on system startup, 713corresponding entries can be made in 714.Pa /etc/rc.conf . 715You can take a look at 716.Pa /etc/defaults/rc.conf 717to see a list of default system variables, which you can override in 718.Pa /etc/rc.conf . 719Note you are 720.Em not 721supposed to change 722.Pa /etc/defaults/rc.conf 723directly, edit only 724.Pa /etc/rc.conf . 725See 726.Xr rc.conf 5 727for further information. 728.Ss X Display Manager 729If you've installed X, you may want to turn on 730.Xr xdm 1 , 731the X Display Manager. 732To do this, set 733.Dq xdm=YES 734in 735.Pa /etc/rc.conf . 736.Ss Printers 737Edit 738.Pa /etc/printcap 739and 740.Pa /etc/hosts.lpd 741to get any printers set up. 742Consult 743.Xr lpd 8 744and 745.Xr printcap 5 746if needed. 747.Ss Tighten up security 748In 749.Pa /etc/inetd.conf 750comment out any extra entries you do not need, and only add things 751that are really needed. 752Note that by default all services are disabled for security reasons. 753.Ss Kerberos 754If you are going to use Kerberos for authentication, 755see 756.Xr kerberos 8 757and 758.Dq info heimdal 759for more information. 760If you already have a Kerberos master, change directory to 761.Pa /etc/kerberosV 762and configure. 763Remember to get a 764.Pa srvtab 765from the master so that the remote commands work. 766.Ss Mail Aliases 767Check 768.Pa /etc/mail/aliases 769and update appropriately if you want e-mail to be routed 770to non-local addresses or to different users. 771.Pp 772Run 773.Xr newaliases 1 774after changes. 775.Ss Postfix 776.Nx 777uses Postfix as its MTA. 778Postfix is started by default, but its initial configuration does not 779cause it to listen on the network for incoming connections. 780To configure Postfix, see 781.Pa /etc/postfix/main.cf 782and 783.Pa /etc/postfix/master.cf . 784If you wish to use a different MTA (e.g., sendmail), install your MTA of 785choice and edit 786.Pa /etc/mailer.conf 787to point to the proper binaries. 788.Ss DHCP server 789If this is a 790DHCP 791server, edit 792.Pa /etc/dhcpd.conf 793and 794.Pa /etc/dhcpd.interfaces 795as needed. 796You will have to make sure 797.Pa /etc/rc.conf 798has 799.Dq dhcpd=YES 800or run 801.Xr dhcpd 8 802manually. 803.Ss Bootparam server 804If this is a 805Bootparam 806server, edit 807.Pa /etc/bootparams 808as needed. 809You will have to turn it on in 810.Pa /etc/rc.conf 811by adding 812.Dq bootparamd=YES . 813.Ss NFS server 814If this is an NFS server, make sure 815.Pa /etc/rc.conf 816has: 817.Bd -literal -offset indent 818nfs_server=YES 819mountd=YES 820rpcbind=YES 821.Ed 822.Pp 823Edit 824.Pa /etc/exports 825and get it correct. 826After this, you can start the server by issuing: 827.Bd -literal -offset indent 828.Ic service rpcbind start 829.Ic service mountd start 830.Ic service nfsd start 831.Ed 832which will also start dependencies. 833.Ss HP remote boot server 834Edit 835.Pa /etc/rbootd.conf 836if needed for remote booting. 837If you do not have HP computers doing remote booting, do not enable this. 838.Ss Daily, weekly, monthly scripts 839Look at and possibly edit the 840.Pa /etc/daily.conf , /etc/weekly.conf , 841and 842.Pa /etc/monthly.conf 843configuration files. 844You can check which values you can set by looking 845to their matching files in 846.Pa /etc/defaults . 847Your site specific things should go into 848.Pa /etc/daily.local , /etc/weekly.local , 849and 850.Pa /etc/monthly.local . 851.Pp 852These scripts have been limited so as to keep the system running without 853filling up disk space from normal running processes and database updates. 854(You probably do not need to understand them.) 855.Ss Other files in /etc 856Look at the other files in 857.Pa /etc 858and edit them as needed. 859(Do not edit files ending in 860.Pa .db 861\(em like 862.Pa pwd.db , spwd.db , 863nor 864.Pa localtime , 865nor 866.Pa rmt , 867nor any directories.) 868.Ss Crontab (background running processes) 869Check what is running by typing 870.Ic crontab -l 871as root 872and see if anything unexpected is present. 873Do you need anything else? 874Do you wish to change things? 875For example, if you do not 876like root getting standard output of the daily scripts, and want only 877the security scripts that are mailed internally, you can type 878.Ic crontab -e 879and change some of the lines to read: 880.Bd -literal -offset indent 88130 1 * * * /bin/sh /etc/daily 2>&1 > /var/log/daily.out 88230 3 * * 6 /bin/sh /etc/weekly 2>&1 > /var/log/weekly.out 88330 5 1 * * /bin/sh /etc/monthly 2>&1 > /var/log/monthly.out 884.Ed 885.Pp 886See 887.Xr crontab 5 . 888.Ss Next day cleanup 889After the first night's security run, change ownerships and permissions 890on files, directories, and devices; root should have received mail 891with subject: "<hostname> daily insecurity output.". 892This mail contains 893a set of security recommendations, presented as a list looking like this: 894.Bd -literal -offset indent 895var/mail: 896 permissions (0755, 0775) 897etc/daily: 898 user (0, 3) 899.Ed 900.Pp 901The best bet is to follow the advice in that list. 902The recommended setting is the first item in parentheses, while 903the current setting is the second one. 904This list is generated by 905.Xr mtree 8 906using 907.Pa /etc/mtree/special . 908Use 909.Xr chmod 1 , 910.Xr chgrp 1 , 911and 912.Xr chown 8 913as needed. 914.Ss Packages 915Install your own packages. 916The 917.Nx 918packages collection, pkgsrc, includes a large set of third-party software. 919A lot of it is available as binary packages that you can download from 920.Lk https://cdn.netbsd.org/pub/pkgsrc/packages/NetBSD/ 921or a mirror. 922.Pp 923For most users, using pkgin to manage binary packages is recommended. 924.Pp 925To install pkgin, if it was not done by the installer: 926.Bd -literal -offset indent 927.Ic export PKG_PATH=https://cdn.netbsd.org/pub/pkgsrc/packages/NetBSD/$(uname -p)/$(uname -r | cut -d_ -f1)/All 928.Ic pkg_add pkgin 929.Ic pkgin update 930.Ic pkgin install bash mpg123 fluxbox ... 931.Ed 932.Pp 933See 934.Lk https://www.NetBSD.org/docs/pkgsrc/ 935and 936.Pa pkgsrc/doc/pkgsrc.txt 937for more details. 938.Pp 939Copy vendor binaries and install them. 940You will need to install any shared libraries, etc. 941(Hint: 942.Ic man -k compat 943to find out how to install and use compatibility mode.) 944.Pp 945There is also other third-party software that is available 946in source form only, either because it has not been ported to 947.Nx 948yet, because licensing restrictions make binary redistribution 949impossible, or simply because you want to build your own binaries. 950Sometimes checking the mailing lists for 951past problems that people have encountered will result in a fix posted. 952.Ss Check the running system 953You can use 954.Xr ps 1 , 955.Xr netstat 1 , 956and 957.Xr fstat 1 958to check on running processes, network connections, and opened files, 959respectively. 960Other tools you may find useful are 961.Xr systat 1 962and 963.Xr top 1 . 964.Sh SYSTEM TESTING 965At this point, the system should be fully configured to your liking. 966It is now a good time to ensure that the system behaves according to 967its specifications and that it is stable on your hardware. 968Please refer to 969.Xr tests 7 970for details on how to do so. 971.Sh SEE ALSO 972.Xr chgrp 1 , 973.Xr chmod 1 , 974.Xr config 1 , 975.Xr crontab 1 , 976.Xr date 1 , 977.Xr df 1 , 978.Xr domainname 1 , 979.Xr fstat 1 , 980.Xr hostname 1 , 981.Xr make 1 , 982.Xr man 1 , 983.Xr netstat 1 , 984.Xr newaliases 1 , 985.Xr passwd 1 , 986.Xr pkg_add 1 , 987.Xr ps 1 , 988.Xr ssh 1 , 989.Xr su 1 , 990.Xr systat 1 , 991.Xr top 1 , 992.Xr xdm 1 , 993.Xr ccd 4 , 994.Xr aliases 5 , 995.Xr crontab 5 , 996.Xr dhcpcd.conf 5 , 997.Xr exports 5 , 998.Xr fstab 5 , 999.Xr group 5 , 1000.Xr hosts 5 , 1001.Xr ifconfig.if 5 , 1002.Xr mailer.conf 5 , 1003.Xr named.conf 5 , 1004.Xr nsswitch.conf 5 , 1005.Xr passwd 5 , 1006.Xr printcap 5 , 1007.Xr rc.conf 5 , 1008.Xr resolv.conf 5 , 1009.Xr sshd_config 5 , 1010.Xr wpa_supplicant.conf 5 , 1011.Xr wscons.conf 5 , 1012.Xr hier 7 , 1013.Xr hostname 7 , 1014.Xr pkgsrc 7 , 1015.Xr tests 7 , 1016.Xr amd 8 , 1017.Xr ccdconfig 8 , 1018.Xr chown 8 , 1019.Xr devpubd 8 , 1020.Xr dhcpcd 8 , 1021.Xr dhcpd 8 , 1022.Xr dmesg 8 , 1023.Xr groupadd 8 , 1024.Xr ifconfig 8 , 1025.Xr inetd 8 , 1026.Xr kerberos 8 , 1027.Xr lpd 8 , 1028.Xr mdnsd 8 , 1029.Xr mount 8 , 1030.Xr mrouted 8 , 1031.Xr mtree 8 , 1032.Xr named 8 , 1033.Xr nis 8 , 1034.Xr ntpd 8 , 1035.Xr ntpdate 8 , 1036.Xr rbootd 8 , 1037.Xr rc 8 , 1038.Xr rdate 8 , 1039.Xr rmt 8 , 1040.Xr route 8 , 1041.Xr rpc.bootparamd 8 , 1042.Xr rpcbind 8 , 1043.Xr sshd 8 , 1044.Xr timed 8 , 1045.Xr umount 8 , 1046.Xr useradd 8 , 1047.Xr vipw 8 , 1048.Xr wpa_cli 8 , 1049.Xr wpa_supplicant 8 , 1050.Xr yp 8 , 1051.Xr ypbind 8 1052.Sh HISTORY 1053This document first appeared in 1054.Ox 2.2 . 1055It has been adapted to 1056.Nx 1057and first appeared in 1058.Nx 2.0 . 1059