1.\" $NetBSD: afterboot.8,v 1.76 2021/01/10 23:24:26 riastradh Exp $ 2.\" $OpenBSD: afterboot.8,v 1.72 2002/02/22 02:02:33 miod Exp $ 3.\" 4.\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu 5.\" Adapted to NetBSD by Julio Merino -- 2002-05-10, jmmv@NetBSD.org 6.\" 7.\" 8.\" Copyright (c) 2002-2008 The NetBSD Foundation, Inc. 9.\" All rights reserved. 10.\" 11.\" Redistribution and use in source and binary forms, with or without 12.\" modification, are permitted provided that the following conditions 13.\" are met: 14.\" 1. Redistributions of source code must retain the above copyright 15.\" notice, this list of conditions and the following disclaimer. 16.\" 2. Redistributions in binary form must reproduce the above copyright 17.\" notice, this list of conditions and the following disclaimer in the 18.\" documentation and/or other materials provided with the distribution. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 21.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 24.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30.\" POSSIBILITY OF SUCH DAMAGE. 31.\" 32.\" 33.\" Copyright (c) 1997 Marshall M. Midden 34.\" All rights reserved. 35.\" 36.\" Redistribution and use in source and binary forms, with or without 37.\" modification, are permitted provided that the following conditions 38.\" are met: 39.\" 40.\" 1. Redistributions of source code must retain the above copyright 41.\" notice, this list of conditions and the following disclaimer. 42.\" 2. Redistributions in binary form must reproduce the above copyright 43.\" notice, this list of conditions and the following disclaimer in the 44.\" documentation and/or other materials provided with the distribution. 45.\" 3. All advertising materials mentioning features or use of this software 46.\" must display the following acknowledgement: 47.\" This product includes software developed by Marshall M. Midden. 48.\" 4. The name of the author may not be used to endorse or promote products 49.\" derived from this software without specific prior written permission. 50.\" 51.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 52.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 53.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 54.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 55.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 56.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 57.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 58.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 59.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 60.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 61.\" 62.Dd October 5, 2020 63.Dt AFTERBOOT 8 64.Os 65.Sh NAME 66.Nm afterboot 67.Nd things to check after the first complete boot 68.Sh DESCRIPTION 69.Ss Starting Out 70This document attempts to list items for the system administrator 71to check and set up after the installation and first complete boot of the 72system. 73The idea is to create a list of items that can be checked off so that you have 74a warm fuzzy feeling that something obvious has not been missed. 75A basic knowledge of 76.Ux 77is assumed. 78.Pp 79Complete instructions for correcting and fixing items is not provided. 80There are manual pages and other methodologies available for doing that. 81For example, to view the man page for the 82.Xr ls 1 83command, type: 84.Bd -literal -offset indent 85.Ic man 1 ls 86.Ed 87.Pp 88Administrators will rapidly become more familiar with 89.Nx 90if they get used to using the manual pages. 91.Ss Security alerts 92By the time that you have installed your system, it is quite likely that 93bugs in the release have been found. 94All significant and easily fixed problems will be reported at 95.Lk http://www.NetBSD.org/support/security/ . 96It is recommended that you check this page regularly. 97.Pp 98Additionally, you should set 99.Dq fetch_pkg_vulnerabilities=YES 100in 101.Pa /etc/daily.conf 102to allow your system to automatically update the local database of known 103vulnerable packages to the latest version available on-line. 104The system will later check, on a daily basis, if any of your installed 105packages are vulnerable based on the contents of this database. 106See 107.Xr daily.conf 5 108and 109.Xr security.conf 5 110for more details. 111.Ss Entropy 112If your machine does not have a hardware random number generator, it 113may not be safe to use on the internet until it has enough entropy to 114generate unpredictable secrets for programs like web browsers and 115.Xr ssh 1 . 116You can use 117.Xr rndctl 8 118to list the entropy sources with 119.Ic rndctl -l , 120or save entropy from another machine running 121.Nx 122with 123.Ic rndctl -S 124and load it on this one with 125.Ic rndctl -L 126(as long as there are no eavesdroppers on the medium between the two 127machines). 128See 129.Xr entropy 7 130for more details. 131.Ss Login 132On a fresh install with no other user accounts, login as 133.Dq Ic root . 134You can do so on the console, or over the network using 135.Xr ssh 1 . 136If you have enabled the SSH daemon (see 137.Xr sshd 8 ) 138and wish to allow root logins over the network, edit the 139.Pa /etc/ssh/sshd_config 140file and set 141.Dq PermitRootLogin 142to 143.Dq yes 144(see 145.Xr sshd_config 5 ) . 146The default is to not permit root logins over the network 147after fresh install in 148.Nx . 149.Pp 150Upon successful login on the console, you may see the message 151.Dq We recommend creating a non-root account... . 152For security reasons, it is bad practice to login as root during 153regular use and maintenance of the system. 154In fact, the system will only let you login as root on a secure 155terminal. 156By default, only the console is considered to be a secure terminal. 157Instead, administrators are encouraged to add a 158.Dq regular 159user, add said user to the 160.Dq wheel 161group, then use the 162.Xr su 1 163command when root privileges are required. 164This process is described in more detail later. 165.Ss Root password 166Change the password for the root user. 167(Note that throughout the documentation, the term 168.Dq superuser 169is a synonym for the root user.) 170Choose a password that has numbers, digits, and special characters (not space) 171as well as from the upper and lower case alphabet. 172Do not choose any word in any language. 173It is common for an intruder to use dictionary attacks. 174Type the command 175.Ic /usr/bin/passwd 176to change it. 177.Pp 178It is a good idea to always specify the full path name for both the 179.Xr passwd 1 180and 181.Xr su 1 182commands as this inhibits the possibility of files placed in your execution 183.Ev PATH 184for most shells. 185Furthermore, the superuser's 186.Ev PATH 187should never contain the current directory 188.Po Dq \&. 189.Pc . 190.Ss System date 191Check the system date with the 192.Xr date 1 193command. 194If needed, change the date, and/or change the symbolic link of 195.Pa /etc/localtime 196to the correct time zone in the 197.Pa /usr/share/zoneinfo 198directory. 199.Pp 200Examples: 201.Bl -tag -width date 202.It Cm date 202010051820 203Set the current date to October 5th, 2020 6:20pm. 204.It Cm ln -fs /usr/share/zoneinfo/Europe/Helsinki /etc/localtime 205Set the time zone to Eastern Europe Summer Time. 206.El 207.Ss Console settings 208One of the first things you will likely need to do is to set up your 209keyboard map (and maybe some other aspects about the system console). 210To change your keyboard encoding, edit the 211.Dq Va encoding 212variable found in 213.Pa /etc/wscons.conf . 214.Pp 215.Xr wscons.conf 5 216contains more information about this file. 217.Ss Check hostname 218Use the 219.Ic hostname 220command to verify that the name of your machine is correct. 221See the man page for 222.Xr hostname 1 223if it needs to be changed. 224You will also need to change the contents of the 225.Dq Va hostname 226variable in 227.Pa /etc/rc.conf 228or edit the 229.Pa /etc/myname 230file to have it stick around for the next reboot. 231Note that 232.Dq Va hostname 233is supposed include a domainname, and that this should 234not be confused with YP (NIS) 235.Xr domainname 1 . 236If you are using 237.Xr dhcpcd 8 238to configure network interfaces, it might override these local hostname 239settings if your DHCP server specifies client's hostname with other network 240configurations. 241.Ss Verify network interface configuration 242The first thing to do is an 243.Ic ifconfig -a 244to see if the network interfaces are properly configured. 245Correct by editing 246.Pa /etc/ifconfig. Ns Ar interface 247or the corresponding 248.Dq Va ifconfig_ Ns Ar interface 249variable in 250.Xr rc.conf 5 251(where 252.Ar interface 253is the interface name, e.g., 254.Dq le0 ) 255and then using 256.Xr ifconfig 8 257to manually configure it 258if you do not wish to reboot. 259.Pp 260Alternatively, you can configure interfaces automatically via DHCP with 261.Xr dhcpcd 8 262if you have a DHCP server running somewhere on your network. 263To get 264.Xr dhcpcd 8 265to start automatically on boot, 266you will need to have this line in 267.Pa /etc/rc.conf : 268.Pp 269.Dl dhcpcd=YES 270.Pp 271See 272.Xr dhcpcd 8 273and 274.Xr dhcpcd.conf 5 275for more information on setting up a DHCP client. 276.Pp 277You can add new 278.Dq virtual interfaces 279by adding the required entries to 280.Pa /etc/ifconfig. Ns Ar interface . 281Read the 282.Xr ifconfig.if 5 283man page for more information on the format of 284.Pa /etc/ifconfig. Ns Ar interface 285files. 286The loopback interface will look something like: 287.Bd -literal -offset indent 288lo0: flags=8009<UP,LOOPBACK,MULTICAST> mtu 32972 289 inet 127.0.0.1 netmask 0xff000000 290 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 291 inet6 ::1 prefixlen 128 292.Ed 293.Pp 294an Ethernet interface something like: 295.Bd -literal -offset indent 296le0: flags=9863<UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST> 297 inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255 298 inet6 fe80::5ef0:f0f0%le0 prefixlen 64 scopeid 0x1 299.Ed 300.Pp 301and a PPP interface something like: 302.Bd -literal -offset indent 303ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> 304 inet 203.3.131.108 --> 198.181.0.253 netmask 0xffff0000 305.Ed 306.Pp 307See 308.Xr mrouted 8 309for instructions on configuring multicast routing. 310.Ss Check routing tables 311Issue a 312.Ic netstat -rn 313command. 314The output will look something like: 315.Bd -literal -offset indent 316Routing tables 317 318Internet: 319Destination Gateway Flags Refs Use Mtu Interface 320default 192.168.4.254 UGS 0 11098028 - le0 321127 127.0.0.1 UGRS 0 0 - lo0 322127.0.0.1 127.0.0.1 UH 3 24 - lo0 323192.168.4 link#1 UC 0 0 - le0 324192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - le0 325192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - le0 326 327Internet6: 328Destination Gateway Flags Refs Use Mtu Interface 329::/96 ::1 UGRS 0 0 32972 lo0 => 330::1 ::1 UH 4 0 32972 lo0 331::ffff:0.0.0.0/96 ::1 UGRS 0 0 32972 lo0 332fc80::/10 ::1 UGRS 0 0 32972 lo0 333fe80::/10 ::1 UGRS 0 0 32972 lo0 334fe80::%le0/64 link#1 UC 0 0 1500 le0 335fe80::%lo0/64 fe80::1%lo0 U 0 0 32972 lo0 336ff01::/32 ::1 U 0 0 32972 lo0 337ff02::%le0/32 link#1 UC 0 0 1500 le0 338ff02::%lo0/32 fe80::1%lo0 UC 0 0 32972 lo0 339.Ed 340.Pp 341The default gateway address is stored in the 342.Dq Va defaultroute 343variable in 344.Pa /etc/rc.conf , 345or in the file 346.Pa /etc/mygate . 347If you need to edit this file, a painless way to reconfigure the network 348afterwards is to issue 349.Bd -literal -offset indent 350.Ic service network restart 351.Ed 352.Pp 353Or, you may prefer to manually configure using a series of 354.Ic route add 355and 356.Ic route delete 357commands (see 358.Xr route 8 ) . 359If you run 360.Xr dhcpcd 8 361you will have to kill it by running 362.Bd -literal -offset indent 363.Ic service dhcpcd stop 364.Ed 365.Pp 366before you flush the routes. 367.Pp 368If you wish to route packets between interfaces, add one or both 369of the following directives (depending on whether IPv4 or IPv6 routing 370is required) to 371.Pa /etc/sysctl.conf : 372.Pp 373.Dl net.inet.ip.forwarding=1 374.Dl net.inet6.ip6.forwarding=1 375.Pp 376As an alternative, compile a new kernel with the 377.Dq GATEWAY 378option. 379Packets are not forwarded by default, due to RFC requirements. 380.Ss Device nodes 381By default, nodes are created in 382.Pa /dev 383for a fairly typical number of devices. 384.Pp 385However, if this system has a large number of devices connected 386(e.g. for large scale storage), you may want to enable 387.Xr devpubd 8 388to ensure a sufficient number of nodes are available. 389Set 390.Dq Va devpubd=YES 391in 392.Pa /etc/rc.conf 393to create nodes automatically during system runtime. 394You can also run the node creation script by hand: 395.Bd -literal -offset indent 396.Ic cd /dev && sh MAKEDEV 397.Ed 398.Ss Secure Shell (SSH) 399By default, all services are disabled in a fresh 400.Nx 401installation, and SSH is no exception. 402You may wish to enable it so you can remotely control your system. 403Set 404.Dq Va sshd=YES 405in 406.Pa /etc/rc.conf 407and then starting the server with the command 408.Bd -literal -offset indent 409.Ic service sshd start 410.Ed 411.Pp 412The first time the server is started, it will generate a new keypair, 413which will be stored inside the directory 414.Pa /etc/ssh . 415.Ss Host names and DNS 416The system resolves host names according the rules for hosts in the 417name service switch configuration at 418.Pa /etc/nsswitch.conf . 419By default, it will query 420.Pa /etc/hosts 421first, and then the DNS resolver specified in 422.Pa /etc/resolv.conf . 423.Pp 424Multicast DNS and DNS Service Discovery are usually not enabled by 425default on a fresh NetBSD system, and can be enabled by setting 426.Dq mdnsd=YES 427in 428.Pa /etc/rc.conf , 429and either rebooting or running the following command: 430.Bd -literal -offset indent 431.Ic service mdnsd start 432.Ed 433.Pp 434If your network does not have a usable DNS resolver, e.g. one provided 435by DHCP, you can run a local caching recursive resolver by setting 436.Dq named=YES 437in 438.Pa /etc/rc.conf 439and either rebooting or running the following command: 440.Bd -literal -offset indent 441.Ic service named start 442.Ed 443.Pp 444.Xr named 8 445is configured in 446.Pa /etc/named.conf 447by default to run as a local caching recursive resolver. 448Then, to make the system use it, put the following in 449.Pa /etc/resolv.conf : 450.Bd -literal -offset indent 451nameserver 127.0.0.1 452.Ed 453.Ss Wireless networking 454To configure the system to connect to a wireless network with a password 455using WPA: 456.Bd -literal -offset indent 457.Ic wpa_passphrase networkname password >> /etc/wpa_supplicant.conf 458.Ed 459.Pp 460To to configure the system to connect to an open wireless network with 461no password, edit 462.Pa /etc/wpa_supplicant.conf 463instead of using 464.Xr wpa_passphrase 8 : 465.Bd -literal -offset indent 466network={ 467 ssid="Public-WiFi" 468 key_mgmt=NONE 469 priority=100 470} 471.Ed 472.Pp 473Then bring up the interface and start the necessary daemons: 474.Bd -literal -offset indent 475.Ic ifconfig iwm0 up 476.Ic service wpa_supplicant onestart 477.Ic service dhcpcd onestart 478.Ed 479.Pp 480To automatically connect at boot, add the following to 481.Pa /etc/rc.conf : 482.Pp 483.Dl ifconfig_iwm0="up" 484.Dl dhcpcd=YES 485.Dl wpa_supplicant=YES 486.Pp 487While using 488.Xr wpa_supplicant 8 , 489you can easily retrieve network scan results with 490.Xr wpa_cli 8 : 491.Bd -literal -offset indent 492.Ic wpa_cli scan_results 493.Ed 494.Pp 495Or trigger a rescan: 496.Bd -literal -offset indent 497.Ic wpa_cli scan 498.Ed 499.Ss RPC-based network services 500Several services depend on the RPC portmapper 501.Xr rpcbind 8 502- formerly known as 503.Ic portmap 504- being running for proper operation. 505This includes YP (NIS) and NFS exports, among other services. 506To get the RPC portmapper to start automatically on boot, 507you will need to have this line in 508.Pa /etc/rc.conf : 509.Pp 510.Dl rpcbind=YES 511.Ss YP (NIS) Setup 512Check the YP domain name with the 513.Xr domainname 1 514command. 515If necessary, correct it by editing the 516.Pa /etc/defaultdomain 517file or by setting the 518.Dq Va domainname 519variable in 520.Pa /etc/rc.conf . 521The 522.Pa /etc/rc.d/network 523script reads this file on bootup to determine and set the domain name. 524You may also set the running system's domain name with the 525.Xr domainname 1 526command. 527To start YP client services, simply run 528.Ic ypbind , 529then perform the remaining 530YP activation as described in 531.Xr passwd 5 532and 533.Xr group 5 . 534.Pp 535In particular, to enable YP passwd support, you'll need to update 536.Pa /etc/nsswitch.conf 537to include 538.Dq nis 539for the 540.Dq passwd 541and 542.Dq group 543entries. 544A traditional way to accomplish the same thing is to 545add following entry to local passwd database via 546.Xr vipw 8 : 547.Bd -literal -offset indent 548.Li +:*:::::::: 549.Ed 550.Pp 551Note this entry has to be the very last one. 552This traditional way works with the default 553.Xr nsswitch.conf 5 554setting of 555.Dq passwd , 556which is 557.Dq compat . 558.Pp 559There are many more YP man pages available to help you. 560You can find more information by starting with 561.Xr nis 8 . 562.Ss Check disk mounts 563Check that the disks are mounted correctly by 564comparing the 565.Pa /etc/fstab 566file against the output of the 567.Xr mount 8 568and 569.Xr df 1 570commands. 571Example: 572.Bd -literal -offset indent 573.Li # Ic cat /etc/fstab 574/dev/sd0a / ffs rw 1 1 575/dev/sd0b none swap sw 576/dev/sd0e /usr ffs rw 1 2 577/dev/sd0f /var ffs rw 1 3 578/dev/sd0g /tmp ffs rw 1 4 579/dev/sd0h /home ffs rw 1 5 580 581.Li # Ic mount 582/dev/sd0a on / type ffs (local) 583/dev/sd0e on /usr type ffs (local) 584/dev/sd0f on /var type ffs (local) 585/dev/sd0g on /tmp type ffs (local) 586/dev/sd0h on /home type ffs (local) 587 588.Li # Ic df 589Filesystem 1024-blocks Used Avail Capacity Mounted on 590/dev/sd0a 22311 14589 6606 69% / 591/dev/sd0e 203399 150221 43008 78% /usr 592/dev/sd0f 10447 682 9242 7% /var 593/dev/sd0g 18823 2 17879 0% /tmp 594/dev/sd0h 7519 5255 1888 74% /home 595 596.Li # Ic pstat -s 597Device 512-blocks Used Avail Capacity Priority 598/dev/sd0b 131072 84656 46416 65% 0 599.Ed 600.Pp 601Edit 602.Pa /etc/fstab 603and use the 604.Xr mount 8 605and 606.Xr umount 8 607commands as appropriate. 608Refer to the above example and 609.Xr fstab 5 610for information on the format of this file. 611.Pp 612You may wish to do NFS mounts now too, or you can do them later. 613.Ss Concatenated disks (ccd) 614If you are using 615.Xr ccd 4 616concatenated disks, edit 617.Pa /etc/ccd.conf . 618You may wish to take a look to 619.Xr ccdconfig 8 620for more information about this file. 621Use the 622.Ic ccdconfig -U 623command to unload and the 624.Ic ccdconfig -C 625command to create tables internal to the kernel for the concatenated disks. 626You then 627.Xr mount 8 , 628.Xr umount 8 , 629and edit 630.Pa /etc/fstab 631as needed. 632.Ss Automounter daemon (AMD) 633To use the 634.Xr amd 8 635automounter, create the 636.Pa /etc/amd 637directory, copy example config files from 638.Pa /usr/share/examples/amd 639to 640.Pa /etc/amd 641and customize them as needed. 642Alternatively, you can get your maps with YP. 643.Ss Clock synchronization 644In order to make sure the system clock is synchronized 645to that of a publicly accessible NTP server, 646make sure that 647.Pa /etc/rc.conf 648contains the following: 649.Pp 650.Dl ntpdate=YES 651.Dl ntpd=YES 652.Pp 653See 654.Xr date 1 , 655.Xr ntpdate 8 , 656.Xr ntpd 8 , 657.Xr rdate 8 , 658and 659.Xr timed 8 660for more information on setting the system's date. 661.Sh CHANGING /etc FILES 662The system should be usable now, but you may wish to do more customizing, 663such as adding users, etc. 664Many of the following sections may be skipped 665if you are not using that package (for example, skip the 666.Sx Kerberos 667section if you won't be using Kerberos). 668We suggest that you 669.Ic cd /etc 670and edit most of the files in that directory. 671.Pp 672Note that the 673.Pa /etc/motd 674file is modified by 675.Pa /etc/rc.d/motd 676whenever the system is booted. 677To keep any custom message intact, ensure that you leave two blank lines 678at the top, or your message will be overwritten. 679.Ss Add new users 680To add new users and groups, there are 681.Xr useradd 8 682and 683.Xr groupadd 8 ; 684see also 685.Xr user 8 686for further programs for user and group manipulation. 687You may use 688.Xr vipw 8 689to add users to the 690.Pa /etc/passwd 691file 692and edit 693.Pa /etc/group 694by hand to add new groups. 695The manual page for 696.Xr su 1 , 697tells you to make sure to put people in 698the 699.Sq wheel 700group if they need root access (non-Kerberos). 701For example: 702.Bd -literal -offset indent 703wheel:*:0:root,myself 704.Ed 705.Pp 706Follow instructions for 707.Xr kerberos 8 708if using 709Kerberos 710for authentication. 711.Ss System boot scripts and /etc/rc.local 712.Pa /etc/rc 713and the 714.Pa /etc/rc.d/* 715scripts are invoked at boot time after single user mode has exited, 716and at shutdown. 717The whole process is controlled by the master script 718.Pa /etc/rc . 719This script should not be changed by administrators. 720.Pp 721The directory 722.Pa /etc/rc.d 723contains a series of scripts used at startup/shutdown, called by 724.Pa /etc/rc . 725.Pa /etc/rc 726is in turn influenced by the configuration variables present in 727.Pa /etc/rc.conf . 728.Pp 729The script 730.Pa /etc/rc.local 731is run as the last thing during multiuser boot, and is provided 732to allow any other local hooks necessary for the system. 733.Ss rc.conf 734To enable or disable various services on system startup, 735corresponding entries can be made in 736.Pa /etc/rc.conf . 737You can take a look at 738.Pa /etc/defaults/rc.conf 739to see a list of default system variables, which you can override in 740.Pa /etc/rc.conf . 741Note you are 742.Em not 743supposed to change 744.Pa /etc/defaults/rc.conf 745directly, edit only 746.Pa /etc/rc.conf . 747See 748.Xr rc.conf 5 749for further information. 750.Ss X Display Manager 751If you've installed X, you may want to turn on 752.Xr xdm 1 , 753the X Display Manager. 754To do this, set 755.Dq xdm=YES 756in 757.Pa /etc/rc.conf . 758.Ss Printers 759Edit 760.Pa /etc/printcap 761and 762.Pa /etc/hosts.lpd 763to get any printers set up. 764Consult 765.Xr lpd 8 766and 767.Xr printcap 5 768if needed. 769.Ss Tighten up security 770In 771.Pa /etc/inetd.conf 772comment out any extra entries you do not need, and only add things 773that are really needed. 774Note that by default all services are disabled for security reasons. 775.Ss Kerberos 776If you are going to use Kerberos for authentication, 777see 778.Xr kerberos 8 779and 780.Dq info heimdal 781for more information. 782If you already have a Kerberos master, change directory to 783.Pa /etc/kerberosV 784and configure. 785Remember to get a 786.Pa srvtab 787from the master so that the remote commands work. 788.Ss Mail Aliases 789Check 790.Pa /etc/mail/aliases 791and update appropriately if you want e-mail to be routed 792to non-local addresses or to different users. 793.Pp 794Run 795.Xr newaliases 1 796after changes. 797.Ss Postfix 798.Nx 799uses Postfix as its MTA. 800Postfix is started by default, but its initial configuration does not 801cause it to listen on the network for incoming connections. 802To configure Postfix, see 803.Pa /etc/postfix/main.cf 804and 805.Pa /etc/postfix/master.cf . 806If you wish to use a different MTA (e.g., sendmail), install your MTA of 807choice and edit 808.Pa /etc/mailer.conf 809to point to the proper binaries. 810.Ss DHCP server 811If this is a 812DHCP 813server, edit 814.Pa /etc/dhcpd.conf 815and 816.Pa /etc/dhcpd.interfaces 817as needed. 818You will have to make sure 819.Pa /etc/rc.conf 820has 821.Dq dhcpd=YES 822or run 823.Xr dhcpd 8 824manually. 825.Ss Bootparam server 826If this is a 827Bootparam 828server, edit 829.Pa /etc/bootparams 830as needed. 831You will have to turn it on in 832.Pa /etc/rc.conf 833by adding 834.Dq bootparamd=YES . 835.Ss NFS server 836If this is an NFS server, make sure 837.Pa /etc/rc.conf 838has: 839.Bd -literal -offset indent 840nfs_server=YES 841mountd=YES 842rpcbind=YES 843.Ed 844.Pp 845Edit 846.Pa /etc/exports 847and get it correct. 848After this, you can start the server by issuing: 849.Bd -literal -offset indent 850.Ic service rpcbind start 851.Ic service mountd start 852.Ic service nfsd start 853.Ed 854which will also start dependencies. 855.Ss HP remote boot server 856Edit 857.Pa /etc/rbootd.conf 858if needed for remote booting. 859If you do not have HP computers doing remote booting, do not enable this. 860.Ss Daily, weekly, monthly scripts 861Look at and possibly edit the 862.Pa /etc/daily.conf , /etc/weekly.conf , 863and 864.Pa /etc/monthly.conf 865configuration files. 866You can check which values you can set by looking 867to their matching files in 868.Pa /etc/defaults . 869Your site specific things should go into 870.Pa /etc/daily.local , /etc/weekly.local , 871and 872.Pa /etc/monthly.local . 873.Pp 874These scripts have been limited so as to keep the system running without 875filling up disk space from normal running processes and database updates. 876(You probably do not need to understand them.) 877.Ss Other files in /etc 878Look at the other files in 879.Pa /etc 880and edit them as needed. 881(Do not edit files ending in 882.Pa .db 883\(em like 884.Pa pwd.db , spwd.db , 885nor 886.Pa localtime , 887nor 888.Pa rmt , 889nor any directories.) 890.Ss Crontab (background running processes) 891Check what is running by typing 892.Ic crontab -l 893as root 894and see if anything unexpected is present. 895Do you need anything else? 896Do you wish to change things? 897For example, if you do not 898like root getting standard output of the daily scripts, and want only 899the security scripts that are mailed internally, you can type 900.Ic crontab -e 901and change some of the lines to read: 902.Bd -literal -offset indent 90330 1 * * * /bin/sh /etc/daily 2>&1 > /var/log/daily.out 90430 3 * * 6 /bin/sh /etc/weekly 2>&1 > /var/log/weekly.out 90530 5 1 * * /bin/sh /etc/monthly 2>&1 > /var/log/monthly.out 906.Ed 907.Pp 908See 909.Xr crontab 5 . 910.Ss Next day cleanup 911After the first night's security run, change ownerships and permissions 912on files, directories, and devices; root should have received mail 913with subject: "<hostname> daily insecurity output.". 914This mail contains 915a set of security recommendations, presented as a list looking like this: 916.Bd -literal -offset indent 917var/mail: 918 permissions (0755, 0775) 919etc/daily: 920 user (0, 3) 921.Ed 922.Pp 923The best bet is to follow the advice in that list. 924The recommended setting is the first item in parentheses, while 925the current setting is the second one. 926This list is generated by 927.Xr mtree 8 928using 929.Pa /etc/mtree/special . 930Use 931.Xr chmod 1 , 932.Xr chgrp 1 , 933and 934.Xr chown 8 935as needed. 936.Ss Packages 937Install your own packages. 938The 939.Nx 940packages collection, pkgsrc, includes a large set of third-party software. 941A lot of it is available as binary packages that you can download from 942.Lk https://cdn.netbsd.org/pub/pkgsrc/packages/NetBSD/ 943or a mirror. 944.Pp 945For most users, using pkgin to manage binary packages is recommended. 946.Pp 947To install pkgin, if it was not done by the installer: 948.Bd -literal -offset indent 949.Ic export PKG_PATH=https://cdn.netbsd.org/pub/pkgsrc/packages/NetBSD/$(uname -p)/$(uname -r | cut -d_ -f1)/All 950.Ic pkg_add pkgin 951.Ic pkgin update 952.Ic pkgin install bash mpg123 fluxbox ... 953.Ed 954.Pp 955See 956.Lk https://www.NetBSD.org/docs/pkgsrc/ 957and 958.Pa pkgsrc/doc/pkgsrc.txt 959for more details. 960.Pp 961Copy vendor binaries and install them. 962You will need to install any shared libraries, etc. 963(Hint: 964.Ic man -k compat 965to find out how to install and use compatibility mode.) 966.Pp 967There is also other third-party software that is available 968in source form only, either because it has not been ported to 969.Nx 970yet, because licensing restrictions make binary redistribution 971impossible, or simply because you want to build your own binaries. 972Sometimes checking the mailing lists for 973past problems that people have encountered will result in a fix posted. 974.Ss Check the running system 975You can use 976.Xr ps 1 , 977.Xr netstat 1 , 978and 979.Xr fstat 1 980to check on running processes, network connections, and opened files, 981respectively. 982Other tools you may find useful are 983.Xr systat 1 984and 985.Xr top 1 . 986.Sh SYSTEM TESTING 987At this point, the system should be fully configured to your liking. 988It is now a good time to ensure that the system behaves according to 989its specifications and that it is stable on your hardware. 990Please refer to 991.Xr tests 7 992for details on how to do so. 993.Sh SEE ALSO 994.Xr chgrp 1 , 995.Xr chmod 1 , 996.Xr config 1 , 997.Xr crontab 1 , 998.Xr date 1 , 999.Xr df 1 , 1000.Xr domainname 1 , 1001.Xr fstat 1 , 1002.Xr hostname 1 , 1003.Xr make 1 , 1004.Xr man 1 , 1005.Xr netstat 1 , 1006.Xr newaliases 1 , 1007.Xr passwd 1 , 1008.Xr pkg_add 1 , 1009.Xr ps 1 , 1010.Xr ssh 1 , 1011.Xr su 1 , 1012.Xr systat 1 , 1013.Xr top 1 , 1014.Xr xdm 1 , 1015.Xr ccd 4 , 1016.Xr aliases 5 , 1017.Xr crontab 5 , 1018.Xr dhcpcd.conf 5 , 1019.Xr exports 5 , 1020.Xr fstab 5 , 1021.Xr group 5 , 1022.Xr hosts 5 , 1023.Xr ifconfig.if 5 , 1024.Xr mailer.conf 5 , 1025.Xr named.conf 5 , 1026.Xr nsswitch.conf 5 , 1027.Xr passwd 5 , 1028.Xr printcap 5 , 1029.Xr rc.conf 5 , 1030.Xr resolv.conf 5 , 1031.Xr sshd_config 5 , 1032.Xr wpa_supplicant.conf 5 , 1033.Xr wscons.conf 5 , 1034.Xr hier 7 , 1035.Xr hostname 7 , 1036.Xr pkgsrc 7 , 1037.Xr tests 7 , 1038.Xr amd 8 , 1039.Xr ccdconfig 8 , 1040.Xr chown 8 , 1041.Xr devpubd 8 , 1042.Xr dhcpcd 8 , 1043.Xr dhcpd 8 , 1044.Xr dmesg 8 , 1045.Xr groupadd 8 , 1046.Xr ifconfig 8 , 1047.Xr inetd 8 , 1048.Xr kerberos 8 , 1049.Xr lpd 8 , 1050.Xr mdnsd 8 , 1051.Xr mount 8 , 1052.Xr mrouted 8 , 1053.Xr mtree 8 , 1054.Xr named 8 , 1055.Xr nis 8 , 1056.Xr ntpd 8 , 1057.Xr ntpdate 8 , 1058.Xr rbootd 8 , 1059.Xr rc 8 , 1060.Xr rdate 8 , 1061.Xr rmt 8 , 1062.Xr route 8 , 1063.Xr rpc.bootparamd 8 , 1064.Xr rpcbind 8 , 1065.Xr sshd 8 , 1066.Xr timed 8 , 1067.Xr umount 8 , 1068.Xr useradd 8 , 1069.Xr vipw 8 , 1070.Xr wpa_cli 8 , 1071.Xr wpa_supplicant 8 , 1072.Xr yp 8 , 1073.Xr ypbind 8 1074.Sh HISTORY 1075This document first appeared in 1076.Ox 2.2 . 1077It has been adapted to 1078.Nx 1079and first appeared in 1080.Nx 2.0 . 1081