1.\" $NetBSD: afterboot.8,v 1.36 2008/05/02 18:11:05 martin Exp $ 2.\" $OpenBSD: afterboot.8,v 1.72 2002/02/22 02:02:33 miod Exp $ 3.\" 4.\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu 5.\" Adapted to NetBSD by Julio Merino -- 2002-05-10, jmmv@NetBSD.org 6.\" 7.\" 8.\" Copyright (c) 2002-2005 The NetBSD Foundation, Inc. 9.\" All rights reserved. 10.\" 11.\" Redistribution and use in source and binary forms, with or without 12.\" modification, are permitted provided that the following conditions 13.\" are met: 14.\" 1. Redistributions of source code must retain the above copyright 15.\" notice, this list of conditions and the following disclaimer. 16.\" 2. Redistributions in binary form must reproduce the above copyright 17.\" notice, this list of conditions and the following disclaimer in the 18.\" documentation and/or other materials provided with the distribution. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 21.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 24.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30.\" POSSIBILITY OF SUCH DAMAGE. 31.\" 32.\" 33.\" Copyright (c) 1997 Marshall M. Midden 34.\" All rights reserved. 35.\" 36.\" Redistribution and use in source and binary forms, with or without 37.\" modification, are permitted provided that the following conditions 38.\" are met: 39.\" 40.\" 1. Redistributions of source code must retain the above copyright 41.\" notice, this list of conditions and the following disclaimer. 42.\" 2. Redistributions in binary form must reproduce the above copyright 43.\" notice, this list of conditions and the following disclaimer in the 44.\" documentation and/or other materials provided with the distribution. 45.\" 3. All advertising materials mentioning features or use of this software 46.\" must display the following acknowledgement: 47.\" This product includes software developed by Marshall M. Midden. 48.\" 4. The name of the author may not be used to endorse or promote products 49.\" derived from this software without specific prior written permission. 50.\" 51.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 52.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 53.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 54.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 55.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 56.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 57.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 58.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 59.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 60.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 61.\" 62.Dd August 19, 2007 63.Dt AFTERBOOT 8 64.Os 65.Sh NAME 66.Nm afterboot 67.Nd things to check after the first complete boot 68.Sh DESCRIPTION 69.Ss Starting Out 70This document attempts to list items for the system administrator 71to check and set up after the installation and first complete boot of the 72system. 73The idea is to create a list of items that can be checked off so that you have 74a warm fuzzy feeling that something obvious has not been missed. 75A basic knowledge of 76.Ux 77is assumed. 78.Pp 79Complete instructions for correcting and fixing items is not provided. 80There are manual pages and other methodologies available for doing that. 81For example, to view the man page for the 82.Xr ls 1 83command, type: 84.Bd -literal -offset indent 85.Ic man 1 ls 86.Ed 87.Pp 88Administrators will rapidly become more familiar with 89.Nx 90if they get used to using the manual pages. 91.Ss Security alerts 92By the time that you have installed your system, it is quite likely that 93bugs in the release have been found. 94All significant and easily fixed problems will be reported at 95.Pa http://www.NetBSD.org/support/security/ . 96It is recommended that you check this page regularly. 97.Ss Login 98Login as 99.Dq Ic root . 100You can do so on the console, or over the network using 101.Xr ssh 1 . 102If you have enabled the ssh daemon and wish to allow root logins over 103the network, edit the 104.Pa /etc/ssh/sshd_config 105file and set 106.Cm PermitRootLogin 107to 108.Dq yes 109(see 110.Xr sshd_config 5 ) . 111The default is to not permit root logins over the network 112after fresh install in 113.Nx . 114.Pp 115Upon successful login on the console, you may see the message 116.Dq We recommend creating a non-root account... . 117For security reasons, it is bad practice to login as root during 118regular use and maintenance of the system. 119In fact, the system will only let you login as root on a secure 120terminal. 121By default, only the console is considered to be a secure terminal. 122Instead, administrators are encouraged to add a 123.Dq regular 124user, add said user to the 125.Dq wheel 126group, then use the 127.Xr su 1 128command when root privileges are required. 129This process is described in more detail later. 130.Ss Root password 131Change the password for the root user. 132(Note that throughout the documentation, the term 133.Dq superuser 134is a synonym for the root user.) 135Choose a password that has numbers, digits, and special characters (not space) 136as well as from the upper and lower case alphabet. 137Do not choose any word in any language. 138It is common for an intruder to use dictionary attacks. 139Type the command 140.Ic /usr/bin/passwd 141to change it. 142.Pp 143It is a good idea to always specify the full path name for both the 144.Xr passwd 1 145and 146.Xr su 1 147commands as this inhibits the possibility of files placed in your execution 148.Ev PATH 149for most shells. 150Furthermore, the superuser's 151.Ev PATH 152should never contain the current directory 153.Po Dq \&. 154.Pc . 155.Ss System date 156Check the system date with the 157.Xr date 1 158command. 159If needed, change the date, and/or change the symbolic link of 160.Pa /etc/localtime 161to the correct time zone in the 162.Pa /usr/share/zoneinfo 163directory. 164.Pp 165Examples: 166.Bl -tag -width date 167.It Cm date 200205101820 168Set the current date to May 10th, 2002 6:20pm. 169.It Cm ln -fs /usr/share/zoneinfo/Europe/Helsinki /etc/localtime 170Set the time zone to Eastern Europe Summer Time. 171.El 172.Ss Console settings 173One of the first things you will likely need to do is to set up your 174keyboard map (and maybe some other aspects about the system console). 175To change your keyboard encoding, edit the 176.Dq Va encoding 177variable found in 178.Pa /etc/wscons.conf . 179.Pp 180.Xr wscons.conf 5 181contains more information about this file. 182.Ss Check hostname 183Use the 184.Ic hostname 185command to verify that the name of your machine is correct. 186See the man page for 187.Xr hostname 1 188if it needs to be changed. 189You will also need to change the contents of the 190.Dq Va hostname 191variable in 192.Pa /etc/rc.conf 193or edit the 194.Pa /etc/myname 195file to have it stick around for the next reboot. 196Note that hostname is supposed include a domainname, and that this should 197not be confused with YP (NIS) 198.Xr domainname 1 . 199.Ss Verify network interface configuration 200The first thing to do is an 201.Ic ifconfig -a 202to see if the network interfaces are properly configured. 203Correct by editing 204.Pa /etc/ifconfig. Ns Ar interface 205or the corresponding 206.Dq Va ifconfig_ Ns Ar interface 207variable in 208.Xr rc.conf 5 209(where 210.Ar interface 211is the interface name, e.g., 212.Dq le0 ) 213and then using 214.Xr ifconfig 8 215to manually configure it 216if you do not wish to reboot. 217.Pp 218You can add new 219.Dq virtual interfaces 220by adding the required entries to 221.Pa /etc/ifconfig. Ns Ar interface . 222Read the 223.Xr ifconfig.if 5 224man page for more information on the format of 225.Pa /etc/ifconfig. Ns Ar interface 226files. 227The loopback interface will look something like: 228.Bd -literal -offset indent 229lo0: flags=8009\*[Lt]UP,LOOPBACK,MULTICAST\*[Gt] mtu 32972 230 inet 127.0.0.1 netmask 0xff000000 231 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 232 inet6 ::1 prefixlen 128 233.Ed 234.Pp 235an Ethernet interface something like: 236.Bd -literal -offset indent 237le0: flags=9863\*[Lt]UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST\*[Gt] 238 inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255 239 inet6 fe80::5ef0:f0f0%le0 prefixlen 64 scopeid 0x1 240.Ed 241.Pp 242and a PPP interface something like: 243.Bd -literal -offset indent 244ppp0: flags=8051\*[Lt]UP,POINTOPOINT,RUNNING,MULTICAST\*[Gt] 245 inet 203.3.131.108 --\*[Gt] 198.181.0.253 netmask 0xffff0000 246.Ed 247.Pp 248See 249.Xr mrouted 8 250for instructions on configuring multicast routing. 251.Pp 252See 253.Xr dhcpd 8 254for instructions on configuring interfaces with DHCP. 255.Ss Check routing tables 256Issue a 257.Ic netstat -rn 258command. 259The output will look something like: 260.Bd -literal -offset indent 261Routing tables 262 263Internet: 264Destination Gateway Flags Refs Use Mtu Interface 265default 192.168.4.254 UGS 0 11098028 - le0 266127 127.0.0.1 UGRS 0 0 - lo0 267127.0.0.1 127.0.0.1 UH 3 24 - lo0 268192.168.4 link#1 UC 0 0 - le0 269192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - le0 270192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - le0 271 272Internet6: 273Destination Gateway Flags Refs Use Mtu Interface 274::/96 ::1 UGRS 0 0 32972 lo0 =\*[Gt] 275::1 ::1 UH 4 0 32972 lo0 276::ffff:0.0.0.0/96 ::1 UGRS 0 0 32972 lo0 277fc80::/10 ::1 UGRS 0 0 32972 lo0 278fe80::/10 ::1 UGRS 0 0 32972 lo0 279fe80::%le0/64 link#1 UC 0 0 1500 le0 280fe80::%lo0/64 fe80::1%lo0 U 0 0 32972 lo0 281ff01::/32 ::1 U 0 0 32972 lo0 282ff02::%le0/32 link#1 UC 0 0 1500 le0 283ff02::%lo0/32 fe80::1%lo0 UC 0 0 32972 lo0 284.Ed 285.Pp 286The default gateway address is stored in the 287.Dq Va defaultroute 288variable in 289.Pa /etc/rc.conf , 290or in the file 291.Pa /etc/mygate . 292If you need to edit this file, a painless way to reconfigure the network 293afterwards is to issue 294.Bd -literal -offset indent 295.Ic /etc/rc.d/network restart 296.Ed 297.Pp 298Or, you may prefer to manually configure using a series of 299.Ic route add 300and 301.Ic route delete 302commands (see 303.Xr route 8 ) . 304If you run 305.Xr dhclient 8 306you will have to kill it by running 307.Bd -literal -offset indent 308.Ic /etc/rc.d/dhclient stop 309.Pp 310.Ed 311after you flush the routes. 312.Pp 313If you wish to route packets between interfaces, add one or both 314of the following directives (depending on whether IPv4 or IPv6 routing 315is required) to 316.Pa /etc/sysctl.conf : 317.Pp 318.Dl net.inet.ip.forwarding=1 319.Dl net.inet6.ip6.forwarding=1 320.Pp 321As an alternative, compile a new kernel with the 322.Cm GATEWAY 323option. 324Packets are not forwarded by default, due to RFC requirements. 325.Ss Secure Shell (ssh) 326By default, all services are disabled in a fresh 327.Nx 328installation, and ssh is no exception. 329You may wish to enable it so you can remotely control your system. 330Set 331.Dq Va sshd=yes 332in 333.Pa /etc/rc.conf 334and then starting the server with the command 335.Bd -literal -offset indent 336.Ic /etc/rc.d/sshd start 337.Ed 338.Pp 339The first time the server is started, it will generate a new keypair, 340which will be stored inside the directory 341.Pa /etc/ssh . 342.Ss BIND Name Server (DNS) 343If you are using the BIND Name Server, check the 344.Pa /etc/resolv.conf 345file. 346It may look something like: 347.Bd -literal -offset indent 348domain some.thing.dom 349nameserver 192.168.0.1 350nameserver 192.168.4.55 351search some.thing.dom. thing.dom. 352.Ed 353.Pp 354For further details, see 355.Xr resolv.conf 5 . 356Note the name service lookup order is set via 357.Xr nsswitch.conf 5 358mechanism. 359.Pp 360If using a caching name server add the line "nameserver 127.0.0.1" first. 361To get a local caching name server to run 362you will need to set "named=yes" in 363.Pa /etc/rc.conf 364and create the 365.Pa named.conf 366file in the appropriate place for 367.Xr named 8 , 368usually in 369.Pa /etc/namedb . 370The same holds true if the machine is going to be a 371name server for your domain. 372In both these cases, make sure that 373.Xr named 8 374is running 375(otherwise there are long waits for resolver timeouts). 376.Ss RPC-based network services 377Several services depend on the RPC portmapper 378.Xr rpcbind 8 379- formerly known as 380.Ic portmap 381- being running for proper operation. 382This includes YP (NIS) and NFS exports, among other services. 383To get the RPC portmapper to start automatically on boot, 384you will need to have this line in 385.Pa /etc/rc.conf : 386.Pp 387.Dl rpcbind=YES 388.Ss YP (NIS) Setup 389Check the YP domain name with the 390.Xr domainname 1 391command. 392If necessary, correct it by editing the 393.Pa /etc/defaultdomain 394file or by setting the 395.Dq Va domainname 396variable in 397.Pa /etc/rc.conf . 398The 399.Pa /etc/rc.d/network 400script reads this file on bootup to determine and set the domain name. 401You may also set the running system's domain name with the 402.Xr domainname 1 403command. 404To start YP client services, simply run 405.Ic ypbind , 406then perform the remaining 407YP activation as described in 408.Xr passwd 5 409and 410.Xr group 5 . 411.Pp 412In particular, to enable YP passwd support, you'll need to update 413.Pa /etc/nsswitch.conf 414to include 415.Dq nis 416for the 417.Dq passwd 418and 419.Dq group 420entries. 421A traditional way to accomplish the same thing is to 422add following entry to local passwd database via 423.Xr vipw 8 : 424.Bd -literal -offset indent 425.Li +:*:::::::: 426.Pp 427.Ed 428Note this entry has to be the very last one. 429This traditional way works with the default 430.Xr nsswitch.conf 5 431setting of 432.Dq passwd , 433which is 434.Dq compat . 435.Pp 436There are many more YP man pages available to help you. 437You can find more information by starting with 438.Xr yp 8 . 439.Ss Check disk mounts 440Check that the disks are mounted correctly by 441comparing the 442.Pa /etc/fstab 443file against the output of the 444.Xr mount 8 445and 446.Xr df 1 447commands. 448Example: 449.Bd -literal -offset indent 450.Li # Ic cat /etc/fstab 451/dev/sd0a / ffs rw 1 1 452/dev/sd0b none swap sw 453/dev/sd0e /usr ffs rw 1 2 454/dev/sd0f /var ffs rw 1 3 455/dev/sd0g /tmp ffs rw 1 4 456/dev/sd0h /home ffs rw 1 5 457 458.Li # Ic mount 459/dev/sd0a on / type ffs (local) 460/dev/sd0e on /usr type ffs (local) 461/dev/sd0f on /var type ffs (local) 462/dev/sd0g on /tmp type ffs (local) 463/dev/sd0h on /home type ffs (local) 464 465.Li # Ic df 466Filesystem 1024-blocks Used Avail Capacity Mounted on 467/dev/sd0a 22311 14589 6606 69% / 468/dev/sd0e 203399 150221 43008 78% /usr 469/dev/sd0f 10447 682 9242 7% /var 470/dev/sd0g 18823 2 17879 0% /tmp 471/dev/sd0h 7519 5255 1888 74% /home 472 473.Li # Ic pstat -s 474Device 512-blocks Used Avail Capacity Priority 475/dev/sd0b 131072 84656 46416 65% 0 476.Ed 477.Pp 478Edit 479.Pa /etc/fstab 480and use the 481.Xr mount 8 482and 483.Xr umount 8 484commands as appropriate. 485Refer to the above example and 486.Xr fstab 5 487for information on the format of this file. 488.Pp 489You may wish to do NFS mounts now too, or you can do them later. 490.Ss Concatenated disks (ccd) 491If you are using 492.Xr ccd 4 493concatenated disks, edit 494.Pa /etc/ccd.conf . 495You may wish to take a look to 496.Xr ccdconfig 8 497for more information about this file. 498Use the 499.Ic ccdconfig -U 500command to unload and the 501.Ic ccdconfig -C 502command to create tables internal to the kernel for the concatenated disks. 503You then 504.Xr mount 8 , 505.Xr umount 8 , 506and edit 507.Pa /etc/fstab 508as needed. 509.Ss Automounter daemon (AMD) 510To use the 511.Xr amd 8 512automounter, create the 513.Pa /etc/amd 514directory, copy example config files from 515.Pa /usr/share/examples/amd 516to 517.Pa /etc/amd 518and customize them as needed. 519Alternatively, you can get your maps with YP. 520.Ss Clock synchronization 521In order to make sure the system clock is synchronized 522to that of a publicly accessible NTP server, 523make sure that 524.Pa /etc/rc.conf 525contains the following: 526.Pp 527.Dl ntpdate=yes 528.Dl ntpd=yes 529.Pp 530See 531.Xr date 1 , 532.Xr ntpdate 8 , 533.Xr ntpd 8 , 534.Xr rdate 8 , 535and 536.Xr timed 8 537for more information on setting the system's date. 538.Sh CHANGING /etc FILES 539The system should be usable now, but you may wish to do more customizing, 540such as adding users, etc. 541Many of the following sections may be skipped 542if you are not using that package (for example, skip the 543.Sx Kerberos 544section if you won't be using Kerberos). 545We suggest that you 546.Ic cd /etc 547and edit most of the files in that directory. 548.Pp 549Note that the 550.Pa /etc/motd 551file is modified by 552.Pa /etc/rc.d/motd 553whenever the system is booted. 554To keep any custom message intact, ensure that you leave two blank lines 555at the top, or your message will be overwritten. 556.Ss Add new users 557To add new users and groups, there are 558.Xr useradd 8 559and 560.Xr groupadd 8 , 561see also 562.Xr user 8 563for further programs for user and group manipulation. 564You may use 565.Xr vipw 8 566to add users to the 567.Pa /etc/passwd 568file 569and edit 570.Pa /etc/group 571by hand to add new groups. 572The manual page for 573.Xr su 1 , 574tells you to make sure to put people in 575the 576.Sq wheel 577group if they need root access (non-Kerberos). 578For example: 579.Bd -literal -offset indent 580wheel:*:0:root,myself 581.Ed 582.Pp 583Follow instructions for 584.Xr kerberos 8 585if using 586Kerberos 587for authentication. 588.Ss System boot scripts and /etc/rc.local 589.Pa /etc/rc 590and the 591.Pa /etc/rc.d/* 592scripts are invoked at boot time after single user mode has exited, 593and at shutdown. 594The whole process is controlled by the master script 595.Pa /etc/rc . 596This script should not be changed by administrators. 597.Pp 598The directory 599.Pa /etc/rc.d 600contains a serie of scripts used at startup/shutdown, called by 601.Pa /etc/rc . 602.Pa /etc/rc 603is in turn influenced by the configuration variables present in 604.Pa /etc/rc.conf . 605.Pp 606The script 607.Pa /etc/rc.local 608is run as the last thing during multiuser boot, and is provided 609to allow any other local hooks necessary for the system. 610.Ss rc.conf 611To enable or disable various services on system startup, 612corresponding entries can be made in 613.Pa /etc/rc.conf . 614You can take a look at 615.Pa /etc/defaults/rc.conf 616to see a list of default system variables, which you can override in 617.Pa /etc/rc.conf . 618Note you are 619.Em not 620supposed to change 621.Pa /etc/defaults/rc.conf 622directly, edit only 623.Pa /etc/rc.conf . 624See 625.Xr rc.conf 5 626for further information. 627.Pp 628If you've installed X, you may want to turn on 629.Xr xdm 1 , 630the X Display Manager. 631To do this, set the variable 632.Dq xdm 633to yes in 634.Pa /etc/rc.conf , 635i.e.: 636.Dq xdm=yes 637.Ss Printers 638Edit 639.Pa /etc/printcap 640and 641.Pa /etc/hosts.lpd 642to get any printers set up. 643Consult 644.Xr lpd 8 645and 646.Xr printcap 5 647if needed. 648.Ss Tighten up security 649In 650.Pa /etc/inetd.conf 651comment out any extra entries you do not need, and only add things 652that are really needed. 653Note that by default all services are disabled for security reasons. 654.Ss Kerberos 655If you are going to use Kerberos for authentication, 656see 657.Xr kerberos 8 658and 659.Dq info heimdal 660for more information. 661If you already have a Kerberos master, change directory to 662.Pa /etc/kerberosV 663and configure. 664Remember to get a 665.Pa srvtab 666from the master so that the remote commands work. 667.Ss Mail Aliases 668Check 669.Pa /etc/mail/aliases 670and update appropriately if you want e-mail to be routed 671to non-local address or to different users. 672.Pp 673Run 674.Xr newaliases 1 675after changes. 676.Ss Postfix 677.Nx 678comes also with Postfix in the base system. 679You may wish to set it up in favor of sendmail. 680Take a look to 681.Pa /etc/postfix/main.cf 682and enable the daemon in 683.Pa /etc/rc.conf 684using "postfix=yes". 685It is very important to configure 686.Pa /etc/mailer.conf 687to point to Postfix binaries. 688.Ss DHCP server 689If this is a 690DHCP 691server, edit 692.Pa /etc/dhcpd.conf 693and 694.Pa /etc/dhcpd.interfaces 695as needed. 696You will have to make sure 697.Pa /etc/rc.conf 698has "dhcpd=yes" 699or run 700.Xr dhcpd 8 701manually. 702.Ss Bootparam server 703If this is a 704Bootparam 705server, edit 706.Pa /etc/bootparams 707as needed. 708You will have to turn it on in 709.Pa /etc/rc.conf 710by adding "bootparamd=yes". 711.Ss NFS server 712If this is an NFS server, make sure 713.Pa /etc/rc.conf 714has: 715.Bd -literal -offset indent 716nfs_server=yes 717mountd=yes 718rpcbind=yes 719.Ed 720.Pp 721Edit 722.Pa /etc/exports 723and get it correct. 724After this, you can start the server by issuing: 725.Bd -literal -offset indent 726.Ic /etc/rc.d/rpcbind start 727.Ic /etc/rc.d/mountd start 728.Ic /etc/rc.d/nfsd start 729.Ed 730which will also start dependencies. 731.Ss HP remote boot server 732Edit 733.Pa /etc/rbootd.conf 734if needed for remote booting. 735If you do not have HP computers doing remote booting, do not enable this. 736.Ss Daily, weekly, monthly scripts 737Look at and possibly edit the 738.Pa /etc/daily.conf , /etc/weekly.conf , 739and 740.Pa /etc/monthly.conf 741configuration files. 742You can check which values you can set by looking 743to their matching files in 744.Pa /etc/defaults . 745Your site specific things should go into 746.Pa /etc/daily.local , /etc/weekly.local , 747and 748.Pa /etc/monthly.local . 749.Pp 750These scripts have been limited so as to keep the system running without 751filling up disk space from normal running processes and database updates. 752(You probably do not need to understand them.) 753.Ss Other files in /etc 754Look at the other files in 755.Pa /etc 756and edit them as needed. 757(Do not edit files ending in 758.Pa .db 759\(em like 760.Pa pwd.db , spwd.db , 761nor 762.Pa localtime , 763nor 764.Pa rmt , 765nor any directories.) 766.Ss Crontab (background running processes) 767Check what is running by typing 768.Ic crontab -l 769as root 770and see if anything unexpected is present. 771Do you need anything else? 772Do you wish to change things? 773For example, if you do not 774like root getting standard output of the daily scripts, and want only 775the security scripts that are mailed internally, you can type 776.Ic crontab -e 777and change some of the lines to read: 778.Bd -literal -offset indent 77930 1 * * * /bin/sh /etc/daily 2\*[Gt]\*[Am]1 \*[Gt] /var/log/daily.out 78030 3 * * 6 /bin/sh /etc/weekly 2\*[Gt]\*[Am]1 \*[Gt] /var/log/weekly.out 78130 5 1 * * /bin/sh /etc/monthly 2\*[Gt]\*[Am]1 \*[Gt] /var/log/monthly.out 782.Ed 783.Pp 784See 785.Xr crontab 5 . 786.Ss Next day cleanup 787After the first night's security run, change ownerships and permissions 788on files, directories, and devices; root should have received mail 789with subject: "\*[Lt]hostname\*[Gt] daily insecurity output.". 790This mail contains 791a set of security recommendations, presented as a list looking like this: 792.Bd -literal -offset indent 793var/mail: 794 permissions (0755, 0775) 795etc/daily: 796 user (0, 3) 797.Ed 798.Pp 799The best bet is to follow the advice in that list. 800The recommended setting is the first item in parentheses, while 801the current setting is the second one. 802This list is generated by 803.Xr mtree 8 804using 805.Pa /etc/mtree/special . 806Use 807.Xr chmod 1 , 808.Xr chgrp 1 , 809and 810.Xr chown 8 811as needed. 812.Ss Packages 813Install your own packages. 814The 815.Nx 816packages collection, pkgsrc, includes a large set of third-party software. 817A lot of it is available as binary packages that you can download from 818.Pa ftp://ftp.NetBSD.org/pub/NetBSD/packages/ 819or a mirror, and install using 820.Xr pkg_add 1 . 821See 822.Pa http://www.NetBSD.org/docs/pkgsrc/ 823and 824.Pa pkgsrc/doc/pkgsrc.txt 825for more details. 826.Pp 827Copy vendor binaries and install them. 828You will need to install any shared libraries, etc. 829(Hint: 830.Ic man -k compat 831to find out how to install and use compatibility mode.) 832.Pp 833There is also other third-party software that is available 834in source form only, either because it has not been ported to 835.Nx 836yet, because licensing restrictions make binary redistribution 837impossible, or simply because you want to build your own binaries. 838Sometimes checking the mailing lists for 839past problems that people have encountered will result in a fix posted. 840.Ss Check the running system 841You can use 842.Xr ps 1 , 843.Xr netstat 1 , 844and 845.Xr fstat 1 846to check on running processes, network connections, and opened files, 847respectively. 848Other tools you may find useful are 849.Xr systat 1 850and 851.Xr top 1 . 852.Sh COMPILING A KERNEL 853Note: 854The standard 855.Nx 856kernel configuration (GENERIC) is suitable for most purposes. 857.Pp 858First, review the system message buffer in 859.Pa /var/run/dmesg.boot 860and by using the 861.Xr dmesg 8 862command to find out information on your system's devices as probed by the 863kernel at boot. 864In particular, note which devices were not configured. 865This information will prove useful when editing kernel configuration files. 866.Pp 867To compile a kernel inside a writable source tree, do the following: 868.Bd -literal -offset indent 869$ cd /usr/src/sys/arch/SOMEARCH/conf 870$ cp GENERIC SOMEFILE (only the first time) 871$ vi SOMEFILE (adapt to your needs) 872$ config SOMEFILE 873$ cd ../compile/SOMEFILE 874$ make depend 875$ make 876.Ed 877.Pp 878where 879.Ar SOMEARCH 880is the architecture (e.g., i386), and 881.Ar SOMEFILE 882should be a name indicative of a particular configuration (often 883that of the hostname). 884.Pp 885If you are building your kernel again, before you do a 886.Ic make 887you should do a 888.Ic make clean 889after making changes to your kernel options. 890.Pp 891After either of these two methods, you can place the new kernel (called 892.Pa netbsd ) 893in 894.Pa / 895(i.e., 896.Pa /netbsd ) 897by issuing 898.Ic make install 899and the system will boot it next time. 900The old kernel is stored as 901.Pa /onetbsd 902so you can boot it in case of failure. 903.Pp 904If you are using toolchain to build your kernel, you will also need to 905build a new set of toolchain binaries. 906You can do it by changing into 907.Pa /usr/src 908and issuing: 909.Bd -literal -offset indent 910$ cd /usr/src 911$ K=sys/arch/`uname -m`/conf 912$ cp $K/GENERIC $K/SOMEFILE 913$ vi $K/SOMEFILE (adapt to your needs) 914$ ./build.sh tools 915$ ./build.sh kernel=SOMEFILE 916.Ed 917.Sh SYSTEM TESTING 918At this point, the system should be fully configured to your liking. 919It is now a good time to ensure that the system behaves according to 920its specifications and that it is stable on your hardware. 921You can easily do so by running the test suites available at 922.Pa /usr/tests/ , 923assuming that you installed the 924.Pa tests.tgz 925set. 926If not, you can install it now by running: 927.Bd -literal -offset indent 928# cd / 929# tar xzpf /path/to/tests.tgz 930.Ed 931.Pp 932Once done, edit the 933.Pa /etc/atf/NetBSD.conf 934file to tune the configuration of the test suite, go to 935.Pa /usr/tests/ 936hierarchy and use the 937.Xr atf-run 1 938and 939.Xr atf-report 1 940utilities to run all the tests in an automated way: 941.Bd -literal -offset indent 942# cd /usr/tests/ 943# atf-run | atf-report 944.Ed 945.Pp 946Should any problems appear when running the test suite, please let the 947.Nx 948developers know by sending a message to the appropriate mailing list or 949by sending a problem report. For more details see: 950.Bl -bullet -offset indent 951.It 952.Pa http://www.netbsd.org/mailinglists/ 953.It 954.Pa http://www.netbsd.org/support/send-pr.html 955.El 956.Sh SEE ALSO 957.Xr atf-report 1 , 958.Xr atf-run 1 , 959.Xr chgrp 1 , 960.Xr chmod 1 , 961.Xr config 1 , 962.Xr crontab 1 , 963.Xr date 1 , 964.Xr df 1 , 965.Xr domainname 1 , 966.Xr hostname 1 , 967.Xr make 1 , 968.Xr man 1 , 969.Xr netstat 1 , 970.Xr newaliases 1 , 971.Xr passwd 1 , 972.Xr su 1 , 973.Xr ccd 4 , 974.Xr aliases 5 , 975.Xr crontab 5 , 976.Xr exports 5 , 977.Xr fstab 5 , 978.Xr group 5 , 979.Xr krb.conf 5 , 980.Xr krb.realms 5 , 981.Xr mailer.conf 5 , 982.Xr passwd 5 , 983.Xr rc.conf 5 , 984.Xr resolv.conf 5 , 985.Xr hier 7 , 986.Xr hostname 7 , 987.Xr pkgsrc 7 , 988.Xr adduser 8 , 989.Xr amd 8 , 990.Xr bootparamd 8 , 991.Xr ccdconfig 8 , 992.Xr chown 8 , 993.Xr dhcpd 8 , 994.Xr ifconfig 8 , 995.Xr inetd 8 , 996.Xr kerberos 8 , 997.Xr mount 8 , 998.Xr mrouted 8 , 999.Xr mtree 8 , 1000.Xr named 8 , 1001.Xr rbootd 8 , 1002.Xr rc 8 , 1003.Xr rmt 8 , 1004.Xr route 8 , 1005.Xr umount 8 , 1006.Xr vipw 8 , 1007.Xr ypbind 8 1008.Sh HISTORY 1009This document first appeared in 1010.Ox 2.2 . 1011It has been adapted to 1012.Nx 1013and first appeared in 1014.Nx 2.0 . 1015