1.\" $NetBSD: afterboot.8,v 1.69 2020/08/15 14:45:31 nia Exp $ 2.\" $OpenBSD: afterboot.8,v 1.72 2002/02/22 02:02:33 miod Exp $ 3.\" 4.\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu 5.\" Adapted to NetBSD by Julio Merino -- 2002-05-10, jmmv@NetBSD.org 6.\" 7.\" 8.\" Copyright (c) 2002-2008 The NetBSD Foundation, Inc. 9.\" All rights reserved. 10.\" 11.\" Redistribution and use in source and binary forms, with or without 12.\" modification, are permitted provided that the following conditions 13.\" are met: 14.\" 1. Redistributions of source code must retain the above copyright 15.\" notice, this list of conditions and the following disclaimer. 16.\" 2. Redistributions in binary form must reproduce the above copyright 17.\" notice, this list of conditions and the following disclaimer in the 18.\" documentation and/or other materials provided with the distribution. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 21.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 24.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30.\" POSSIBILITY OF SUCH DAMAGE. 31.\" 32.\" 33.\" Copyright (c) 1997 Marshall M. Midden 34.\" All rights reserved. 35.\" 36.\" Redistribution and use in source and binary forms, with or without 37.\" modification, are permitted provided that the following conditions 38.\" are met: 39.\" 40.\" 1. Redistributions of source code must retain the above copyright 41.\" notice, this list of conditions and the following disclaimer. 42.\" 2. Redistributions in binary form must reproduce the above copyright 43.\" notice, this list of conditions and the following disclaimer in the 44.\" documentation and/or other materials provided with the distribution. 45.\" 3. All advertising materials mentioning features or use of this software 46.\" must display the following acknowledgement: 47.\" This product includes software developed by Marshall M. Midden. 48.\" 4. The name of the author may not be used to endorse or promote products 49.\" derived from this software without specific prior written permission. 50.\" 51.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 52.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 53.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 54.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 55.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 56.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 57.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 58.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 59.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 60.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 61.\" 62.Dd August 15, 2020 63.Dt AFTERBOOT 8 64.Os 65.Sh NAME 66.Nm afterboot 67.Nd things to check after the first complete boot 68.Sh DESCRIPTION 69.Ss Starting Out 70This document attempts to list items for the system administrator 71to check and set up after the installation and first complete boot of the 72system. 73The idea is to create a list of items that can be checked off so that you have 74a warm fuzzy feeling that something obvious has not been missed. 75A basic knowledge of 76.Ux 77is assumed. 78.Pp 79Complete instructions for correcting and fixing items is not provided. 80There are manual pages and other methodologies available for doing that. 81For example, to view the man page for the 82.Xr ls 1 83command, type: 84.Bd -literal -offset indent 85.Ic man 1 ls 86.Ed 87.Pp 88Administrators will rapidly become more familiar with 89.Nx 90if they get used to using the manual pages. 91.Ss Security alerts 92By the time that you have installed your system, it is quite likely that 93bugs in the release have been found. 94All significant and easily fixed problems will be reported at 95.Lk http://www.NetBSD.org/support/security/ . 96It is recommended that you check this page regularly. 97.Pp 98Additionally, you should set 99.Dq fetch_pkg_vulnerabilities=YES 100in 101.Pa /etc/daily.conf 102to allow your system to automatically update the local database of known 103vulnerable packages to the latest version available on-line. 104The system will later check, on a daily basis, if any of your installed 105packages are vulnerable based on the contents of this database. 106See 107.Xr daily.conf 5 108and 109.Xr security.conf 5 110for more details. 111.Ss Login 112On a fresh install with no other user accounts, login as 113.Dq Ic root . 114You can do so on the console, or over the network using 115.Xr ssh 1 . 116If you have enabled the SSH daemon (see 117.Xr sshd 8 ) 118and wish to allow root logins over the network, edit the 119.Pa /etc/ssh/sshd_config 120file and set 121.Dq PermitRootLogin 122to 123.Dq yes 124(see 125.Xr sshd_config 5 ) . 126The default is to not permit root logins over the network 127after fresh install in 128.Nx . 129.Pp 130Upon successful login on the console, you may see the message 131.Dq We recommend creating a non-root account... . 132For security reasons, it is bad practice to login as root during 133regular use and maintenance of the system. 134In fact, the system will only let you login as root on a secure 135terminal. 136By default, only the console is considered to be a secure terminal. 137Instead, administrators are encouraged to add a 138.Dq regular 139user, add said user to the 140.Dq wheel 141group, then use the 142.Xr su 1 143command when root privileges are required. 144This process is described in more detail later. 145.Ss Root password 146Change the password for the root user. 147(Note that throughout the documentation, the term 148.Dq superuser 149is a synonym for the root user.) 150Choose a password that has numbers, digits, and special characters (not space) 151as well as from the upper and lower case alphabet. 152Do not choose any word in any language. 153It is common for an intruder to use dictionary attacks. 154Type the command 155.Ic /usr/bin/passwd 156to change it. 157.Pp 158It is a good idea to always specify the full path name for both the 159.Xr passwd 1 160and 161.Xr su 1 162commands as this inhibits the possibility of files placed in your execution 163.Ev PATH 164for most shells. 165Furthermore, the superuser's 166.Ev PATH 167should never contain the current directory 168.Po Dq \&. 169.Pc . 170.Ss System date 171Check the system date with the 172.Xr date 1 173command. 174If needed, change the date, and/or change the symbolic link of 175.Pa /etc/localtime 176to the correct time zone in the 177.Pa /usr/share/zoneinfo 178directory. 179.Pp 180Examples: 181.Bl -tag -width date 182.It Cm date 200205101820 183Set the current date to May 10th, 2002 6:20pm. 184.It Cm ln -fs /usr/share/zoneinfo/Europe/Helsinki /etc/localtime 185Set the time zone to Eastern Europe Summer Time. 186.El 187.Ss Console settings 188One of the first things you will likely need to do is to set up your 189keyboard map (and maybe some other aspects about the system console). 190To change your keyboard encoding, edit the 191.Dq Va encoding 192variable found in 193.Pa /etc/wscons.conf . 194.Pp 195.Xr wscons.conf 5 196contains more information about this file. 197.Ss Check hostname 198Use the 199.Ic hostname 200command to verify that the name of your machine is correct. 201See the man page for 202.Xr hostname 1 203if it needs to be changed. 204You will also need to change the contents of the 205.Dq Va hostname 206variable in 207.Pa /etc/rc.conf 208or edit the 209.Pa /etc/myname 210file to have it stick around for the next reboot. 211Note that 212.Dq Va hostname 213is supposed include a domainname, and that this should 214not be confused with YP (NIS) 215.Xr domainname 1 . 216If you are using 217.Xr dhcpcd 8 218to configure network interfaces, it might override these local hostname 219settings if your DHCP server specifies client's hostname with other network 220configurations. 221.Ss Verify network interface configuration 222The first thing to do is an 223.Ic ifconfig -a 224to see if the network interfaces are properly configured. 225Correct by editing 226.Pa /etc/ifconfig. Ns Ar interface 227or the corresponding 228.Dq Va ifconfig_ Ns Ar interface 229variable in 230.Xr rc.conf 5 231(where 232.Ar interface 233is the interface name, e.g., 234.Dq le0 ) 235and then using 236.Xr ifconfig 8 237to manually configure it 238if you do not wish to reboot. 239.Pp 240Alternatively, you can configure interfaces automatically via DHCP with 241.Xr dhcpcd 8 242if you have a DHCP server running somewhere on your network. 243To get 244.Xr dhcpcd 8 245to start automatically on boot, 246you will need to have this line in 247.Pa /etc/rc.conf : 248.Pp 249.Dl dhcpcd=YES 250.Pp 251See 252.Xr dhcpcd 8 253and 254.Xr dhcpcd.conf 5 255for more information on setting up a DHCP client. 256.Pp 257You can add new 258.Dq virtual interfaces 259by adding the required entries to 260.Pa /etc/ifconfig. Ns Ar interface . 261Read the 262.Xr ifconfig.if 5 263man page for more information on the format of 264.Pa /etc/ifconfig. Ns Ar interface 265files. 266The loopback interface will look something like: 267.Bd -literal -offset indent 268lo0: flags=8009<UP,LOOPBACK,MULTICAST> mtu 32972 269 inet 127.0.0.1 netmask 0xff000000 270 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 271 inet6 ::1 prefixlen 128 272.Ed 273.Pp 274an Ethernet interface something like: 275.Bd -literal -offset indent 276le0: flags=9863<UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST> 277 inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255 278 inet6 fe80::5ef0:f0f0%le0 prefixlen 64 scopeid 0x1 279.Ed 280.Pp 281and a PPP interface something like: 282.Bd -literal -offset indent 283ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> 284 inet 203.3.131.108 --> 198.181.0.253 netmask 0xffff0000 285.Ed 286.Pp 287See 288.Xr mrouted 8 289for instructions on configuring multicast routing. 290.Ss Check routing tables 291Issue a 292.Ic netstat -rn 293command. 294The output will look something like: 295.Bd -literal -offset indent 296Routing tables 297 298Internet: 299Destination Gateway Flags Refs Use Mtu Interface 300default 192.168.4.254 UGS 0 11098028 - le0 301127 127.0.0.1 UGRS 0 0 - lo0 302127.0.0.1 127.0.0.1 UH 3 24 - lo0 303192.168.4 link#1 UC 0 0 - le0 304192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - le0 305192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - le0 306 307Internet6: 308Destination Gateway Flags Refs Use Mtu Interface 309::/96 ::1 UGRS 0 0 32972 lo0 => 310::1 ::1 UH 4 0 32972 lo0 311::ffff:0.0.0.0/96 ::1 UGRS 0 0 32972 lo0 312fc80::/10 ::1 UGRS 0 0 32972 lo0 313fe80::/10 ::1 UGRS 0 0 32972 lo0 314fe80::%le0/64 link#1 UC 0 0 1500 le0 315fe80::%lo0/64 fe80::1%lo0 U 0 0 32972 lo0 316ff01::/32 ::1 U 0 0 32972 lo0 317ff02::%le0/32 link#1 UC 0 0 1500 le0 318ff02::%lo0/32 fe80::1%lo0 UC 0 0 32972 lo0 319.Ed 320.Pp 321The default gateway address is stored in the 322.Dq Va defaultroute 323variable in 324.Pa /etc/rc.conf , 325or in the file 326.Pa /etc/mygate . 327If you need to edit this file, a painless way to reconfigure the network 328afterwards is to issue 329.Bd -literal -offset indent 330.Ic service network restart 331.Ed 332.Pp 333Or, you may prefer to manually configure using a series of 334.Ic route add 335and 336.Ic route delete 337commands (see 338.Xr route 8 ) . 339If you run 340.Xr dhcpcd 8 341you will have to kill it by running 342.Bd -literal -offset indent 343.Ic service dhcpcd stop 344.Ed 345.Pp 346before you flush the routes. 347.Pp 348If you wish to route packets between interfaces, add one or both 349of the following directives (depending on whether IPv4 or IPv6 routing 350is required) to 351.Pa /etc/sysctl.conf : 352.Pp 353.Dl net.inet.ip.forwarding=1 354.Dl net.inet6.ip6.forwarding=1 355.Pp 356As an alternative, compile a new kernel with the 357.Dq GATEWAY 358option. 359Packets are not forwarded by default, due to RFC requirements. 360.Ss Device nodes 361By default, nodes are created in 362.Pa /dev 363for a fairly typical number of devices. 364.Pp 365However, if this system has a large number of devices connected 366(e.g. for large scale storage), you may want to enable 367.Xr devpubd 8 368to ensure a sufficient number of nodes are available. 369Set 370.Dq Va devpubd=YES 371in 372.Pa /etc/rc.conf 373to create nodes automatically during system runtime. 374You can also run the node creation script by hand: 375.Bd -literal -offset indent 376.Ic cd /dev && sh MAKEDEV 377.Ed 378.Ss Secure Shell (SSH) 379By default, all services are disabled in a fresh 380.Nx 381installation, and SSH is no exception. 382You may wish to enable it so you can remotely control your system. 383Set 384.Dq Va sshd=YES 385in 386.Pa /etc/rc.conf 387and then starting the server with the command 388.Bd -literal -offset indent 389.Ic service sshd start 390.Ed 391.Pp 392The first time the server is started, it will generate a new keypair, 393which will be stored inside the directory 394.Pa /etc/ssh . 395.Ss Host names and DNS 396The system resolves host names according the rules for hosts in the 397name service switch configuration at 398.Pa /etc/nsswitch.conf . 399By default, it will query 400.Pa /etc/hosts 401first, and then the DNS resolver specified in 402.Pa /etc/resolv.conf . 403.Pp 404Multicast DNS and DNS Service Discovery are usually not enabled by 405default on a fresh NetBSD system, and can be enabled by setting 406.Dq mdnsd=YES 407in 408.Pa /etc/rc.conf , 409and either rebooting or running the following command: 410.Bd -literal -offset indent 411.Ic service mdnsd start 412.Ed 413.Pp 414If your network does not have a usable DNS resolver, e.g. one provided 415by DHCP, you can run a local caching recursive resolver by setting 416.Dq named=YES 417in 418.Pa /etc/rc.conf 419and either rebooting or running the following command: 420.Bd -literal -offset indent 421.Ic service named start 422.Ed 423.Pp 424.Xr named 8 425is configured in 426.Pa /etc/named.conf 427by default to run as a local caching recursive resolver. 428Then, to make the system use it, put the following in 429.Pa /etc/resolv.conf : 430.Bd -literal -offset indent 431nameserver 127.0.0.1 432.Ed 433.Ss Wireless networking 434You can scan for nearby wireless networks using: 435.Bd -literal -offset indent 436.Ic ifconfig iwm0 up list scan 437.Ic ifconfig iwm0 down 438.Ed 439.Pp 440To connect to a wireless network using WPA and DHCP: 441.Bd -literal -offset indent 442.Ic wpa_passphrase networkname password >> /etc/wpa_supplicant.conf 443.Ic service wpa_supplicant onestart 444.Ic service dhcpcd onestart 445.Ed 446.Pp 447To connect to an open wireless network with no password, edit 448.Pa /etc/wpa_supplicant.conf 449instead of using 450.Xr wpa_passphrase 8 : 451.Bd -literal -offset indent 452network={ 453 ssid="Public-WiFi" 454 key_mgmt=NONE 455 priority=100 456} 457.Ed 458.Pp 459To automatically connect at boot, add the following to 460.Pa /etc/rc.conf : 461.Pp 462.Dl dhcpcd=YES 463.Dl wpa_supplicant=YES 464.Ss RPC-based network services 465Several services depend on the RPC portmapper 466.Xr rpcbind 8 467- formerly known as 468.Ic portmap 469- being running for proper operation. 470This includes YP (NIS) and NFS exports, among other services. 471To get the RPC portmapper to start automatically on boot, 472you will need to have this line in 473.Pa /etc/rc.conf : 474.Pp 475.Dl rpcbind=YES 476.Ss YP (NIS) Setup 477Check the YP domain name with the 478.Xr domainname 1 479command. 480If necessary, correct it by editing the 481.Pa /etc/defaultdomain 482file or by setting the 483.Dq Va domainname 484variable in 485.Pa /etc/rc.conf . 486The 487.Pa /etc/rc.d/network 488script reads this file on bootup to determine and set the domain name. 489You may also set the running system's domain name with the 490.Xr domainname 1 491command. 492To start YP client services, simply run 493.Ic ypbind , 494then perform the remaining 495YP activation as described in 496.Xr passwd 5 497and 498.Xr group 5 . 499.Pp 500In particular, to enable YP passwd support, you'll need to update 501.Pa /etc/nsswitch.conf 502to include 503.Dq nis 504for the 505.Dq passwd 506and 507.Dq group 508entries. 509A traditional way to accomplish the same thing is to 510add following entry to local passwd database via 511.Xr vipw 8 : 512.Bd -literal -offset indent 513.Li +:*:::::::: 514.Ed 515.Pp 516Note this entry has to be the very last one. 517This traditional way works with the default 518.Xr nsswitch.conf 5 519setting of 520.Dq passwd , 521which is 522.Dq compat . 523.Pp 524There are many more YP man pages available to help you. 525You can find more information by starting with 526.Xr nis 8 . 527.Ss Check disk mounts 528Check that the disks are mounted correctly by 529comparing the 530.Pa /etc/fstab 531file against the output of the 532.Xr mount 8 533and 534.Xr df 1 535commands. 536Example: 537.Bd -literal -offset indent 538.Li # Ic cat /etc/fstab 539/dev/sd0a / ffs rw 1 1 540/dev/sd0b none swap sw 541/dev/sd0e /usr ffs rw 1 2 542/dev/sd0f /var ffs rw 1 3 543/dev/sd0g /tmp ffs rw 1 4 544/dev/sd0h /home ffs rw 1 5 545 546.Li # Ic mount 547/dev/sd0a on / type ffs (local) 548/dev/sd0e on /usr type ffs (local) 549/dev/sd0f on /var type ffs (local) 550/dev/sd0g on /tmp type ffs (local) 551/dev/sd0h on /home type ffs (local) 552 553.Li # Ic df 554Filesystem 1024-blocks Used Avail Capacity Mounted on 555/dev/sd0a 22311 14589 6606 69% / 556/dev/sd0e 203399 150221 43008 78% /usr 557/dev/sd0f 10447 682 9242 7% /var 558/dev/sd0g 18823 2 17879 0% /tmp 559/dev/sd0h 7519 5255 1888 74% /home 560 561.Li # Ic pstat -s 562Device 512-blocks Used Avail Capacity Priority 563/dev/sd0b 131072 84656 46416 65% 0 564.Ed 565.Pp 566Edit 567.Pa /etc/fstab 568and use the 569.Xr mount 8 570and 571.Xr umount 8 572commands as appropriate. 573Refer to the above example and 574.Xr fstab 5 575for information on the format of this file. 576.Pp 577You may wish to do NFS mounts now too, or you can do them later. 578.Ss Concatenated disks (ccd) 579If you are using 580.Xr ccd 4 581concatenated disks, edit 582.Pa /etc/ccd.conf . 583You may wish to take a look to 584.Xr ccdconfig 8 585for more information about this file. 586Use the 587.Ic ccdconfig -U 588command to unload and the 589.Ic ccdconfig -C 590command to create tables internal to the kernel for the concatenated disks. 591You then 592.Xr mount 8 , 593.Xr umount 8 , 594and edit 595.Pa /etc/fstab 596as needed. 597.Ss Automounter daemon (AMD) 598To use the 599.Xr amd 8 600automounter, create the 601.Pa /etc/amd 602directory, copy example config files from 603.Pa /usr/share/examples/amd 604to 605.Pa /etc/amd 606and customize them as needed. 607Alternatively, you can get your maps with YP. 608.Ss Clock synchronization 609In order to make sure the system clock is synchronized 610to that of a publicly accessible NTP server, 611make sure that 612.Pa /etc/rc.conf 613contains the following: 614.Pp 615.Dl ntpdate=YES 616.Dl ntpd=YES 617.Pp 618See 619.Xr date 1 , 620.Xr ntpdate 8 , 621.Xr ntpd 8 , 622.Xr rdate 8 , 623and 624.Xr timed 8 625for more information on setting the system's date. 626.Sh CHANGING /etc FILES 627The system should be usable now, but you may wish to do more customizing, 628such as adding users, etc. 629Many of the following sections may be skipped 630if you are not using that package (for example, skip the 631.Sx Kerberos 632section if you won't be using Kerberos). 633We suggest that you 634.Ic cd /etc 635and edit most of the files in that directory. 636.Pp 637Note that the 638.Pa /etc/motd 639file is modified by 640.Pa /etc/rc.d/motd 641whenever the system is booted. 642To keep any custom message intact, ensure that you leave two blank lines 643at the top, or your message will be overwritten. 644.Ss Add new users 645To add new users and groups, there are 646.Xr useradd 8 647and 648.Xr groupadd 8 ; 649see also 650.Xr user 8 651for further programs for user and group manipulation. 652You may use 653.Xr vipw 8 654to add users to the 655.Pa /etc/passwd 656file 657and edit 658.Pa /etc/group 659by hand to add new groups. 660The manual page for 661.Xr su 1 , 662tells you to make sure to put people in 663the 664.Sq wheel 665group if they need root access (non-Kerberos). 666For example: 667.Bd -literal -offset indent 668wheel:*:0:root,myself 669.Ed 670.Pp 671Follow instructions for 672.Xr kerberos 8 673if using 674Kerberos 675for authentication. 676.Ss System boot scripts and /etc/rc.local 677.Pa /etc/rc 678and the 679.Pa /etc/rc.d/* 680scripts are invoked at boot time after single user mode has exited, 681and at shutdown. 682The whole process is controlled by the master script 683.Pa /etc/rc . 684This script should not be changed by administrators. 685.Pp 686The directory 687.Pa /etc/rc.d 688contains a series of scripts used at startup/shutdown, called by 689.Pa /etc/rc . 690.Pa /etc/rc 691is in turn influenced by the configuration variables present in 692.Pa /etc/rc.conf . 693.Pp 694The script 695.Pa /etc/rc.local 696is run as the last thing during multiuser boot, and is provided 697to allow any other local hooks necessary for the system. 698.Ss rc.conf 699To enable or disable various services on system startup, 700corresponding entries can be made in 701.Pa /etc/rc.conf . 702You can take a look at 703.Pa /etc/defaults/rc.conf 704to see a list of default system variables, which you can override in 705.Pa /etc/rc.conf . 706Note you are 707.Em not 708supposed to change 709.Pa /etc/defaults/rc.conf 710directly, edit only 711.Pa /etc/rc.conf . 712See 713.Xr rc.conf 5 714for further information. 715.Ss X Display Manager 716If you've installed X, you may want to turn on 717.Xr xdm 1 , 718the X Display Manager. 719To do this, set 720.Dq xdm=YES 721in 722.Pa /etc/rc.conf . 723.Ss Printers 724Edit 725.Pa /etc/printcap 726and 727.Pa /etc/hosts.lpd 728to get any printers set up. 729Consult 730.Xr lpd 8 731and 732.Xr printcap 5 733if needed. 734.Ss Tighten up security 735In 736.Pa /etc/inetd.conf 737comment out any extra entries you do not need, and only add things 738that are really needed. 739Note that by default all services are disabled for security reasons. 740.Ss Kerberos 741If you are going to use Kerberos for authentication, 742see 743.Xr kerberos 8 744and 745.Dq info heimdal 746for more information. 747If you already have a Kerberos master, change directory to 748.Pa /etc/kerberosV 749and configure. 750Remember to get a 751.Pa srvtab 752from the master so that the remote commands work. 753.Ss Mail Aliases 754Check 755.Pa /etc/mail/aliases 756and update appropriately if you want e-mail to be routed 757to non-local addresses or to different users. 758.Pp 759Run 760.Xr newaliases 1 761after changes. 762.Ss Postfix 763.Nx 764uses Postfix as its MTA. 765Postfix is started by default, but its initial configuration does not 766cause it to listen on the network for incoming connections. 767To configure Postfix, see 768.Pa /etc/postfix/main.cf 769and 770.Pa /etc/postfix/master.cf . 771If you wish to use a different MTA (e.g., sendmail), install your MTA of 772choice and edit 773.Pa /etc/mailer.conf 774to point to the proper binaries. 775.Ss DHCP server 776If this is a 777DHCP 778server, edit 779.Pa /etc/dhcpd.conf 780and 781.Pa /etc/dhcpd.interfaces 782as needed. 783You will have to make sure 784.Pa /etc/rc.conf 785has 786.Dq dhcpd=YES 787or run 788.Xr dhcpd 8 789manually. 790.Ss Bootparam server 791If this is a 792Bootparam 793server, edit 794.Pa /etc/bootparams 795as needed. 796You will have to turn it on in 797.Pa /etc/rc.conf 798by adding 799.Dq bootparamd=YES . 800.Ss NFS server 801If this is an NFS server, make sure 802.Pa /etc/rc.conf 803has: 804.Bd -literal -offset indent 805nfs_server=YES 806mountd=YES 807rpcbind=YES 808.Ed 809.Pp 810Edit 811.Pa /etc/exports 812and get it correct. 813After this, you can start the server by issuing: 814.Bd -literal -offset indent 815.Ic service rpcbind start 816.Ic service mountd start 817.Ic service nfsd start 818.Ed 819which will also start dependencies. 820.Ss HP remote boot server 821Edit 822.Pa /etc/rbootd.conf 823if needed for remote booting. 824If you do not have HP computers doing remote booting, do not enable this. 825.Ss Daily, weekly, monthly scripts 826Look at and possibly edit the 827.Pa /etc/daily.conf , /etc/weekly.conf , 828and 829.Pa /etc/monthly.conf 830configuration files. 831You can check which values you can set by looking 832to their matching files in 833.Pa /etc/defaults . 834Your site specific things should go into 835.Pa /etc/daily.local , /etc/weekly.local , 836and 837.Pa /etc/monthly.local . 838.Pp 839These scripts have been limited so as to keep the system running without 840filling up disk space from normal running processes and database updates. 841(You probably do not need to understand them.) 842.Ss Other files in /etc 843Look at the other files in 844.Pa /etc 845and edit them as needed. 846(Do not edit files ending in 847.Pa .db 848\(em like 849.Pa pwd.db , spwd.db , 850nor 851.Pa localtime , 852nor 853.Pa rmt , 854nor any directories.) 855.Ss Crontab (background running processes) 856Check what is running by typing 857.Ic crontab -l 858as root 859and see if anything unexpected is present. 860Do you need anything else? 861Do you wish to change things? 862For example, if you do not 863like root getting standard output of the daily scripts, and want only 864the security scripts that are mailed internally, you can type 865.Ic crontab -e 866and change some of the lines to read: 867.Bd -literal -offset indent 86830 1 * * * /bin/sh /etc/daily 2>&1 > /var/log/daily.out 86930 3 * * 6 /bin/sh /etc/weekly 2>&1 > /var/log/weekly.out 87030 5 1 * * /bin/sh /etc/monthly 2>&1 > /var/log/monthly.out 871.Ed 872.Pp 873See 874.Xr crontab 5 . 875.Ss Next day cleanup 876After the first night's security run, change ownerships and permissions 877on files, directories, and devices; root should have received mail 878with subject: "<hostname> daily insecurity output.". 879This mail contains 880a set of security recommendations, presented as a list looking like this: 881.Bd -literal -offset indent 882var/mail: 883 permissions (0755, 0775) 884etc/daily: 885 user (0, 3) 886.Ed 887.Pp 888The best bet is to follow the advice in that list. 889The recommended setting is the first item in parentheses, while 890the current setting is the second one. 891This list is generated by 892.Xr mtree 8 893using 894.Pa /etc/mtree/special . 895Use 896.Xr chmod 1 , 897.Xr chgrp 1 , 898and 899.Xr chown 8 900as needed. 901.Ss Packages 902Install your own packages. 903The 904.Nx 905packages collection, pkgsrc, includes a large set of third-party software. 906A lot of it is available as binary packages that you can download from 907.Lk https://cdn.netbsd.org/pub/pkgsrc/packages/NetBSD/ 908or a mirror. 909.Pp 910For most users, using pkgin to manage binary packages is recommended. 911.Pp 912To install pkgin, if it was not done by the installer: 913.Bd -literal -offset indent 914.Ic export PKG_PATH=https://cdn.netbsd.org/pub/pkgsrc/packages/NetBSD/$(sysctl -n hw.machine_arch)/$(uname -r | cut -d_ -f1)/All 915.Ic pkg_add pkgin 916.Ic pkgin update 917.Ic pkgin install bash mpg123 fluxbox ... 918.Ed 919.Pp 920See 921.Lk https://www.NetBSD.org/docs/pkgsrc/ 922and 923.Pa pkgsrc/doc/pkgsrc.txt 924for more details. 925.Pp 926Copy vendor binaries and install them. 927You will need to install any shared libraries, etc. 928(Hint: 929.Ic man -k compat 930to find out how to install and use compatibility mode.) 931.Pp 932There is also other third-party software that is available 933in source form only, either because it has not been ported to 934.Nx 935yet, because licensing restrictions make binary redistribution 936impossible, or simply because you want to build your own binaries. 937Sometimes checking the mailing lists for 938past problems that people have encountered will result in a fix posted. 939.Ss Check the running system 940You can use 941.Xr ps 1 , 942.Xr netstat 1 , 943and 944.Xr fstat 1 945to check on running processes, network connections, and opened files, 946respectively. 947Other tools you may find useful are 948.Xr systat 1 949and 950.Xr top 1 . 951.Sh COMPILING A KERNEL 952Note: 953The standard 954.Nx 955kernel configuration (GENERIC) is suitable for most purposes. 956.Pp 957First, review the system message buffer in 958.Pa /var/run/dmesg.boot 959and by using the 960.Xr dmesg 8 961command to find out information on your system's devices as probed by the 962kernel at boot. 963In particular, note which devices were not configured. 964This information will prove useful when editing kernel configuration files. 965.Pp 966To compile a kernel inside a writable source tree, do the following: 967.Bd -literal -offset indent 968$ cd /usr/src/sys/arch/SOMEARCH/conf 969$ cp GENERIC SOMEFILE (only the first time) 970$ vi SOMEFILE (adapt to your needs) 971$ config SOMEFILE 972$ cd ../compile/SOMEFILE 973$ make depend 974$ make 975.Ed 976.Pp 977where 978.Ar SOMEARCH 979is the architecture (e.g., i386), and 980.Ar SOMEFILE 981should be a name indicative of a particular configuration (often 982that of the hostname). 983.Pp 984If you are building your kernel again, before you do a 985.Ic make 986you should do a 987.Ic make clean 988after making changes to your kernel options. 989.Pp 990After either of these two methods, you can place the new kernel (called 991.Pa netbsd ) 992in 993.Pa / 994(i.e., 995.Pa /netbsd ) 996by issuing 997.Ic make install 998and the system will boot it next time. 999The old kernel is stored as 1000.Pa /onetbsd 1001so you can boot it in case of failure. 1002.Pp 1003If you are using toolchain to build your kernel, you will also need to 1004build a new set of toolchain binaries. 1005You can do it by changing into 1006.Pa /usr/src 1007and issuing: 1008.Bd -literal -offset indent 1009$ cd /usr/src 1010$ K=sys/arch/`uname -m`/conf 1011$ cp $K/GENERIC $K/SOMEFILE 1012$ vi $K/SOMEFILE (adapt to your needs) 1013$ ./build.sh tools 1014$ ./build.sh kernel=SOMEFILE 1015.Ed 1016.Sh SYSTEM TESTING 1017At this point, the system should be fully configured to your liking. 1018It is now a good time to ensure that the system behaves according to 1019its specifications and that it is stable on your hardware. 1020Please refer to 1021.Xr tests 7 1022for details on how to do so. 1023.Sh SEE ALSO 1024.Xr chgrp 1 , 1025.Xr chmod 1 , 1026.Xr config 1 , 1027.Xr crontab 1 , 1028.Xr date 1 , 1029.Xr df 1 , 1030.Xr domainname 1 , 1031.Xr fstat 1 , 1032.Xr hostname 1 , 1033.Xr make 1 , 1034.Xr man 1 , 1035.Xr netstat 1 , 1036.Xr newaliases 1 , 1037.Xr passwd 1 , 1038.Xr pkg_add 1 , 1039.Xr ps 1 , 1040.Xr ssh 1 , 1041.Xr su 1 , 1042.Xr systat 1 , 1043.Xr top 1 , 1044.Xr xdm 1 , 1045.Xr ccd 4 , 1046.Xr aliases 5 , 1047.Xr crontab 5 , 1048.Xr dhcpcd.conf 5 , 1049.Xr exports 5 , 1050.Xr fstab 5 , 1051.Xr group 5 , 1052.Xr hosts 5 , 1053.Xr ifconfig.if 5 , 1054.Xr mailer.conf 5 , 1055.Xr named.conf 5 , 1056.Xr nsswitch.conf 5 , 1057.Xr passwd 5 , 1058.Xr printcap 5 , 1059.Xr rc.conf 5 , 1060.Xr resolv.conf 5 , 1061.Xr sshd_config 5 , 1062.Xr wpa_supplicant.conf 5 , 1063.Xr wscons.conf 5 , 1064.Xr hier 7 , 1065.Xr hostname 7 , 1066.Xr pkgsrc 7 , 1067.Xr tests 7 , 1068.Xr amd 8 , 1069.Xr ccdconfig 8 , 1070.Xr chown 8 , 1071.Xr dhcpcd 8 , 1072.Xr dhcpd 8 , 1073.Xr dmesg 8 , 1074.Xr groupadd 8 , 1075.Xr ifconfig 8 , 1076.Xr inetd 8 , 1077.Xr kerberos 8 , 1078.Xr lpd 8 , 1079.Xr mount 8 , 1080.Xr mrouted 8 , 1081.Xr mtree 8 , 1082.Xr named 8 , 1083.Xr nis 8 , 1084.Xr ntpd 8 , 1085.Xr ntpdate 8 , 1086.Xr rbootd 8 , 1087.Xr rc 8 , 1088.Xr rdate 8 , 1089.Xr rmt 8 , 1090.Xr route 8 , 1091.Xr rpc.bootparamd 8 , 1092.Xr rpcbind 8 , 1093.Xr sshd 8 , 1094.Xr timed 8 , 1095.Xr umount 8 , 1096.Xr useradd 8 , 1097.Xr vipw 8 , 1098.Xr wpa_supplicant 8 , 1099.Xr yp 8 , 1100.Xr ypbind 8 1101.Sh HISTORY 1102This document first appeared in 1103.Ox 2.2 . 1104It has been adapted to 1105.Nx 1106and first appeared in 1107.Nx 2.0 . 1108