1.\" $NetBSD: afterboot.8,v 1.22 2005/09/11 23:36:19 wiz Exp $ 2.\" $OpenBSD: afterboot.8,v 1.72 2002/02/22 02:02:33 miod Exp $ 3.\" 4.\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu 5.\" Adapted to NetBSD by Julio Merino -- 2002-05-10, jmmv@hispabsd.org 6.\" 7.\" 8.\" Copyright (c) 2002-2005 The NetBSD Foundation, Inc. 9.\" All rights reserved. 10.\" 11.\" Redistribution and use in source and binary forms, with or without 12.\" modification, are permitted provided that the following conditions 13.\" are met: 14.\" 1. Redistributions of source code must retain the above copyright 15.\" notice, this list of conditions and the following disclaimer. 16.\" 2. Redistributions in binary form must reproduce the above copyright 17.\" notice, this list of conditions and the following disclaimer in the 18.\" documentation and/or other materials provided with the distribution. 19.\" 3. All advertising materials mentioning features or use of this software 20.\" must display the following acknowledgement: 21.\" This product includes software developed by the NetBSD 22.\" Foundation, Inc. and its contributors. 23.\" 4. Neither the name of The NetBSD Foundation nor the names of its 24.\" contributors may be used to endorse or promote products derived 25.\" from this software without specific prior written permission. 26.\" 27.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 28.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 29.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 30.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 31.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 32.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 33.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 34.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 35.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 36.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 37.\" POSSIBILITY OF SUCH DAMAGE. 38.\" 39.\" 40.\" Copyright (c) 1997 Marshall M. Midden 41.\" All rights reserved. 42.\" 43.\" Redistribution and use in source and binary forms, with or without 44.\" modification, are permitted provided that the following conditions 45.\" are met: 46.\" 47.\" 1. Redistributions of source code must retain the above copyright 48.\" notice, this list of conditions and the following disclaimer. 49.\" 2. Redistributions in binary form must reproduce the above copyright 50.\" notice, this list of conditions and the following disclaimer in the 51.\" documentation and/or other materials provided with the distribution. 52.\" 3. All advertising materials mentioning features or use of this software 53.\" must display the following acknowledgement: 54.\" This product includes software developed by Marshall M. Midden. 55.\" 4. The name of the author may not be used to endorse or promote products 56.\" derived from this software without specific prior written permission. 57.\" 58.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 59.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 60.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 61.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 62.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 63.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 64.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 65.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 66.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 67.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 68.\" 69.Dd May 4, 2005 70.Dt AFTERBOOT 8 71.Os 72.Sh NAME 73.Nm afterboot 74.Nd things to check after the first complete boot 75.Sh DESCRIPTION 76.Ss Starting Out 77This document attempts to list items for the system administrator 78to check and set up after the installation and first complete boot of the 79system. 80The idea is to create a list of items that can be checked off so that you have 81a warm fuzzy feeling that something obvious has not been missed. 82A basic knowledge of 83.Ux 84is assumed. 85.Pp 86Complete instructions for correcting and fixing items is not provided. 87There are manual pages and other methodologies available for doing that. 88For example, to view the man page for the 89.Xr ls 1 90command, type: 91.Bd -literal -offset indent 92.Ic man 1 ls 93.Ed 94.Pp 95Administrators will rapidly become more familiar with 96.Nx 97if they get used to using the manual pages. 98.Ss Security alerts 99By the time that you have installed your system, it is quite likely that 100bugs in the release have been found. 101All significant and easily fixed problems will be reported at 102.Pa http://www.NetBSD.org/Security/ . 103It is recommended that you check this page regularly. 104.Ss Login 105Login as 106.Dq Ic root . 107You can do so on the console, or over the network using 108.Xr ssh 1 . 109If you have enabled the ssh daemon and wish to allow root logins over 110the network, edit the 111.Pa /etc/ssh/sshd_config 112file and set 113.Cm PermitRootLogin 114to 115.Dq yes 116(see 117.Xr sshd 8 ) . 118The default is to not permit root logins over the network 119after fresh install in 120.Nx . 121.Pp 122Upon successful login on the console, you may see the message 123.Dq We recommend creating a non-root account... . 124For security reasons, it is bad practice to login as root during 125regular use and maintenance of the system. 126Instead, administrators are encouraged to add a 127.Dq regular 128user, add said user to the 129.Dq wheel 130group, then use the 131.Xr su 1 132command when root privileges are required. 133This process is described in more detail later. 134.Ss Root password 135Change the password for the root user. 136(Note that throughout the documentation, the term 137.Dq superuser 138is a synonym for the root user.) 139Choose a password that has numbers, digits, and special characters (not space) 140as well as from the upper and lower case alphabet. 141Do not choose any word in any language. 142It is common for an intruder to use dictionary attacks. 143Type the command 144.Ic /usr/bin/passwd 145to change it. 146.Pp 147It is a good idea to always specify the full path name for both the 148.Xr passwd 1 149and 150.Xr su 1 151commands as this inhibits the possibility of files placed in your execution 152.Ev PATH 153for most shells. 154Furthermore, the superuser's 155.Ev PATH 156should never contain the current directory 157.Po Dq \&. 158.Pc . 159.Ss System date 160Check the system date with the 161.Xr date 1 162command. 163If needed, change the date, and/or change the symbolic link of 164.Pa /etc/localtime 165to the correct time zone in the 166.Pa /usr/share/zoneinfo 167directory. 168.Pp 169Examples: 170.Bl -tag -width date 171.It Cm date 200205101820 172Set the current date to May 10th, 2002 6:20pm. 173.It Cm ln -fs /usr/share/zoneinfo/Europe/Helsinki /etc/localtime 174Set the time zone to Eastern Europe Summer Time. 175.El 176.Ss Console settings 177One of the first things you will likely need to do is to set up your 178keyboard map (and maybe some other aspects about the system console). 179To change your keyboard encoding, edit the 180.Dq Va encoding 181variable found in 182.Pa /etc/wscons.conf . 183.Pp 184.Xr wscons.conf 5 185contains more information about this file. 186.Ss Check hostname 187Use the 188.Ic hostname 189command to verify that the name of your machine is correct. 190See the man page for 191.Xr hostname 1 192if it needs to be changed. 193You will also need to change the contents of the 194.Dq Va hostname 195variable in 196.Pa /etc/rc.conf 197or edit the 198.Pa /etc/myname 199file to have it stick around for the next reboot. 200Note that hostname is supposed include a domainname, and that this should 201not be confused with YP (NIS) 202.Xr domainname 1 . 203.Ss Verify network interface configuration 204The first thing to do is an 205.Ic ifconfig -a 206to see if the network interfaces are properly configured. 207Correct by editing 208.Pa /etc/ifconfig. Ns Ar interface 209or the corresponding 210.Dq Va ifconfig_ Ns Ar interface 211variable in 212.Xr rc.conf 5 213(where 214.Ar interface 215is the interface name, e.g., 216.Dq le0 ) 217and then using 218.Xr ifconfig 8 219to manually configure it 220if you do not wish to reboot. 221.Pp 222You can add new 223.Dq virtual interfaces 224by adding the required entries to 225.Pa /etc/ifconfig. Ns Ar interface . 226Read the 227.Xr ifconfig.if 5 228man page for more information on the format of 229.Pa /etc/ifconfig. Ns Ar interface 230files. 231The loopback interface will look something like: 232.Bd -literal -offset indent 233lo0: flags=8009\*[Lt]UP,LOOPBACK,MULTICAST\*[Gt] mtu 32972 234 inet 127.0.0.1 netmask 0xff000000 235 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 236 inet6 ::1 prefixlen 128 237.Ed 238.Pp 239an Ethernet interface something like: 240.Bd -literal -offset indent 241le0: flags=9863\*[Lt]UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST\*[Gt] 242 inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255 243 inet6 fe80::5ef0:f0f0%le0 prefixlen 64 scopeid 0x1 244.Ed 245.Pp 246and a PPP interface something like: 247.Bd -literal -offset indent 248ppp0: flags=8051\*[Lt]UP,POINTOPOINT,RUNNING,MULTICAST\*[Gt] 249 inet 203.3.131.108 --\*[Gt] 198.181.0.253 netmask 0xffff0000 250.Ed 251.Pp 252See 253.Xr mrouted 8 254for instructions on configuring multicast routing. 255.Pp 256See 257.Xr dhcpd 8 258for instructions on configuring interfaces with DHCP. 259.Ss Check routing tables 260Issue a 261.Ic netstat -rn 262command. 263The output will look something like: 264.Bd -literal -offset indent 265Routing tables 266 267Internet: 268Destination Gateway Flags Refs Use Mtu Interface 269default 192.168.4.254 UGS 0 11098028 - le0 270127 127.0.0.1 UGRS 0 0 - lo0 271127.0.0.1 127.0.0.1 UH 3 24 - lo0 272192.168.4 link#1 UC 0 0 - le0 273192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - le0 274192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - le0 275 276Internet6: 277Destination Gateway Flags Refs Use Mtu Interface 278::/96 ::1 UGRS 0 0 32972 lo0 =\*[Gt] 279::1 ::1 UH 4 0 32972 lo0 280::ffff:0.0.0.0/96 ::1 UGRS 0 0 32972 lo0 281fc80::/10 ::1 UGRS 0 0 32972 lo0 282fe80::/10 ::1 UGRS 0 0 32972 lo0 283fe80::%le0/64 link#1 UC 0 0 1500 le0 284fe80::%lo0/64 fe80::1%lo0 U 0 0 32972 lo0 285ff01::/32 ::1 U 0 0 32972 lo0 286ff02::%le0/32 link#1 UC 0 0 1500 le0 287ff02::%lo0/32 fe80::1%lo0 UC 0 0 32972 lo0 288.Ed 289.Pp 290The default gateway address is stored in the 291.Dq Va defaultroute 292variable in 293.Pa /etc/rc.conf , 294or in the file 295.Pa /etc/mygate . 296If you need to edit this file, a painless way to reconfigure the network 297afterwards is to issue 298.Bd -literal -offset indent 299.Ic /etc/rc.d/network restart 300.Ed 301.Pp 302Or, you may prefer to manually configure using a series of 303.Ic route add 304and 305.Ic route delete 306commands (see 307.Xr route 8 ) . 308If you run 309.Xr dhclient 8 310you will have to kill it by running 311.Bd -literal -offset indent 312.Ic /etc/rc.d/dhclient stop 313.Pp 314.Ed 315after you flush the routes. 316.Pp 317If you wish to route packets between interfaces, add one or both 318of the following directives (depending on whether IPv4 or IPv6 routing 319is required) to 320.Pa /etc/sysctl.conf : 321.Pp 322.Dl net.inet.ip.forwarding=1 323.Dl net.inet6.ip6.forwarding=1 324.Pp 325As an alternative, compile a new kernel with the 326.Cm GATEWAY 327option. 328Packets are not forwarded by default, due to RFC requirements. 329.Ss Secure Shell (ssh) 330By default, all services are disabled in a fresh 331.Nx 332installation, and ssh is no exception. 333You may wish to enable it so you can remotely control your system. 334Set 335.Dq Va sshd=yes 336in 337.Pa /etc/rc.conf 338and then starting the server with the command 339.Bd -literal -offset indent 340.Ic /etc/rc.d/sshd start 341.Ed 342.Pp 343The first time the server is started, it will generate a new keypair, 344which will be stored inside the directory 345.Pa /etc/ssh . 346.Ss BIND Name Server (DNS) 347If you are using the BIND Name Server, check the 348.Pa /etc/resolv.conf 349file. 350It may look something like: 351.Bd -literal -offset indent 352domain some.thing.dom 353nameserver 192.168.0.1 354nameserver 192.168.4.55 355search some.thing.dom. thing.dom. 356.Ed 357.Pp 358For further details, see 359.Xr resolv.conf 5 . 360Note the name service lookup order is set via 361.Xr nsswitch.conf 5 362mechanism. 363.Pp 364If using a caching name server add the line "nameserver 127.0.0.1" first. 365To get a local caching name server to run 366you will need to set "named=yes" in 367.Pa /etc/rc.conf 368and create the 369.Pa named.conf 370file in the appropriate place for 371.Xr named 8 , 372usually in 373.Pa /etc/namedb . 374The same holds true if the machine is going to be a 375name server for your domain. 376In both these cases, make sure that 377.Xr named 8 378is running 379(otherwise there are long waits for resolver timeouts). 380.Ss RPC-based network services 381Several services depend on the RPC portmapper 382.Xr rpcbind 8 383- formerly known as 384.Ic portmap 385- being running for proper operation. 386This includes YP (NIS) and NFS exports, among other services. 387To get the RPC portmapper to start automatically on boot, 388you will need to have this line in 389.Pa /etc/rc.conf : 390.Pp 391.Dl rpcbind=YES 392.Ss YP (NIS) Setup 393Check the YP domain name with the 394.Xr domainname 1 395command. 396If necessary, correct it by editing the 397.Pa /etc/defaultdomain 398file or by setting the 399.Dq Va domainname 400variable in 401.Pa /etc/rc.conf . 402The 403.Pa /etc/rc.d/network 404script reads this file on bootup to determine and set the domain name. 405You may also set the running system's domain name with the 406.Xr domainname 1 407command. 408To start YP client services, simply run 409.Ic ypbind , 410then perform the remaining 411YP activation as described in 412.Xr passwd 5 413and 414.Xr group 5 . 415.Pp 416In particular, to enable YP passwd support, you'll need to update 417.Pa /etc/nsswitch.conf 418to include 419.Dq nis 420for the 421.Dq passwd 422and 423.Dq group 424entries. 425A traditional way to accomplish the same thing is to 426add following entry to local passwd database via 427.Xr vipw 8 : 428.Bd -literal -offset indent 429.Li +:*:::::::: 430.Pp 431.Ed 432Note this entry has to be the very last one. 433This traditional way works with the default 434.Xr nsswitch.conf 5 435setting of 436.Dq passwd , 437which is 438.Dq compat . 439.Pp 440There are many more YP man pages available to help you. 441You can find more information by starting with 442.Xr yp 8 . 443.Ss Check disk mounts 444Check that the disks are mounted correctly by 445comparing the 446.Pa /etc/fstab 447file against the output of the 448.Xr mount 8 449and 450.Xr df 1 451commands. 452Example: 453.Bd -literal -offset indent 454.Li # Ic cat /etc/fstab 455/dev/sd0a / ffs rw 1 1 456/dev/sd0b none swap sw 457/dev/sd0e /usr ffs rw 1 2 458/dev/sd0f /var ffs rw 1 3 459/dev/sd0g /tmp ffs rw 1 4 460/dev/sd0h /home ffs rw 1 5 461 462.Li # Ic mount 463/dev/sd0a on / type ffs (local) 464/dev/sd0e on /usr type ffs (local) 465/dev/sd0f on /var type ffs (local) 466/dev/sd0g on /tmp type ffs (local) 467/dev/sd0h on /home type ffs (local) 468 469.Li # Ic df 470Filesystem 1024-blocks Used Avail Capacity Mounted on 471/dev/sd0a 22311 14589 6606 69% / 472/dev/sd0e 203399 150221 43008 78% /usr 473/dev/sd0f 10447 682 9242 7% /var 474/dev/sd0g 18823 2 17879 0% /tmp 475/dev/sd0h 7519 5255 1888 74% /home 476 477.Li # Ic pstat -s 478Device 512-blocks Used Avail Capacity Priority 479/dev/sd0b 131072 84656 46416 65% 0 480.Ed 481.Pp 482Edit 483.Pa /etc/fstab 484and use the 485.Xr mount 8 486and 487.Xr umount 8 488commands as appropriate. 489Refer to the above example and 490.Xr fstab 5 491for information on the format of this file. 492.Pp 493You may wish to do NFS mounts now too, or you can do them later. 494.Ss Concatenated disks (ccd) 495If you are using 496.Xr ccd 4 497concatenated disks, edit 498.Pa /etc/ccd.conf . 499You may wish to take a look to 500.Xr ccdconfig 8 501for more information about this file. 502Use the 503.Ic ccdconfig -U 504command to unload and the 505.Ic ccdconfig -C 506command to create tables internal to the kernel for the concatenated disks. 507You then 508.Xr mount 8 , 509.Xr umount 8 , 510and edit 511.Pa /etc/fstab 512as needed. 513.Ss Automounter daemon (AMD) 514To use the 515.Xr amd 8 516automounter, create the 517.Pa /etc/amd 518directory, copy example config files from 519.Pa /usr/share/examples/amd 520to 521.Pa /etc/amd 522and customize them as needed. 523Alternatively, you can get your maps with YP. 524.Ss Clock synchronisation 525In order to make sure the system clock is synchronised 526to that of a publicly accessible NTP server, 527make sure that 528.Pa /etc/rc.conf 529contains the following: 530.Pp 531.Dl ntpdate=yes 532.Dl ntpd=yes 533.Pp 534See 535.Xr date 1 , 536.Xr ntpdate 8 , 537.Xr ntpd 8 , 538.Xr rdate 8 , 539and 540.Xr timed 8 541for more information on setting the system's date. 542.Sh CHANGING /etc FILES 543The system should be usable now, but you may wish to do more customizing, 544such as adding users, etc. 545Many of the following sections may be skipped 546if you are not using that package (for example, skip the 547.Sx Kerberos 548section if you won't be using Kerberos). 549We suggest that you 550.Ic cd /etc 551and edit most of the files in that directory. 552.Pp 553Note that the 554.Pa /etc/motd 555file is modified by 556.Pa /etc/rc.d/motd 557whenever the system is booted. 558To keep any custom message intact, ensure that you leave two blank lines 559at the top, or your message will be overwritten. 560.Ss Sushi 561.Xr sushi 8 562is a tool for configuring the system. 563It will allow you to set up many 564aspects of the system from interactive menus. 565You can launch it typing: 566.Bd -literal -offset indent 567.Ic sushi 568.Ed 569.Ss Add new users 570To add new users and groups, there are 571.Xr useradd 8 572and 573.Xr groupadd 8 , 574see also 575.Xr user 8 576for forther programs for user and group manipulation. 577You may use 578.Xr vipw 8 579to add users to the 580.Pa /etc/passwd 581file 582and edit 583.Pa /etc/group 584by hand to add new groups. 585The manual page for 586.Xr su 1 , 587tells you to make sure to put people in 588the 589.Sq wheel 590group if they need root access (non-Kerberos). 591For example: 592.Bd -literal -offset indent 593wheel:*:0:root,myself 594.Ed 595.Pp 596Follow instructions for 597.Xr kerberos 8 598if using 599Kerberos 600for authentication. 601.Ss System boot scripts and /etc/rc.local 602.Pa /etc/rc 603and the 604.Pa /etc/rc.d/* 605scripts are invoked at boot time after single user mode has exited, 606and at shutdown. 607The whole process is controlled by the master script 608.Pa /etc/rc . 609This script should not be changed by administrators. 610.Pp 611The directory 612.Pa /etc/rc.d 613contains a serie of scripts used at startup/shutdown, called by 614.Pa /etc/rc . 615.Pa /etc/rc 616is in turn influenced by the configuration variables present in 617.Pa /etc/rc.conf . 618.Pp 619The script 620.Pa /etc/rc.local 621is run as the last thing during multiuser boot, and is provided 622to allow any other local hooks necessary for the system. 623.Ss rc.conf 624To enable or disable various services on system startup, 625corresponding entries can be made in 626.Pa /etc/rc.conf . 627You can take a look at 628.Pa /etc/defaults/rc.conf 629to see a list of default system variables, which you can override in 630.Pa /etc/rc.conf . 631Note you are 632.Em not 633supposed to change 634.Pa /etc/defaults/rc.conf 635directly, edit only 636.Pa /etc/rc.conf . 637See 638.Xr rc.conf 5 639for further information. 640.Pp 641If you've installed X, you may want to turn on 642.Xr xdm 1 , 643the X Display Manager. 644To do this, set the variable 645.Dq xdm 646to yes in 647.Pa /etc/rc.conf , 648i.e.: 649.Dq xdm=yes 650.Ss Printers 651Edit 652.Pa /etc/printcap 653and 654.Pa /etc/hosts.lpd 655to get any printers set up. 656Consult 657.Xr lpd 8 658and 659.Xr printcap 5 660if needed. 661.Ss Tighten up security 662In 663.Pa /etc/inetd.conf 664comment out any extra entries you do not need, and only add things 665that are really needed. 666Note that by default all services are disabled for security reasons. 667.Ss Kerberos 668If you are going to use Kerberos for authentication, 669see 670.Xr kerberos 8 671and 672.Dq info heimdal 673for more information. 674If you already have a Kerberos master, change directory to 675.Pa /etc/kerberosIV 676or 677.Pa /etc/kerberosV 678and configure. 679Remember to get a 680.Pa srvtab 681from the master so that the remote commands work. 682.Ss Mail Aliases 683Check 684.Pa /etc/mail/aliases 685and update appropriately if you want e-mail to be routed 686to non-local address or to different users. 687.Pp 688Run 689.Xr newaliases 1 690after changes. 691.Ss Sendmail 692.Nx 693ships with default 694.Pa /etc/mail/sendmail.cf 695and 696.Pa /etc/mail/submit.cf 697files that will work for simple installations; they were generated from 698.Pa netbsd-proto.mc 699and 700.Pa netbsd-msp.mc 701in 702.Pa /usr/share/sendmail/cf . 703Please see 704.Pa /usr/share/sendmail/README 705and 706.Pa /usr/share/doc/smm/08.sendmailop/op.me 707(run 708.Ic make 709there to produce a PostScript version) 710for information on generating your own sendmail configuration files. 711.Pa /etc/mailer.conf 712is configured to use Sendmail binaries by default and 713.Xr sendmail 8 714will start by default if no other changes to the mail system are made. 715See 716.Xr mailer.conf 5 717and 718.Xr rc.conf 5 719for more details. 720.Ss Postfix 721.Nx 722comes also with Postfix in the base system. 723You may wish to set it up in favor of sendmail. 724Take a look to 725.Pa /etc/postfix/main.cf 726and enable the daemon in 727.Pa /etc/rc.conf 728using "postfix=yes". 729It is very important to configure 730.Pa /etc/mailer.conf 731to point to Postfix binaries. 732.Ss DHCP server 733If this is a 734DHCP 735server, edit 736.Pa /etc/dhcpd.conf 737and 738.Pa /etc/dhcpd.interfaces 739as needed. 740You will have to make sure 741.Pa /etc/rc.conf 742has "dhcpd=yes" 743or run 744.Xr dhcpd 8 745manually. 746.Ss Bootparam server 747If this is a 748Bootparam 749server, edit 750.Pa /etc/bootparams 751as needed. 752You will have to turn it on in 753.Pa /etc/rc.conf 754by adding "bootparamd=yes". 755.Ss NFS server 756If this is an NFS server, make sure 757.Pa /etc/rc.conf 758has: 759.Bd -literal -offset indent 760nfs_server=yes 761mountd=yes 762rpcbind=yes 763.Ed 764.Pp 765Edit 766.Pa /etc/exports 767and get it correct. 768After this, you can start the server by issuing: 769.Bd -literal -offset indent 770.Ic /etc/rc.d/rpcbind start 771.Ic /etc/rc.d/mountd start 772.Ic /etc/rc.d/nfsd start 773.Ed 774which will also start dependancies. 775.Ss HP remote boot server 776Edit 777.Pa /etc/rbootd.conf 778if needed for remote booting. 779If you do not have HP computers doing remote booting, do not enable this. 780.Ss Daily, weekly, monthly scripts 781Look at and possibly edit the 782.Pa /etc/daily.conf , /etc/weekly.conf , 783and 784.Pa /etc/monthly.conf 785configuration files. 786You can check which values you can set by looking 787to their matching files in 788.Pa /etc/defaults . 789Your site specific things should go into 790.Pa /etc/daily.local , /etc/weekly.local , 791and 792.Pa /etc/monthly.local . 793.Pp 794These scripts have been limited so as to keep the system running without 795filling up disk space from normal running processes and database updates. 796(You probably do not need to understand them.) 797.Ss Other files in /etc 798Look at the other files in 799.Pa /etc 800and edit them as needed. 801(Do not edit files ending in 802.Pa .db 803\(em like 804.Pa pwd.db , spwd.db , 805nor 806.Pa localtime , 807nor 808.Pa rmt , 809nor any directories.) 810.Ss Crontab (background running processes) 811Check what is running by typing 812.Ic crontab -l 813as root 814and see if anything unexpected is present. 815Do you need anything else? 816Do you wish to change things? 817For example, if you do not 818like root getting standard output of the daily scripts, and want only 819the security scripts that are mailed internally, you can type 820.Ic crontab -e 821and change some of the lines to read: 822.Bd -literal -offset indent 82330 1 * * * /bin/sh /etc/daily 2\*[Gt]\*[Am]1 \*[Gt] /var/log/daily.out 82430 3 * * 6 /bin/sh /etc/weekly 2\*[Gt]\*[Am]1 \*[Gt] /var/log/weekly.out 82530 5 1 * * /bin/sh /etc/monthly 2\*[Gt]\*[Am]1 \*[Gt] /var/log/monthly.out 826.Ed 827.Pp 828See 829.Xr crontab 5 . 830.Ss Next day cleanup 831After the first night's security run, change ownerships and permissions 832on files, directories, and devices; root should have received mail 833with subject: "\*[Lt]hostname\*[Gt] daily insecurity output.". 834This mail contains 835a set of security recommendations, presented as a list looking like this: 836.Bd -literal -offset indent 837var/mail: 838 permissions (0755, 0775) 839etc/daily: 840 user (0, 3) 841.Ed 842.Pp 843The best bet is to follow the advice in that list. 844The recommended setting is the first item in parentheses, while 845the current setting is the second one. 846This list is generated by 847.Xr mtree 8 848using 849.Pa /etc/mtree/special . 850Use 851.Xr chmod 1 , 852.Xr chgrp 1 , 853and 854.Xr chown 8 855as needed. 856.Ss Packages 857Install your own packages. 858The 859.Nx 860packages collection, pkgsrc, includes a large set of third-party software. 861A lot of it is available as binary packages that you can download from 862.Pa ftp://ftp.NetBSD.org/pub/NetBSD/packages/ 863or a mirror, and install using 864.Xr pkg_add 1 . 865See 866.Pa http://www.NetBSD.org/Documentation/pkgsrc/ 867and 868.Xr packages 7 869for more details. 870.Pp 871Copy vendor binaries and install them. 872You will need to install any shared libraries, etc. 873(Hint: 874.Ic man -k compat 875to find out how to install and use compatibility mode.) 876.Pp 877There is also other third-party software that is available 878in source form only, either because it has not been ported to 879.Nx 880yet, because licensing restrictions make binary redistribution 881impossible, or simply because you want to build your own binaries. 882Sometimes checking the mailing lists for 883past problems that people have encountered will result in a fix posted. 884.Ss Check the running system 885You can use 886.Xr ps 1 , 887.Xr netstat 1 , 888and 889.Xr fstat 1 890to check on running processes, network connections, and opened files, 891respectively. 892Other tools you may find useful are 893.Xr systat 1 894and 895.Xr top 1 . 896.Sh COMPILING A KERNEL 897Note: 898The standard 899.Nx 900kernel configuration (GENERIC) is suitable for most purposes. 901.Pp 902First, review the system message buffer in 903.Pa /var/run/dmesg.boot 904and by using the 905.Xr dmesg 8 906command to find out information on your system's devices as probed by the 907kernel at boot. 908In particular, note which devices were not configured. 909This information will prove useful when editing kernel configuration files. 910.Pp 911To compile a kernel inside a writable source tree, do the following: 912.Bd -literal -offset indent 913$ cd /usr/src/sys/arch/SOMEARCH/conf 914$ cp GENERIC SOMEFILE (only the first time) 915$ vi SOMEFILE (adapt to your needs) 916$ config SOMEFILE 917$ cd ../compile/SOMEFILE 918$ make depend 919$ make 920.Ed 921.Pp 922where 923.Ar SOMEARCH 924is the architecture (e.g., i386), and 925.Ar SOMEFILE 926should be a name indicative of a particular configuration (often 927that of the hostname). 928.Pp 929If you are building your kernel again, before you do a 930.Ic make 931you should do a 932.Ic make clean 933after making changes to your kernel options. 934.Pp 935After either of these two methods, you can place the new kernel (called 936.Pa netbsd ) 937in 938.Pa / 939(i.e., 940.Pa /netbsd ) 941by issuing 942.Ic make install 943and the system will boot it next time. 944The old kernel is stored as 945.Pa /onetbsd 946so you can boot it in case of failure. 947.Pp 948If you are using toolchain to build your kernel, you will also need to 949build a new set of toolchain binaries. 950You can do it by changing into 951.Pa /usr/src 952and issuing: 953.Bd -literal -offset indent 954$ cd /usr/src 955$ K=sys/arch/`uname -m`/conf 956$ cp $K/GENERIC $K/SOMEFILE 957$ vi $K/SOMEFILE (adapt to your needs) 958$ ./build.sh tools 959$ ./build.sh kernel=SOMEFILE 960.Ed 961.Sh SEE ALSO 962.Xr chgrp 1 , 963.Xr chmod 1 , 964.Xr config 1 , 965.Xr crontab 1 , 966.Xr date 1 , 967.Xr df 1 , 968.Xr domainname 1 , 969.Xr hostname 1 , 970.Xr make 1 , 971.Xr man 1 , 972.Xr netstat 1 , 973.Xr newaliases 1 , 974.Xr passwd 1 , 975.Xr su 1 , 976.Xr ccd 4 , 977.Xr aliases 5 , 978.Xr crontab 5 , 979.Xr exports 5 , 980.Xr fstab 5 , 981.Xr group 5 , 982.Xr krb.conf 5 , 983.Xr krb.realms 5 , 984.Xr mailer.conf 5 , 985.Xr passwd 5 , 986.Xr rc.conf 5 , 987.Xr resolv.conf 5 , 988.Xr hostname 7 , 989.Xr packages 7 , 990.Xr adduser 8 , 991.Xr amd 8 , 992.Xr bootparamd 8 , 993.Xr ccdconfig 8 , 994.Xr chown 8 , 995.Xr dhcpd 8 , 996.Xr ifconfig 8 , 997.Xr inetd 8 , 998.Xr kerberos 8 , 999.Xr mount 8 , 1000.Xr mrouted 8 , 1001.Xr mtree 8 , 1002.Xr named 8 , 1003.Xr rbootd 8 , 1004.Xr rc 8 , 1005.Xr rmt 8 , 1006.Xr route 8 , 1007.Xr sushi 8 , 1008.Xr umount 8 , 1009.Xr vipw 8 , 1010.Xr ypbind 8 1011.Sh HISTORY 1012This document first appeared in 1013.Ox 2.2 . 1014It has been adapted to 1015.Nx 1016and first appeared in 1017.Nx 2.0 . 1018