1.\" $NetBSD: afterboot.8,v 1.27 2006/04/29 14:34:25 peter Exp $ 2.\" $OpenBSD: afterboot.8,v 1.72 2002/02/22 02:02:33 miod Exp $ 3.\" 4.\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu 5.\" Adapted to NetBSD by Julio Merino -- 2002-05-10, jmmv@hispabsd.org 6.\" 7.\" 8.\" Copyright (c) 2002-2005 The NetBSD Foundation, Inc. 9.\" All rights reserved. 10.\" 11.\" Redistribution and use in source and binary forms, with or without 12.\" modification, are permitted provided that the following conditions 13.\" are met: 14.\" 1. Redistributions of source code must retain the above copyright 15.\" notice, this list of conditions and the following disclaimer. 16.\" 2. Redistributions in binary form must reproduce the above copyright 17.\" notice, this list of conditions and the following disclaimer in the 18.\" documentation and/or other materials provided with the distribution. 19.\" 3. All advertising materials mentioning features or use of this software 20.\" must display the following acknowledgement: 21.\" This product includes software developed by the NetBSD 22.\" Foundation, Inc. and its contributors. 23.\" 4. Neither the name of The NetBSD Foundation nor the names of its 24.\" contributors may be used to endorse or promote products derived 25.\" from this software without specific prior written permission. 26.\" 27.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 28.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 29.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 30.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 31.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 32.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 33.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 34.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 35.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 36.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 37.\" POSSIBILITY OF SUCH DAMAGE. 38.\" 39.\" 40.\" Copyright (c) 1997 Marshall M. Midden 41.\" All rights reserved. 42.\" 43.\" Redistribution and use in source and binary forms, with or without 44.\" modification, are permitted provided that the following conditions 45.\" are met: 46.\" 47.\" 1. Redistributions of source code must retain the above copyright 48.\" notice, this list of conditions and the following disclaimer. 49.\" 2. Redistributions in binary form must reproduce the above copyright 50.\" notice, this list of conditions and the following disclaimer in the 51.\" documentation and/or other materials provided with the distribution. 52.\" 3. All advertising materials mentioning features or use of this software 53.\" must display the following acknowledgement: 54.\" This product includes software developed by Marshall M. Midden. 55.\" 4. The name of the author may not be used to endorse or promote products 56.\" derived from this software without specific prior written permission. 57.\" 58.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 59.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 60.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 61.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 62.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 63.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 64.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 65.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 66.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 67.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 68.\" 69.Dd March 23, 2006 70.Dt AFTERBOOT 8 71.Os 72.Sh NAME 73.Nm afterboot 74.Nd things to check after the first complete boot 75.Sh DESCRIPTION 76.Ss Starting Out 77This document attempts to list items for the system administrator 78to check and set up after the installation and first complete boot of the 79system. 80The idea is to create a list of items that can be checked off so that you have 81a warm fuzzy feeling that something obvious has not been missed. 82A basic knowledge of 83.Ux 84is assumed. 85.Pp 86Complete instructions for correcting and fixing items is not provided. 87There are manual pages and other methodologies available for doing that. 88For example, to view the man page for the 89.Xr ls 1 90command, type: 91.Bd -literal -offset indent 92.Ic man 1 ls 93.Ed 94.Pp 95Administrators will rapidly become more familiar with 96.Nx 97if they get used to using the manual pages. 98.Ss Security alerts 99By the time that you have installed your system, it is quite likely that 100bugs in the release have been found. 101All significant and easily fixed problems will be reported at 102.Pa http://www.NetBSD.org/Security/ . 103It is recommended that you check this page regularly. 104.Ss Login 105Login as 106.Dq Ic root . 107You can do so on the console, or over the network using 108.Xr ssh 1 . 109If you have enabled the ssh daemon and wish to allow root logins over 110the network, edit the 111.Pa /etc/ssh/sshd_config 112file and set 113.Cm PermitRootLogin 114to 115.Dq yes 116(see 117.Xr sshd 8 ) . 118The default is to not permit root logins over the network 119after fresh install in 120.Nx . 121.Pp 122Upon successful login on the console, you may see the message 123.Dq We recommend creating a non-root account... . 124For security reasons, it is bad practice to login as root during 125regular use and maintenance of the system. 126In fact, the system will only let you login as root on a secure 127terminal. 128By default, only the console is considered to be a secure terminal. 129Instead, administrators are encouraged to add a 130.Dq regular 131user, add said user to the 132.Dq wheel 133group, then use the 134.Xr su 1 135command when root privileges are required. 136This process is described in more detail later. 137.Ss Root password 138Change the password for the root user. 139(Note that throughout the documentation, the term 140.Dq superuser 141is a synonym for the root user.) 142Choose a password that has numbers, digits, and special characters (not space) 143as well as from the upper and lower case alphabet. 144Do not choose any word in any language. 145It is common for an intruder to use dictionary attacks. 146Type the command 147.Ic /usr/bin/passwd 148to change it. 149.Pp 150It is a good idea to always specify the full path name for both the 151.Xr passwd 1 152and 153.Xr su 1 154commands as this inhibits the possibility of files placed in your execution 155.Ev PATH 156for most shells. 157Furthermore, the superuser's 158.Ev PATH 159should never contain the current directory 160.Po Dq \&. 161.Pc . 162.Ss System date 163Check the system date with the 164.Xr date 1 165command. 166If needed, change the date, and/or change the symbolic link of 167.Pa /etc/localtime 168to the correct time zone in the 169.Pa /usr/share/zoneinfo 170directory. 171.Pp 172Examples: 173.Bl -tag -width date 174.It Cm date 200205101820 175Set the current date to May 10th, 2002 6:20pm. 176.It Cm ln -fs /usr/share/zoneinfo/Europe/Helsinki /etc/localtime 177Set the time zone to Eastern Europe Summer Time. 178.El 179.Ss Console settings 180One of the first things you will likely need to do is to set up your 181keyboard map (and maybe some other aspects about the system console). 182To change your keyboard encoding, edit the 183.Dq Va encoding 184variable found in 185.Pa /etc/wscons.conf . 186.Pp 187.Xr wscons.conf 5 188contains more information about this file. 189.Ss Check hostname 190Use the 191.Ic hostname 192command to verify that the name of your machine is correct. 193See the man page for 194.Xr hostname 1 195if it needs to be changed. 196You will also need to change the contents of the 197.Dq Va hostname 198variable in 199.Pa /etc/rc.conf 200or edit the 201.Pa /etc/myname 202file to have it stick around for the next reboot. 203Note that hostname is supposed include a domainname, and that this should 204not be confused with YP (NIS) 205.Xr domainname 1 . 206.Ss Verify network interface configuration 207The first thing to do is an 208.Ic ifconfig -a 209to see if the network interfaces are properly configured. 210Correct by editing 211.Pa /etc/ifconfig. Ns Ar interface 212or the corresponding 213.Dq Va ifconfig_ Ns Ar interface 214variable in 215.Xr rc.conf 5 216(where 217.Ar interface 218is the interface name, e.g., 219.Dq le0 ) 220and then using 221.Xr ifconfig 8 222to manually configure it 223if you do not wish to reboot. 224.Pp 225You can add new 226.Dq virtual interfaces 227by adding the required entries to 228.Pa /etc/ifconfig. Ns Ar interface . 229Read the 230.Xr ifconfig.if 5 231man page for more information on the format of 232.Pa /etc/ifconfig. Ns Ar interface 233files. 234The loopback interface will look something like: 235.Bd -literal -offset indent 236lo0: flags=8009\*[Lt]UP,LOOPBACK,MULTICAST\*[Gt] mtu 32972 237 inet 127.0.0.1 netmask 0xff000000 238 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 239 inet6 ::1 prefixlen 128 240.Ed 241.Pp 242an Ethernet interface something like: 243.Bd -literal -offset indent 244le0: flags=9863\*[Lt]UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST\*[Gt] 245 inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255 246 inet6 fe80::5ef0:f0f0%le0 prefixlen 64 scopeid 0x1 247.Ed 248.Pp 249and a PPP interface something like: 250.Bd -literal -offset indent 251ppp0: flags=8051\*[Lt]UP,POINTOPOINT,RUNNING,MULTICAST\*[Gt] 252 inet 203.3.131.108 --\*[Gt] 198.181.0.253 netmask 0xffff0000 253.Ed 254.Pp 255See 256.Xr mrouted 8 257for instructions on configuring multicast routing. 258.Pp 259See 260.Xr dhcpd 8 261for instructions on configuring interfaces with DHCP. 262.Ss Check routing tables 263Issue a 264.Ic netstat -rn 265command. 266The output will look something like: 267.Bd -literal -offset indent 268Routing tables 269 270Internet: 271Destination Gateway Flags Refs Use Mtu Interface 272default 192.168.4.254 UGS 0 11098028 - le0 273127 127.0.0.1 UGRS 0 0 - lo0 274127.0.0.1 127.0.0.1 UH 3 24 - lo0 275192.168.4 link#1 UC 0 0 - le0 276192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - le0 277192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - le0 278 279Internet6: 280Destination Gateway Flags Refs Use Mtu Interface 281::/96 ::1 UGRS 0 0 32972 lo0 =\*[Gt] 282::1 ::1 UH 4 0 32972 lo0 283::ffff:0.0.0.0/96 ::1 UGRS 0 0 32972 lo0 284fc80::/10 ::1 UGRS 0 0 32972 lo0 285fe80::/10 ::1 UGRS 0 0 32972 lo0 286fe80::%le0/64 link#1 UC 0 0 1500 le0 287fe80::%lo0/64 fe80::1%lo0 U 0 0 32972 lo0 288ff01::/32 ::1 U 0 0 32972 lo0 289ff02::%le0/32 link#1 UC 0 0 1500 le0 290ff02::%lo0/32 fe80::1%lo0 UC 0 0 32972 lo0 291.Ed 292.Pp 293The default gateway address is stored in the 294.Dq Va defaultroute 295variable in 296.Pa /etc/rc.conf , 297or in the file 298.Pa /etc/mygate . 299If you need to edit this file, a painless way to reconfigure the network 300afterwards is to issue 301.Bd -literal -offset indent 302.Ic /etc/rc.d/network restart 303.Ed 304.Pp 305Or, you may prefer to manually configure using a series of 306.Ic route add 307and 308.Ic route delete 309commands (see 310.Xr route 8 ) . 311If you run 312.Xr dhclient 8 313you will have to kill it by running 314.Bd -literal -offset indent 315.Ic /etc/rc.d/dhclient stop 316.Pp 317.Ed 318after you flush the routes. 319.Pp 320If you wish to route packets between interfaces, add one or both 321of the following directives (depending on whether IPv4 or IPv6 routing 322is required) to 323.Pa /etc/sysctl.conf : 324.Pp 325.Dl net.inet.ip.forwarding=1 326.Dl net.inet6.ip6.forwarding=1 327.Pp 328As an alternative, compile a new kernel with the 329.Cm GATEWAY 330option. 331Packets are not forwarded by default, due to RFC requirements. 332.Ss Secure Shell (ssh) 333By default, all services are disabled in a fresh 334.Nx 335installation, and ssh is no exception. 336You may wish to enable it so you can remotely control your system. 337Set 338.Dq Va sshd=yes 339in 340.Pa /etc/rc.conf 341and then starting the server with the command 342.Bd -literal -offset indent 343.Ic /etc/rc.d/sshd start 344.Ed 345.Pp 346The first time the server is started, it will generate a new keypair, 347which will be stored inside the directory 348.Pa /etc/ssh . 349.Ss BIND Name Server (DNS) 350If you are using the BIND Name Server, check the 351.Pa /etc/resolv.conf 352file. 353It may look something like: 354.Bd -literal -offset indent 355domain some.thing.dom 356nameserver 192.168.0.1 357nameserver 192.168.4.55 358search some.thing.dom. thing.dom. 359.Ed 360.Pp 361For further details, see 362.Xr resolv.conf 5 . 363Note the name service lookup order is set via 364.Xr nsswitch.conf 5 365mechanism. 366.Pp 367If using a caching name server add the line "nameserver 127.0.0.1" first. 368To get a local caching name server to run 369you will need to set "named=yes" in 370.Pa /etc/rc.conf 371and create the 372.Pa named.conf 373file in the appropriate place for 374.Xr named 8 , 375usually in 376.Pa /etc/namedb . 377The same holds true if the machine is going to be a 378name server for your domain. 379In both these cases, make sure that 380.Xr named 8 381is running 382(otherwise there are long waits for resolver timeouts). 383.Ss RPC-based network services 384Several services depend on the RPC portmapper 385.Xr rpcbind 8 386- formerly known as 387.Ic portmap 388- being running for proper operation. 389This includes YP (NIS) and NFS exports, among other services. 390To get the RPC portmapper to start automatically on boot, 391you will need to have this line in 392.Pa /etc/rc.conf : 393.Pp 394.Dl rpcbind=YES 395.Ss YP (NIS) Setup 396Check the YP domain name with the 397.Xr domainname 1 398command. 399If necessary, correct it by editing the 400.Pa /etc/defaultdomain 401file or by setting the 402.Dq Va domainname 403variable in 404.Pa /etc/rc.conf . 405The 406.Pa /etc/rc.d/network 407script reads this file on bootup to determine and set the domain name. 408You may also set the running system's domain name with the 409.Xr domainname 1 410command. 411To start YP client services, simply run 412.Ic ypbind , 413then perform the remaining 414YP activation as described in 415.Xr passwd 5 416and 417.Xr group 5 . 418.Pp 419In particular, to enable YP passwd support, you'll need to update 420.Pa /etc/nsswitch.conf 421to include 422.Dq nis 423for the 424.Dq passwd 425and 426.Dq group 427entries. 428A traditional way to accomplish the same thing is to 429add following entry to local passwd database via 430.Xr vipw 8 : 431.Bd -literal -offset indent 432.Li +:*:::::::: 433.Pp 434.Ed 435Note this entry has to be the very last one. 436This traditional way works with the default 437.Xr nsswitch.conf 5 438setting of 439.Dq passwd , 440which is 441.Dq compat . 442.Pp 443There are many more YP man pages available to help you. 444You can find more information by starting with 445.Xr yp 8 . 446.Ss Check disk mounts 447Check that the disks are mounted correctly by 448comparing the 449.Pa /etc/fstab 450file against the output of the 451.Xr mount 8 452and 453.Xr df 1 454commands. 455Example: 456.Bd -literal -offset indent 457.Li # Ic cat /etc/fstab 458/dev/sd0a / ffs rw 1 1 459/dev/sd0b none swap sw 460/dev/sd0e /usr ffs rw 1 2 461/dev/sd0f /var ffs rw 1 3 462/dev/sd0g /tmp ffs rw 1 4 463/dev/sd0h /home ffs rw 1 5 464 465.Li # Ic mount 466/dev/sd0a on / type ffs (local) 467/dev/sd0e on /usr type ffs (local) 468/dev/sd0f on /var type ffs (local) 469/dev/sd0g on /tmp type ffs (local) 470/dev/sd0h on /home type ffs (local) 471 472.Li # Ic df 473Filesystem 1024-blocks Used Avail Capacity Mounted on 474/dev/sd0a 22311 14589 6606 69% / 475/dev/sd0e 203399 150221 43008 78% /usr 476/dev/sd0f 10447 682 9242 7% /var 477/dev/sd0g 18823 2 17879 0% /tmp 478/dev/sd0h 7519 5255 1888 74% /home 479 480.Li # Ic pstat -s 481Device 512-blocks Used Avail Capacity Priority 482/dev/sd0b 131072 84656 46416 65% 0 483.Ed 484.Pp 485Edit 486.Pa /etc/fstab 487and use the 488.Xr mount 8 489and 490.Xr umount 8 491commands as appropriate. 492Refer to the above example and 493.Xr fstab 5 494for information on the format of this file. 495.Pp 496You may wish to do NFS mounts now too, or you can do them later. 497.Ss Concatenated disks (ccd) 498If you are using 499.Xr ccd 4 500concatenated disks, edit 501.Pa /etc/ccd.conf . 502You may wish to take a look to 503.Xr ccdconfig 8 504for more information about this file. 505Use the 506.Ic ccdconfig -U 507command to unload and the 508.Ic ccdconfig -C 509command to create tables internal to the kernel for the concatenated disks. 510You then 511.Xr mount 8 , 512.Xr umount 8 , 513and edit 514.Pa /etc/fstab 515as needed. 516.Ss Automounter daemon (AMD) 517To use the 518.Xr amd 8 519automounter, create the 520.Pa /etc/amd 521directory, copy example config files from 522.Pa /usr/share/examples/amd 523to 524.Pa /etc/amd 525and customize them as needed. 526Alternatively, you can get your maps with YP. 527.Ss Clock synchronization 528In order to make sure the system clock is synchronized 529to that of a publicly accessible NTP server, 530make sure that 531.Pa /etc/rc.conf 532contains the following: 533.Pp 534.Dl ntpdate=yes 535.Dl ntpd=yes 536.Pp 537See 538.Xr date 1 , 539.Xr ntpdate 8 , 540.Xr ntpd 8 , 541.Xr rdate 8 , 542and 543.Xr timed 8 544for more information on setting the system's date. 545.Sh CHANGING /etc FILES 546The system should be usable now, but you may wish to do more customizing, 547such as adding users, etc. 548Many of the following sections may be skipped 549if you are not using that package (for example, skip the 550.Sx Kerberos 551section if you won't be using Kerberos). 552We suggest that you 553.Ic cd /etc 554and edit most of the files in that directory. 555.Pp 556Note that the 557.Pa /etc/motd 558file is modified by 559.Pa /etc/rc.d/motd 560whenever the system is booted. 561To keep any custom message intact, ensure that you leave two blank lines 562at the top, or your message will be overwritten. 563.Ss Add new users 564To add new users and groups, there are 565.Xr useradd 8 566and 567.Xr groupadd 8 , 568see also 569.Xr user 8 570for forther programs for user and group manipulation. 571You may use 572.Xr vipw 8 573to add users to the 574.Pa /etc/passwd 575file 576and edit 577.Pa /etc/group 578by hand to add new groups. 579The manual page for 580.Xr su 1 , 581tells you to make sure to put people in 582the 583.Sq wheel 584group if they need root access (non-Kerberos). 585For example: 586.Bd -literal -offset indent 587wheel:*:0:root,myself 588.Ed 589.Pp 590Follow instructions for 591.Xr kerberos 8 592if using 593Kerberos 594for authentication. 595.Ss System boot scripts and /etc/rc.local 596.Pa /etc/rc 597and the 598.Pa /etc/rc.d/* 599scripts are invoked at boot time after single user mode has exited, 600and at shutdown. 601The whole process is controlled by the master script 602.Pa /etc/rc . 603This script should not be changed by administrators. 604.Pp 605The directory 606.Pa /etc/rc.d 607contains a serie of scripts used at startup/shutdown, called by 608.Pa /etc/rc . 609.Pa /etc/rc 610is in turn influenced by the configuration variables present in 611.Pa /etc/rc.conf . 612.Pp 613The script 614.Pa /etc/rc.local 615is run as the last thing during multiuser boot, and is provided 616to allow any other local hooks necessary for the system. 617.Ss rc.conf 618To enable or disable various services on system startup, 619corresponding entries can be made in 620.Pa /etc/rc.conf . 621You can take a look at 622.Pa /etc/defaults/rc.conf 623to see a list of default system variables, which you can override in 624.Pa /etc/rc.conf . 625Note you are 626.Em not 627supposed to change 628.Pa /etc/defaults/rc.conf 629directly, edit only 630.Pa /etc/rc.conf . 631See 632.Xr rc.conf 5 633for further information. 634.Pp 635If you've installed X, you may want to turn on 636.Xr xdm 1 , 637the X Display Manager. 638To do this, set the variable 639.Dq xdm 640to yes in 641.Pa /etc/rc.conf , 642i.e.: 643.Dq xdm=yes 644.Ss Printers 645Edit 646.Pa /etc/printcap 647and 648.Pa /etc/hosts.lpd 649to get any printers set up. 650Consult 651.Xr lpd 8 652and 653.Xr printcap 5 654if needed. 655.Ss Tighten up security 656In 657.Pa /etc/inetd.conf 658comment out any extra entries you do not need, and only add things 659that are really needed. 660Note that by default all services are disabled for security reasons. 661.Ss Kerberos 662If you are going to use Kerberos for authentication, 663see 664.Xr kerberos 8 665and 666.Dq info heimdal 667for more information. 668If you already have a Kerberos master, change directory to 669.Pa /etc/kerberosV 670and configure. 671Remember to get a 672.Pa srvtab 673from the master so that the remote commands work. 674.Ss Mail Aliases 675Check 676.Pa /etc/mail/aliases 677and update appropriately if you want e-mail to be routed 678to non-local address or to different users. 679.Pp 680Run 681.Xr newaliases 1 682after changes. 683.Ss Sendmail 684.Nx 685ships with default 686.Pa /etc/mail/sendmail.cf 687and 688.Pa /etc/mail/submit.cf 689files that will work for simple installations; they were generated from 690.Pa netbsd-proto.mc 691and 692.Pa netbsd-msp.mc 693in 694.Pa /usr/share/sendmail/cf . 695Please see 696.Pa /usr/share/sendmail/README 697and 698.Pa /usr/share/doc/smm/08.sendmailop/op.me 699(run 700.Ic make 701there to produce a PostScript version) 702for information on generating your own sendmail configuration files. 703.Pa /etc/mailer.conf 704is configured to use Sendmail binaries by default and 705.Xr sendmail 8 706will start by default if no other changes to the mail system are made. 707See 708.Xr mailer.conf 5 709and 710.Xr rc.conf 5 711for more details. 712.Ss Postfix 713.Nx 714comes also with Postfix in the base system. 715You may wish to set it up in favor of sendmail. 716Take a look to 717.Pa /etc/postfix/main.cf 718and enable the daemon in 719.Pa /etc/rc.conf 720using "postfix=yes". 721It is very important to configure 722.Pa /etc/mailer.conf 723to point to Postfix binaries. 724.Ss DHCP server 725If this is a 726DHCP 727server, edit 728.Pa /etc/dhcpd.conf 729and 730.Pa /etc/dhcpd.interfaces 731as needed. 732You will have to make sure 733.Pa /etc/rc.conf 734has "dhcpd=yes" 735or run 736.Xr dhcpd 8 737manually. 738.Ss Bootparam server 739If this is a 740Bootparam 741server, edit 742.Pa /etc/bootparams 743as needed. 744You will have to turn it on in 745.Pa /etc/rc.conf 746by adding "bootparamd=yes". 747.Ss NFS server 748If this is an NFS server, make sure 749.Pa /etc/rc.conf 750has: 751.Bd -literal -offset indent 752nfs_server=yes 753mountd=yes 754rpcbind=yes 755.Ed 756.Pp 757Edit 758.Pa /etc/exports 759and get it correct. 760After this, you can start the server by issuing: 761.Bd -literal -offset indent 762.Ic /etc/rc.d/rpcbind start 763.Ic /etc/rc.d/mountd start 764.Ic /etc/rc.d/nfsd start 765.Ed 766which will also start dependencies. 767.Ss HP remote boot server 768Edit 769.Pa /etc/rbootd.conf 770if needed for remote booting. 771If you do not have HP computers doing remote booting, do not enable this. 772.Ss Daily, weekly, monthly scripts 773Look at and possibly edit the 774.Pa /etc/daily.conf , /etc/weekly.conf , 775and 776.Pa /etc/monthly.conf 777configuration files. 778You can check which values you can set by looking 779to their matching files in 780.Pa /etc/defaults . 781Your site specific things should go into 782.Pa /etc/daily.local , /etc/weekly.local , 783and 784.Pa /etc/monthly.local . 785.Pp 786These scripts have been limited so as to keep the system running without 787filling up disk space from normal running processes and database updates. 788(You probably do not need to understand them.) 789.Ss Other files in /etc 790Look at the other files in 791.Pa /etc 792and edit them as needed. 793(Do not edit files ending in 794.Pa .db 795\(em like 796.Pa pwd.db , spwd.db , 797nor 798.Pa localtime , 799nor 800.Pa rmt , 801nor any directories.) 802.Ss Crontab (background running processes) 803Check what is running by typing 804.Ic crontab -l 805as root 806and see if anything unexpected is present. 807Do you need anything else? 808Do you wish to change things? 809For example, if you do not 810like root getting standard output of the daily scripts, and want only 811the security scripts that are mailed internally, you can type 812.Ic crontab -e 813and change some of the lines to read: 814.Bd -literal -offset indent 81530 1 * * * /bin/sh /etc/daily 2\*[Gt]\*[Am]1 \*[Gt] /var/log/daily.out 81630 3 * * 6 /bin/sh /etc/weekly 2\*[Gt]\*[Am]1 \*[Gt] /var/log/weekly.out 81730 5 1 * * /bin/sh /etc/monthly 2\*[Gt]\*[Am]1 \*[Gt] /var/log/monthly.out 818.Ed 819.Pp 820See 821.Xr crontab 5 . 822.Ss Next day cleanup 823After the first night's security run, change ownerships and permissions 824on files, directories, and devices; root should have received mail 825with subject: "\*[Lt]hostname\*[Gt] daily insecurity output.". 826This mail contains 827a set of security recommendations, presented as a list looking like this: 828.Bd -literal -offset indent 829var/mail: 830 permissions (0755, 0775) 831etc/daily: 832 user (0, 3) 833.Ed 834.Pp 835The best bet is to follow the advice in that list. 836The recommended setting is the first item in parentheses, while 837the current setting is the second one. 838This list is generated by 839.Xr mtree 8 840using 841.Pa /etc/mtree/special . 842Use 843.Xr chmod 1 , 844.Xr chgrp 1 , 845and 846.Xr chown 8 847as needed. 848.Ss Packages 849Install your own packages. 850The 851.Nx 852packages collection, pkgsrc, includes a large set of third-party software. 853A lot of it is available as binary packages that you can download from 854.Pa ftp://ftp.NetBSD.org/pub/NetBSD/packages/ 855or a mirror, and install using 856.Xr pkg_add 1 . 857See 858.Pa http://www.NetBSD.org/Documentation/pkgsrc/ 859and 860.Xr packages 7 861for more details. 862.Pp 863Copy vendor binaries and install them. 864You will need to install any shared libraries, etc. 865(Hint: 866.Ic man -k compat 867to find out how to install and use compatibility mode.) 868.Pp 869There is also other third-party software that is available 870in source form only, either because it has not been ported to 871.Nx 872yet, because licensing restrictions make binary redistribution 873impossible, or simply because you want to build your own binaries. 874Sometimes checking the mailing lists for 875past problems that people have encountered will result in a fix posted. 876.Ss Check the running system 877You can use 878.Xr ps 1 , 879.Xr netstat 1 , 880and 881.Xr fstat 1 882to check on running processes, network connections, and opened files, 883respectively. 884Other tools you may find useful are 885.Xr systat 1 886and 887.Xr top 1 . 888.Sh COMPILING A KERNEL 889Note: 890The standard 891.Nx 892kernel configuration (GENERIC) is suitable for most purposes. 893.Pp 894First, review the system message buffer in 895.Pa /var/run/dmesg.boot 896and by using the 897.Xr dmesg 8 898command to find out information on your system's devices as probed by the 899kernel at boot. 900In particular, note which devices were not configured. 901This information will prove useful when editing kernel configuration files. 902.Pp 903To compile a kernel inside a writable source tree, do the following: 904.Bd -literal -offset indent 905$ cd /usr/src/sys/arch/SOMEARCH/conf 906$ cp GENERIC SOMEFILE (only the first time) 907$ vi SOMEFILE (adapt to your needs) 908$ config SOMEFILE 909$ cd ../compile/SOMEFILE 910$ make depend 911$ make 912.Ed 913.Pp 914where 915.Ar SOMEARCH 916is the architecture (e.g., i386), and 917.Ar SOMEFILE 918should be a name indicative of a particular configuration (often 919that of the hostname). 920.Pp 921If you are building your kernel again, before you do a 922.Ic make 923you should do a 924.Ic make clean 925after making changes to your kernel options. 926.Pp 927After either of these two methods, you can place the new kernel (called 928.Pa netbsd ) 929in 930.Pa / 931(i.e., 932.Pa /netbsd ) 933by issuing 934.Ic make install 935and the system will boot it next time. 936The old kernel is stored as 937.Pa /onetbsd 938so you can boot it in case of failure. 939.Pp 940If you are using toolchain to build your kernel, you will also need to 941build a new set of toolchain binaries. 942You can do it by changing into 943.Pa /usr/src 944and issuing: 945.Bd -literal -offset indent 946$ cd /usr/src 947$ K=sys/arch/`uname -m`/conf 948$ cp $K/GENERIC $K/SOMEFILE 949$ vi $K/SOMEFILE (adapt to your needs) 950$ ./build.sh tools 951$ ./build.sh kernel=SOMEFILE 952.Ed 953.Sh SEE ALSO 954.Xr chgrp 1 , 955.Xr chmod 1 , 956.Xr config 1 , 957.Xr crontab 1 , 958.Xr date 1 , 959.Xr df 1 , 960.Xr domainname 1 , 961.Xr hostname 1 , 962.Xr make 1 , 963.Xr man 1 , 964.Xr netstat 1 , 965.Xr newaliases 1 , 966.Xr passwd 1 , 967.Xr su 1 , 968.Xr ccd 4 , 969.Xr aliases 5 , 970.Xr crontab 5 , 971.Xr exports 5 , 972.Xr fstab 5 , 973.Xr group 5 , 974.Xr krb.conf 5 , 975.Xr krb.realms 5 , 976.Xr mailer.conf 5 , 977.Xr passwd 5 , 978.Xr rc.conf 5 , 979.Xr resolv.conf 5 , 980.Xr hostname 7 , 981.Xr packages 7 , 982.Xr adduser 8 , 983.Xr amd 8 , 984.Xr bootparamd 8 , 985.Xr ccdconfig 8 , 986.Xr chown 8 , 987.Xr dhcpd 8 , 988.Xr ifconfig 8 , 989.Xr inetd 8 , 990.Xr kerberos 8 , 991.Xr mount 8 , 992.Xr mrouted 8 , 993.Xr mtree 8 , 994.Xr named 8 , 995.Xr rbootd 8 , 996.Xr rc 8 , 997.Xr rmt 8 , 998.Xr route 8 , 999.Xr umount 8 , 1000.Xr vipw 8 , 1001.Xr ypbind 8 1002.Sh HISTORY 1003This document first appeared in 1004.Ox 2.2 . 1005It has been adapted to 1006.Nx 1007and first appeared in 1008.Nx 2.0 . 1009