1.\" $OpenBSD: afterboot.8,v 1.168 2020/12/29 12:28:23 mglocker Exp $ 2.\" 3.\" Copyright (c) 1997 Marshall M. Midden 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. All advertising materials mentioning features or use of this software 16.\" must display the following acknowledgement: 17.\" This product includes software developed by Marshall M. Midden. 18.\" 4. The name of the author may not be used to endorse or promote products 19.\" derived from this software without specific prior written permission. 20.\" 21.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31.\" 32.Dd $Mdocdate: December 29 2020 $ 33.Dt AFTERBOOT 8 34.\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu 35.Os 36.Sh NAME 37.Nm afterboot 38.Nd things to check after the first complete boot 39.Sh DESCRIPTION 40.Ss Starting out 41This document attempts to list items for the system administrator 42to check and set up after the installation and first complete boot of the 43system. 44The idea is to create a list of items that can be checked off so that you have 45a warm fuzzy feeling that something obvious has not been missed. 46A basic knowledge of 47.Ux 48is assumed, otherwise type: 49.Pp 50.Dl $ help 51.Pp 52Complete instructions for correcting and fixing items are not provided. 53There are manual pages and other methodologies available for doing that. 54For example, to view the man page for the 55.Xr ls 1 56command, type: 57.Pp 58.Dl $ man 1 ls 59.Pp 60Administrators will rapidly become more familiar with 61.Ox 62if they get used to using the high quality manual pages. 63.Pp 64Some base programs and subsystems also come with sample configuration 65files in 66.Pa /etc/examples . 67.Ss Errata 68By the time that you have installed your system, it is possible that 69bugs in the release have been found. 70Security or reliability fixes can be found at 71.Lk https://www.openbsd.org/errata.html , 72and can be installed using 73.Xr syspatch 8 . 74.Ss Login 75Log in on the console, or over the network using 76.Xr ssh 1 . 77For security reasons, it is bad practice to log in as root during regular use 78and maintenance of the system. 79Instead, administrators are encouraged to add a 80.Dq regular 81user, add said user to the 82.Dq wheel 83group, then use the 84.Xr su 1 85and 86.Xr doas 1 87commands when root privileges are required. 88.Pp 89The installation process provides an option to set up a user account. 90By default, accounts created via this method are automatically added to 91the 92.Dq wheel 93group. 94If that option was not used, see the paragraph 95.Sx Add new users 96below. 97.Pp 98To deny root logins over the network, edit the 99.Pa /etc/ssh/sshd_config 100file and set 101.Cm PermitRootLogin 102to 103.Dq no 104(see 105.Xr sshd_config 5 ) . 106.Ss Root password 107Change the password for the root user. 108(Note that throughout the documentation, the term 109.Dq superuser 110is a synonym for the root user.) 111Choose a password that has digits and special characters 112as well as from the upper and lower case alphabet. 113Do not choose any word in any language. 114It is common for an intruder to use dictionary attacks. 115Type the following command to change it: 116.Pp 117.Dl # passwd root 118.Pp 119To avoid the possibility of rogue files placed in 120the superuser's 121.Ev PATH , 122it should never contain the current directory 123.Pq Dq \&. . 124.Ss System date 125.Xr ntpd 8 126is used to automatically synchronize clocks with remote NTP servers. 127You can use 128.Xr ntpctl 8 129to check the status. 130To change the NTP server, see 131.Xr ntpd.conf 5 . 132.Pp 133Check the system date with the 134.Xr date 1 135command. 136If needed, change the date, and/or change the symbolic link of 137.Pa /etc/localtime 138to the correct time zone in the 139.Pa /usr/share/zoneinfo 140directory. 141.Pp 142Examples: 143.Pp 144Set the current date to January 27th, 2016 3:04pm: 145.Dl # date 201601271504 146.Pp 147Set the time zone to Atlantic Standard Time: 148.Dl # ln -fs /usr/share/zoneinfo/Canada/Atlantic /etc/localtime 149.Ss Check hostname 150Use the 151.Ic hostname 152command to verify that the name of your machine is correct. 153See the man page for 154.Xr hostname 1 155if it needs to be changed. 156You will also need to edit the 157.Pa /etc/myname 158file to have it stick around for the next reboot. 159.Ss Verify network interface configuration and routing tables 160The first thing to do is an 161.Ic ifconfig -a 162to see if the network interfaces are properly configured. 163Correct by editing 164.Pa /etc/hostname. Ns Ar interface 165(where 166.Ar interface 167is the interface name, e.g., 168.Dq em0 ) 169and then using 170.Xr ifconfig 8 171to manually configure it 172if you do not wish to reboot. 173Read the 174.Xr hostname.if 5 175man page for more information on the format of 176.Pa /etc/hostname. Ns Ar interface 177files. 178.Pp 179See 180.Xr multicast 4 181for instructions on configuring multicast routing. 182See 183.Xr hostname.if 5 184for instructions on configuring interfaces with DHCP. 185.Pp 186Routing tables can be viewed by issuing a 187.Ic netstat -rn 188command. 189The default gateway address is stored in the 190.Pa /etc/mygate 191file. 192If you need to edit this file, a painless way to reconfigure the network 193afterwards is 194.Ic route flush 195followed by a 196.Ic sh -x /etc/netstart 197command. 198Or, you may prefer to manually configure using a series of 199.Ic route add 200and 201.Ic route delete 202commands (see 203.Xr route 8 ) . 204If you run 205.Xr dhclient 8 206you will have to kill it by running 207.Ic pkill dhclient 208after you flush the routes. 209.Pp 210If you wish to route packets between interfaces, add one or both 211of the following directives (depending on whether IPv4 or IPv6 routing 212is required) to 213.Pa /etc/sysctl.conf : 214.Pp 215.Dl net.inet.ip.forwarding=1 216.Dl net.inet6.ip6.forwarding=1 217.Pp 218Packets are not forwarded by default, due to RFC requirements. 219.Ss Check DNS 220Use 221.Xr host 1 222or 223.Xr dig 1 224to check that domain name resolution is working properly. 225.Pp 226Most likely, the IP address of at least one domain name server 227was added to 228.Xr resolv.conf 5 229while installing the system. 230If DHCP is in use, it will overwrite 231.Pa /etc/resolv.conf 232every time 233.Xr dhclient 8 234is run but 235.Pa /etc/resolv.conf.tail 236can be used to add options and extra name servers to those received 237dynamically. 238.Pp 239A 240.Xr hosts 5 241file can be used if there is a need for system specific name 242resolution entries. 243.Ss Check disk mounts 244Check that the disks are mounted correctly by 245comparing the 246.Pa /etc/fstab 247file against the output of the 248.Xr mount 8 249and 250.Xr df 1 251commands. 252Example: 253.Bd -literal -offset indent 254# cat /etc/fstab 255/dev/sd0a / ffs rw 1 1 256/dev/sd0d /usr ffs rw,nodev 1 2 257/dev/sd0e /var ffs rw,nodev,nosuid 1 3 258/dev/sd0g /tmp ffs rw,nodev,nosuid 1 4 259/dev/sd0h /home ffs rw,nodev,nosuid 1 5 260 261# mount 262/dev/sd0a on / type ffs (local) 263/dev/sd0d on /usr type ffs (local, nodev) 264/dev/sd0e on /var type ffs (local, nodev, nosuid) 265/dev/sd0g on /tmp type ffs (local, nodev, nosuid) 266/dev/sd0h on /home type ffs (local, nodev, nosuid) 267 268# df 269Filesystem 1024-blocks Used Avail Capacity Mounted on 270/dev/sd0a 22311 14589 6606 69% / 271/dev/sd0d 203399 150221 43008 78% /usr 272/dev/sd0e 10447 682 9242 7% /var 273/dev/sd0g 18823 2 17879 0% /tmp 274/dev/sd0h 7519 5255 1888 74% /home 275 276# pstat -s 277Device 512-blocks Used Avail Capacity Priority 278/dev/sd0b 131072 84656 46416 65% 0 279.Ed 280.Pp 281Edit 282.Pa /etc/fstab 283and use the 284.Xr mount 8 285and 286.Xr umount 8 287commands as appropriate. 288Refer to the above example and 289.Xr fstab 5 290for information on the format of this file. 291.Pp 292You may wish to do NFS partitions now too, or you can do them later. 293.Ss Check the running system 294You can use 295.Xr ps 1 , 296.Xr netstat 1 , 297and 298.Xr fstat 1 299to check on running processes, network connections, and opened files, 300respectively. 301.Sh FURTHER CHANGES 302The system should be usable now, but you may wish to do more customizing, 303such as adding users, etc. 304We suggest that you 305.Ic cd /etc 306and edit any files in that directory as necessary. 307.Pp 308Note that the 309.Pa /etc/motd 310file is modified by 311.Pa /etc/rc 312whenever the system is booted. 313To keep any custom message intact, ensure that you leave two blank lines 314at the top, or your message will be overwritten. 315.Ss Add new users 316Add users. 317There is an 318.Xr adduser 8 319script. 320You may use 321.Xr vipw 8 322to add users to the 323.Pa /etc/passwd 324file 325and edit 326.Pa /etc/group 327by hand to add new groups. 328You may also wish to edit 329.Pa /etc/login.conf 330and tune some of the limits documented in 331.Xr login.conf 5 . 332The manual page for 333.Xr su 1 334tells you to make sure to put people in 335the 336.Sq wheel 337group if they need root access. 338For example: 339.Pp 340.Dl wheel:*:0:root,myself 341.Ss System command scripts 342The 343.Pa /etc/rc.*\& 344scripts are invoked at boot time, after single-user mode has exited, 345and at shutdown. 346The whole process is controlled, more or less, by the master script 347.Pa /etc/rc . 348This script should not be changed by administrators. 349.Pp 350.Pa /etc/rc 351is in turn influenced by the configuration variables present in 352.Pa /etc/rc.conf . 353Again, this script should not be changed by administrators: 354site-specific changes should be made to 355.Pq freshly created if necessary 356.Pa /etc/rc.conf.local 357or by using the 358.Xr rcctl 8 359utility. 360.Pp 361Any commands which should be run before the system sets its 362secure level should be made to 363.Pa /etc/rc.securelevel , 364and commands to be run after the system sets its 365secure level should be made to 366.Pa /etc/rc.local . 367Commands to be run before system shutdown should be set in 368.Pa /etc/rc.shutdown . 369.Pp 370For more information about system startup/shutdown files, see 371.Xr rc 8 , 372.Xr rc.conf 8 , 373.Xr securelevel 7 , 374and 375.Xr rc.shutdown 8 . 376.Pp 377If you've installed X, you may want to turn on 378.Xr xenodm 1 , 379the X Display Manager. 380To do this, change the value of 381.Va xenodm_flags 382in 383.Pa /etc/rc.conf.local . 384.Ss Set keyboard type 385Some architectures permit keyboard type control. 386Use the 387.Xr kbd 8 388command to change the keyboard encoding. 389.Ic kbd -l 390will list all available encodings. 391.Ic kbd xxx 392will select the 393.Ic xxx 394encoding. 395Store the encoding in 396.Pa /etc/kbdtype 397to make sure it is set automatically at boot time. 398.Ss Printers 399Edit 400.Pa /etc/printcap 401and 402.Pa /etc/hosts.lpd 403to get any printers set up. 404Consult 405.Xr lpd 8 406and 407.Xr printcap 5 408if needed. 409.Ss Audio and video recording 410The 411.Xr audio 4 412and 413.Xr video 4 414drivers by default record only silence and blanked images. 415Normal recording can be enabled by adding the following directives to 416.Xr sysctl.conf 5 : 417.Bd -literal -offset indent 418kern.audio.record=1 419kern.video.record=1 420.Ed 421.Ss Mail aliases 422Edit 423.Pa /etc/mail/aliases 424and set the three standard aliases to go to either a mailing list, or 425the system administrator. 426.Bd -literal -offset indent 427# Well-known aliases -- these should be filled in! 428root: sysadm 429manager: root 430dumper: root 431.Ed 432.Ss Mail 433The default mail agent on 434.Ox 435is 436.Xr smtpd 8 . 437Details on how to configure an alternative mailer are documented in 438.Xr mailer.conf 5 . 439.Pp 440.Ox 441ships with a default 442.Pa /etc/mail/smtpd.conf 443file that will work for simple installations. 444See 445.Xr smtpd.conf 5 446for information on configuring more complex setups. 447For the default installation, 448.Xr smtpd 8 449is configured to only accept connections from the local host. 450This makes it possible to send mail locally, but not receive mail from remote 451servers, which is ideal if you have one central incoming mail machine and 452several clients. 453To cause smtpd to accept external network connections, modify the 454.Ic listen on 455directive in 456.Pa /etc/mail/smtpd.conf 457to include the interfaces to listen on. 458.Ss Daily, weekly, monthly scripts 459Review 460.Xr daily 8 461to understand what the periodic system maintenance scripts do and 462how to customize them: 463For example, to enable 464.Ev ROOTBACKUP 465or to add local maintenance code to 466.Pa /etc/daily.local , /etc/weekly.local , 467or 468.Pa /etc/monthly.local . 469.Ss Tighten up security 470You might wish to tighten up security more by editing 471.Pa /etc/fbtab 472as when installing X. 473Look at the other files in 474.Pa /etc 475and edit them as needed. 476(Do not edit files ending in 477.Pa .db 478\(em like 479.Pa pwd.db , spwd.db , 480nor 481.Pa localtime , 482nor 483.Pa rmt , 484nor any directories.) 485.Ss Crontab (background running processes) 486Check what is running by typing 487.Ic crontab -l 488as root 489and see if anything unexpected is present. 490Do you need anything else? 491Do you wish to change things? 492See 493.Xr crontab 5 . 494.Ss Next day cleanup 495After the first night's 496.Xr security 8 497run, change ownerships and permissions 498on files, directories, and devices; root may have received mail 499with subject: "<hostname> daily insecurity output". 500This mail contains a set of security recommendations, 501presented as a list looking something like this: 502.Bd -literal -offset indent 503var/mail: 504 permissions (0755, 0775) 505etc/daily: 506 user (0, 3) 507.Ed 508.Pp 509The best bet is to follow the advice in that list. 510The recommended setting is the first item in parentheses, while 511the current setting is the second one. 512This list is generated by 513.Xr mtree 8 514using 515.Pa /etc/mtree/special . 516Use 517.Xr chmod 1 , 518.Xr chgrp 1 , 519and 520.Xr chown 8 521as needed. 522.Ss Daemons 523Enable/disable any daemon processes as necessary. 524.Xr intro 8 525contains a comprehensive guide to the various daemons available on the 526.Ox 527system. 528.Ss Packages 529Install your own packages. 530The 531.Ox 532ports collection includes a large set of third-party software. 533A lot of it is available as binary packages that you can install using 534.Xr pkg_add 1 . 535See 536.Xr ports 7 537and 538.Xr packages 7 539for more details. 540To start daemons installed from packages, see 541.Xr rc.d 8 . 542.Pp 543There is also other third-party software that is available 544in source form only, either because it has not been ported to 545.Ox 546yet, or because licensing restrictions make binary redistribution 547impossible. 548Sometimes checking the mailing lists for 549past problems that people have encountered will result in a fix posted. 550.Ss Compiling a kernel 551Information on building and modifying kernels 552is contained within 553.Xr config 8 . 554.Sh SEE ALSO 555.Xr doas 1 , 556.Xr ksh 1 , 557.Xr man 1 , 558.Xr pkg_add 1 , 559.Xr ps 1 , 560.Xr vi 1 , 561.Xr multicast 4 , 562.Xr hier 7 , 563.Xr config 8 , 564.Xr dmesg 8 , 565.Xr ifconfig 8 , 566.Xr intro 8 , 567.Xr rcctl 8 , 568.Xr sysctl 8 569.Sh HISTORY 570This document first appeared in 571.Ox 2.2 . 572