xref: /openbsd-src/share/man/man8/afterboot.8 (revision 46035553bfdd96e63c94e32da0210227ec2e3cf1)
1.\"	$OpenBSD: afterboot.8,v 1.168 2020/12/29 12:28:23 mglocker Exp $
2.\"
3.\" Copyright (c) 1997 Marshall M. Midden
4.\" All rights reserved.
5.\"
6.\" Redistribution and use in source and binary forms, with or without
7.\" modification, are permitted provided that the following conditions
8.\" are met:
9.\"
10.\" 1. Redistributions of source code must retain the above copyright
11.\"    notice, this list of conditions and the following disclaimer.
12.\" 2. Redistributions in binary form must reproduce the above copyright
13.\"    notice, this list of conditions and the following disclaimer in the
14.\"    documentation and/or other materials provided with the distribution.
15.\" 3. All advertising materials mentioning features or use of this software
16.\"    must display the following acknowledgement:
17.\"	This product includes software developed by Marshall M. Midden.
18.\" 4. The name of the author may not be used to endorse or promote products
19.\"    derived from this software without specific prior written permission.
20.\"
21.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31.\"
32.Dd $Mdocdate: December 29 2020 $
33.Dt AFTERBOOT 8
34.\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu
35.Os
36.Sh NAME
37.Nm afterboot
38.Nd things to check after the first complete boot
39.Sh DESCRIPTION
40.Ss Starting out
41This document attempts to list items for the system administrator
42to check and set up after the installation and first complete boot of the
43system.
44The idea is to create a list of items that can be checked off so that you have
45a warm fuzzy feeling that something obvious has not been missed.
46A basic knowledge of
47.Ux
48is assumed, otherwise type:
49.Pp
50.Dl $ help
51.Pp
52Complete instructions for correcting and fixing items are not provided.
53There are manual pages and other methodologies available for doing that.
54For example, to view the man page for the
55.Xr ls 1
56command, type:
57.Pp
58.Dl $ man 1 ls
59.Pp
60Administrators will rapidly become more familiar with
61.Ox
62if they get used to using the high quality manual pages.
63.Pp
64Some base programs and subsystems also come with sample configuration
65files in
66.Pa /etc/examples .
67.Ss Errata
68By the time that you have installed your system, it is possible that
69bugs in the release have been found.
70Security or reliability fixes can be found at
71.Lk https://www.openbsd.org/errata.html ,
72and can be installed using
73.Xr syspatch 8 .
74.Ss Login
75Log in on the console, or over the network using
76.Xr ssh 1 .
77For security reasons, it is bad practice to log in as root during regular use
78and maintenance of the system.
79Instead, administrators are encouraged to add a
80.Dq regular
81user, add said user to the
82.Dq wheel
83group, then use the
84.Xr su 1
85and
86.Xr doas 1
87commands when root privileges are required.
88.Pp
89The installation process provides an option to set up a user account.
90By default, accounts created via this method are automatically added to
91the
92.Dq wheel
93group.
94If that option was not used, see the paragraph
95.Sx Add new users
96below.
97.Pp
98To deny root logins over the network, edit the
99.Pa /etc/ssh/sshd_config
100file and set
101.Cm PermitRootLogin
102to
103.Dq no
104(see
105.Xr sshd_config 5 ) .
106.Ss Root password
107Change the password for the root user.
108(Note that throughout the documentation, the term
109.Dq superuser
110is a synonym for the root user.)
111Choose a password that has digits and special characters
112as well as from the upper and lower case alphabet.
113Do not choose any word in any language.
114It is common for an intruder to use dictionary attacks.
115Type the following command to change it:
116.Pp
117.Dl # passwd root
118.Pp
119To avoid the possibility of rogue files placed in
120the superuser's
121.Ev PATH ,
122it should never contain the current directory
123.Pq Dq \&. .
124.Ss System date
125.Xr ntpd 8
126is used to automatically synchronize clocks with remote NTP servers.
127You can use
128.Xr ntpctl 8
129to check the status.
130To change the NTP server, see
131.Xr ntpd.conf 5 .
132.Pp
133Check the system date with the
134.Xr date 1
135command.
136If needed, change the date, and/or change the symbolic link of
137.Pa /etc/localtime
138to the correct time zone in the
139.Pa /usr/share/zoneinfo
140directory.
141.Pp
142Examples:
143.Pp
144Set the current date to January 27th, 2016 3:04pm:
145.Dl # date 201601271504
146.Pp
147Set the time zone to Atlantic Standard Time:
148.Dl # ln -fs /usr/share/zoneinfo/Canada/Atlantic /etc/localtime
149.Ss Check hostname
150Use the
151.Ic hostname
152command to verify that the name of your machine is correct.
153See the man page for
154.Xr hostname 1
155if it needs to be changed.
156You will also need to edit the
157.Pa /etc/myname
158file to have it stick around for the next reboot.
159.Ss Verify network interface configuration and routing tables
160The first thing to do is an
161.Ic ifconfig -a
162to see if the network interfaces are properly configured.
163Correct by editing
164.Pa /etc/hostname. Ns Ar interface
165(where
166.Ar interface
167is the interface name, e.g.,
168.Dq em0 )
169and then using
170.Xr ifconfig 8
171to manually configure it
172if you do not wish to reboot.
173Read the
174.Xr hostname.if 5
175man page for more information on the format of
176.Pa /etc/hostname. Ns Ar interface
177files.
178.Pp
179See
180.Xr multicast 4
181for instructions on configuring multicast routing.
182See
183.Xr hostname.if 5
184for instructions on configuring interfaces with DHCP.
185.Pp
186Routing tables can be viewed by issuing a
187.Ic netstat -rn
188command.
189The default gateway address is stored in the
190.Pa /etc/mygate
191file.
192If you need to edit this file, a painless way to reconfigure the network
193afterwards is
194.Ic route flush
195followed by a
196.Ic sh -x /etc/netstart
197command.
198Or, you may prefer to manually configure using a series of
199.Ic route add
200and
201.Ic route delete
202commands (see
203.Xr route 8 ) .
204If you run
205.Xr dhclient 8
206you will have to kill it by running
207.Ic pkill dhclient
208after you flush the routes.
209.Pp
210If you wish to route packets between interfaces, add one or both
211of the following directives (depending on whether IPv4 or IPv6 routing
212is required) to
213.Pa /etc/sysctl.conf :
214.Pp
215.Dl net.inet.ip.forwarding=1
216.Dl net.inet6.ip6.forwarding=1
217.Pp
218Packets are not forwarded by default, due to RFC requirements.
219.Ss Check DNS
220Use
221.Xr host 1
222or
223.Xr dig 1
224to check that domain name resolution is working properly.
225.Pp
226Most likely, the IP address of at least one domain name server
227was added to
228.Xr resolv.conf 5
229while installing the system.
230If DHCP is in use, it will overwrite
231.Pa /etc/resolv.conf
232every time
233.Xr dhclient 8
234is run but
235.Pa /etc/resolv.conf.tail
236can be used to add options and extra name servers to those received
237dynamically.
238.Pp
239A
240.Xr hosts 5
241file can be used if there is a need for system specific name
242resolution entries.
243.Ss Check disk mounts
244Check that the disks are mounted correctly by
245comparing the
246.Pa /etc/fstab
247file against the output of the
248.Xr mount 8
249and
250.Xr df 1
251commands.
252Example:
253.Bd -literal -offset indent
254# cat /etc/fstab
255/dev/sd0a / ffs rw 1 1
256/dev/sd0d /usr ffs rw,nodev 1 2
257/dev/sd0e /var ffs rw,nodev,nosuid 1 3
258/dev/sd0g /tmp ffs rw,nodev,nosuid 1 4
259/dev/sd0h /home ffs rw,nodev,nosuid 1 5
260
261# mount
262/dev/sd0a on / type ffs (local)
263/dev/sd0d on /usr type ffs (local, nodev)
264/dev/sd0e on /var type ffs (local, nodev, nosuid)
265/dev/sd0g on /tmp type ffs (local, nodev, nosuid)
266/dev/sd0h on /home type ffs (local, nodev, nosuid)
267
268# df
269Filesystem  1024-blocks     Used    Avail Capacity  Mounted on
270/dev/sd0a         22311    14589     6606    69%    /
271/dev/sd0d        203399   150221    43008    78%    /usr
272/dev/sd0e         10447      682     9242     7%    /var
273/dev/sd0g         18823        2    17879     0%    /tmp
274/dev/sd0h          7519     5255     1888    74%    /home
275
276# pstat -s
277Device      512-blocks     Used    Avail Capacity  Priority
278/dev/sd0b       131072    84656    46416    65%    0
279.Ed
280.Pp
281Edit
282.Pa /etc/fstab
283and use the
284.Xr mount 8
285and
286.Xr umount 8
287commands as appropriate.
288Refer to the above example and
289.Xr fstab 5
290for information on the format of this file.
291.Pp
292You may wish to do NFS partitions now too, or you can do them later.
293.Ss Check the running system
294You can use
295.Xr ps 1 ,
296.Xr netstat 1 ,
297and
298.Xr fstat 1
299to check on running processes, network connections, and opened files,
300respectively.
301.Sh FURTHER CHANGES
302The system should be usable now, but you may wish to do more customizing,
303such as adding users, etc.
304We suggest that you
305.Ic cd /etc
306and edit any files in that directory as necessary.
307.Pp
308Note that the
309.Pa /etc/motd
310file is modified by
311.Pa /etc/rc
312whenever the system is booted.
313To keep any custom message intact, ensure that you leave two blank lines
314at the top, or your message will be overwritten.
315.Ss Add new users
316Add users.
317There is an
318.Xr adduser 8
319script.
320You may use
321.Xr vipw 8
322to add users to the
323.Pa /etc/passwd
324file
325and edit
326.Pa /etc/group
327by hand to add new groups.
328You may also wish to edit
329.Pa /etc/login.conf
330and tune some of the limits documented in
331.Xr login.conf 5 .
332The manual page for
333.Xr su 1
334tells you to make sure to put people in
335the
336.Sq wheel
337group if they need root access.
338For example:
339.Pp
340.Dl wheel:*:0:root,myself
341.Ss System command scripts
342The
343.Pa /etc/rc.*\&
344scripts are invoked at boot time, after single-user mode has exited,
345and at shutdown.
346The whole process is controlled, more or less, by the master script
347.Pa /etc/rc .
348This script should not be changed by administrators.
349.Pp
350.Pa /etc/rc
351is in turn influenced by the configuration variables present in
352.Pa /etc/rc.conf .
353Again, this script should not be changed by administrators:
354site-specific changes should be made to
355.Pq freshly created if necessary
356.Pa /etc/rc.conf.local
357or by using the
358.Xr rcctl 8
359utility.
360.Pp
361Any commands which should be run before the system sets its
362secure level should be made to
363.Pa /etc/rc.securelevel ,
364and commands to be run after the system sets its
365secure level should be made to
366.Pa /etc/rc.local .
367Commands to be run before system shutdown should be set in
368.Pa /etc/rc.shutdown .
369.Pp
370For more information about system startup/shutdown files, see
371.Xr rc 8 ,
372.Xr rc.conf 8 ,
373.Xr securelevel 7 ,
374and
375.Xr rc.shutdown 8 .
376.Pp
377If you've installed X, you may want to turn on
378.Xr xenodm 1 ,
379the X Display Manager.
380To do this, change the value of
381.Va xenodm_flags
382in
383.Pa /etc/rc.conf.local .
384.Ss Set keyboard type
385Some architectures permit keyboard type control.
386Use the
387.Xr kbd 8
388command to change the keyboard encoding.
389.Ic kbd -l
390will list all available encodings.
391.Ic kbd xxx
392will select the
393.Ic xxx
394encoding.
395Store the encoding in
396.Pa /etc/kbdtype
397to make sure it is set automatically at boot time.
398.Ss Printers
399Edit
400.Pa /etc/printcap
401and
402.Pa /etc/hosts.lpd
403to get any printers set up.
404Consult
405.Xr lpd 8
406and
407.Xr printcap 5
408if needed.
409.Ss Audio and video recording
410The
411.Xr audio 4
412and
413.Xr video 4
414drivers by default record only silence and blanked images.
415Normal recording can be enabled by adding the following directives to
416.Xr sysctl.conf 5 :
417.Bd -literal -offset indent
418kern.audio.record=1
419kern.video.record=1
420.Ed
421.Ss Mail aliases
422Edit
423.Pa /etc/mail/aliases
424and set the three standard aliases to go to either a mailing list, or
425the system administrator.
426.Bd -literal -offset indent
427# Well-known aliases -- these should be filled in!
428root:		sysadm
429manager:	root
430dumper:		root
431.Ed
432.Ss Mail
433The default mail agent on
434.Ox
435is
436.Xr smtpd 8 .
437Details on how to configure an alternative mailer are documented in
438.Xr mailer.conf 5 .
439.Pp
440.Ox
441ships with a default
442.Pa /etc/mail/smtpd.conf
443file that will work for simple installations.
444See
445.Xr smtpd.conf 5
446for information on configuring more complex setups.
447For the default installation,
448.Xr smtpd 8
449is configured to only accept connections from the local host.
450This makes it possible to send mail locally, but not receive mail from remote
451servers, which is ideal if you have one central incoming mail machine and
452several clients.
453To cause smtpd to accept external network connections, modify the
454.Ic listen on
455directive in
456.Pa /etc/mail/smtpd.conf
457to include the interfaces to listen on.
458.Ss Daily, weekly, monthly scripts
459Review
460.Xr daily 8
461to understand what the periodic system maintenance scripts do and
462how to customize them:
463For example, to enable
464.Ev ROOTBACKUP
465or to add local maintenance code to
466.Pa /etc/daily.local , /etc/weekly.local ,
467or
468.Pa /etc/monthly.local .
469.Ss Tighten up security
470You might wish to tighten up security more by editing
471.Pa /etc/fbtab
472as when installing X.
473Look at the other files in
474.Pa /etc
475and edit them as needed.
476(Do not edit files ending in
477.Pa .db
478\(em like
479.Pa pwd.db , spwd.db ,
480nor
481.Pa localtime ,
482nor
483.Pa rmt ,
484nor any directories.)
485.Ss Crontab (background running processes)
486Check what is running by typing
487.Ic crontab -l
488as root
489and see if anything unexpected is present.
490Do you need anything else?
491Do you wish to change things?
492See
493.Xr crontab 5 .
494.Ss Next day cleanup
495After the first night's
496.Xr security 8
497run, change ownerships and permissions
498on files, directories, and devices; root may have received mail
499with subject: "<hostname> daily insecurity output".
500This mail contains a set of security recommendations,
501presented as a list looking something like this:
502.Bd -literal -offset indent
503var/mail:
504        permissions (0755, 0775)
505etc/daily:
506        user (0, 3)
507.Ed
508.Pp
509The best bet is to follow the advice in that list.
510The recommended setting is the first item in parentheses, while
511the current setting is the second one.
512This list is generated by
513.Xr mtree 8
514using
515.Pa /etc/mtree/special .
516Use
517.Xr chmod 1 ,
518.Xr chgrp 1 ,
519and
520.Xr chown 8
521as needed.
522.Ss Daemons
523Enable/disable any daemon processes as necessary.
524.Xr intro 8
525contains a comprehensive guide to the various daemons available on the
526.Ox
527system.
528.Ss Packages
529Install your own packages.
530The
531.Ox
532ports collection includes a large set of third-party software.
533A lot of it is available as binary packages that you can install using
534.Xr pkg_add 1 .
535See
536.Xr ports 7
537and
538.Xr packages 7
539for more details.
540To start daemons installed from packages, see
541.Xr rc.d 8 .
542.Pp
543There is also other third-party software that is available
544in source form only, either because it has not been ported to
545.Ox
546yet, or because licensing restrictions make binary redistribution
547impossible.
548Sometimes checking the mailing lists for
549past problems that people have encountered will result in a fix posted.
550.Ss Compiling a kernel
551Information on building and modifying kernels
552is contained within
553.Xr config 8 .
554.Sh SEE ALSO
555.Xr doas 1 ,
556.Xr ksh 1 ,
557.Xr man 1 ,
558.Xr pkg_add 1 ,
559.Xr ps 1 ,
560.Xr vi 1 ,
561.Xr multicast 4 ,
562.Xr hier 7 ,
563.Xr config 8 ,
564.Xr dmesg 8 ,
565.Xr ifconfig 8 ,
566.Xr intro 8 ,
567.Xr rcctl 8 ,
568.Xr sysctl 8
569.Sh HISTORY
570This document first appeared in
571.Ox 2.2 .
572