1.\" $OpenBSD: afterboot.8,v 1.136 2012/03/01 04:38:10 lum Exp $ 2.\" 3.\" Copyright (c) 1997 Marshall M. Midden 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. All advertising materials mentioning features or use of this software 16.\" must display the following acknowledgement: 17.\" This product includes software developed by Marshall M. Midden. 18.\" 4. The name of the author may not be used to endorse or promote products 19.\" derived from this software without specific prior written permission. 20.\" 21.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31.\" 32.Dd $Mdocdate: March 1 2012 $ 33.Dt AFTERBOOT 8 34.\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu 35.Os 36.Sh NAME 37.Nm afterboot 38.Nd things to check after the first complete boot 39.Sh DESCRIPTION 40.Ss Starting out 41This document attempts to list items for the system administrator 42to check and set up after the installation and first complete boot of the 43system. 44The idea is to create a list of items that can be checked off so that you have 45a warm fuzzy feeling that something obvious has not been missed. 46A basic knowledge of 47.Ux 48is assumed, otherwise type: 49.Pp 50.Dl $ help 51.Pp 52Complete instructions for correcting and fixing items is not provided. 53There are manual pages and other methodologies available for doing that. 54For example, to view the man page for the 55.Xr ls 1 56command, type: 57.Pp 58.Dl $ man 1 ls 59.Pp 60Administrators will rapidly become more familiar with 61.Ox 62if they get used to using the high quality manual pages. 63.Ss Errata 64By the time that you have installed your system, it is quite likely that 65bugs in the release have been found. 66Any security or reliability fixes can be found at 67.Pa http://www.openbsd.org/errata.html . 68It is recommended to check this page regularly. 69.Ss Login 70Log in on the console, or over the network using 71.Xr ssh 1 . 72For security reasons, it is bad practice to log in as root during regular use 73and maintenance of the system. 74Instead, administrators are encouraged to add a 75.Dq regular 76user, add said user to the 77.Dq wheel 78group, then use the 79.Xr su 1 80and 81.Xr sudo 8 82commands when root privileges are required. 83.Pp 84The installation process provides an option to set up a user account. 85By default, accounts created via this method are automatically added to 86the 87.Dq wheel 88group. 89If that option was not used, see the paragraph 90.Sx Add new users 91below. 92.Pp 93To deny root logins over the network, edit the 94.Pa /etc/ssh/sshd_config 95file and set 96.Cm PermitRootLogin 97to 98.Dq no 99(see 100.Xr sshd_config 5 ) . 101.Ss Root password 102Change the password for the root user. 103(Note that throughout the documentation, the term 104.Dq superuser 105is a synonym for the root user.) 106Choose a password that has digits and special characters (not space) 107as well as from the upper and lower case alphabet. 108Do not choose any word in any language. 109It is common for an intruder to use dictionary attacks. 110Type the following command to change it: 111.Pp 112.Dl $ /usr/bin/sudo /usr/bin/passwd root 113.Pp 114It is a good idea to always specify the full path name for the 115.Xr passwd 1 , 116.Xr su 1 117and 118.Xr sudo 8 119commands as this inhibits the possibility of rogue files placed in your 120.Ev PATH 121being executed for most shells. 122Furthermore, the superuser's 123.Ev PATH 124should never contain the current directory 125.Pq Dq \&. . 126.Ss System date 127Check the system date with the 128.Xr date 1 129command. 130If needed, change the date, and/or change the symbolic link of 131.Pa /etc/localtime 132to the correct time zone in the 133.Pa /usr/share/zoneinfo 134directory. 135Alternatively, 136.Xr ntpd 8 137can be used to automatically synchronize clocks with remote NTP servers. 138.Pp 139Examples: 140.Pp 141Set the current date to January 27th, 1999 3:04pm: 142.Dl # date 199901271504 143.Pp 144Set the time zone to Atlantic Standard Time: 145.Dl # ln -fs /usr/share/zoneinfo/Canada/Atlantic /etc/localtime 146.Ss Check hostname 147Use the 148.Ic hostname 149command to verify that the name of your machine is correct. 150See the man page for 151.Xr hostname 1 152if it needs to be changed. 153You will also need to edit the 154.Pa /etc/myname 155file to have it stick around for the next reboot. 156.Ss Verify network interface configuration 157The first thing to do is an 158.Ic ifconfig -a 159to see if the network interfaces are properly configured. 160Correct by editing 161.Pa /etc/hostname. Ns Ar interface 162(where 163.Ar interface 164is the interface name, e.g., 165.Dq le0 ) 166and then using 167.Xr ifconfig 8 168to manually configure it 169if you do not wish to reboot. 170Read the 171.Xr hostname.if 5 172man page for more information on the format of 173.Pa /etc/hostname. Ns Ar interface 174files. 175The loopback interface will look something like: 176.Bd -literal -offset indent 177lo0: flags=8009<UP,LOOPBACK,MULTICAST> mtu 32972 178 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 179 inet6 ::1 prefixlen 128 180 inet 127.0.0.1 netmask 0xff000000 181.Ed 182.Pp 183an Ethernet interface something like: 184.Bd -literal -offset indent 185le0: flags=9863<UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST> 186 inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255 187 inet6 fe80::5ef0:f0f0%le0 prefixlen 64 scopeid 0x1 188.Ed 189.Pp 190and a PPP interface something like: 191.Bd -literal -offset indent 192ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> 193 inet 203.3.131.108 --> 198.181.0.253 netmask 0xffff0000 194.Ed 195.Pp 196See 197.Xr netstart 8 198for instructions on configuring multicast routing. 199.Pp 200See 201.Xr dhcp 8 202for instructions on configuring interfaces with DHCP. 203.Ss Check routing tables 204Issue a 205.Ic netstat -rn 206command. 207The output will look something like: 208.Bd -literal -offset indent 209Routing tables 210 211Internet: 212Destination Gateway Flags Refs Use Mtu Interface 213default 192.168.4.254 UGS 0 11098028 - le0 214127 127.0.0.1 UGRS 0 0 - lo0 215127.0.0.1 127.0.0.1 UH 3 24 - lo0 216192.168.4 link#1 UC 0 0 - le0 217192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - le0 218192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - le0 219 220Internet6: 221Destination Gateway Flags Refs Use Mtu Interface 222::/96 ::1 UGRS 0 0 32972 lo0 => 223::1 ::1 UH 4 0 32972 lo0 224::ffff:0.0.0.0/96 ::1 UGRS 0 0 32972 lo0 225fc80::/10 ::1 UGRS 0 0 32972 lo0 226fe80::/10 ::1 UGRS 0 0 32972 lo0 227fe80::%le0/64 link#1 UC 0 0 1500 le0 228fe80::%lo0/64 fe80::1%lo0 U 0 0 32972 lo0 229ff01::/32 ::1 U 0 0 32972 lo0 230ff02::%le0/32 link#1 UC 0 0 1500 le0 231ff02::%lo0/32 fe80::1%lo0 UC 0 0 32972 lo0 232.Ed 233.Pp 234The default gateway address is stored in the 235.Pa /etc/mygate 236file. 237If you need to edit this file, a painless way to reconfigure the network 238afterwards is 239.Ic route flush 240followed by a 241.Ic sh -x /etc/netstart 242command. 243Or, you may prefer to manually configure using a series of 244.Ic route add 245and 246.Ic route delete 247commands (see 248.Xr route 8 ) . 249If you run 250.Xr dhclient 8 251you will have to kill it by running 252.Ic pkill dhclient 253after you flush the routes. 254.Pp 255If you wish to route packets between interfaces, add one or both 256of the following directives (depending on whether IPv4 or IPv6 routing 257is required) to 258.Pa /etc/sysctl.conf : 259.Pp 260.Dl net.inet.ip.forwarding=1 261.Dl net.inet6.ip6.forwarding=1 262.Pp 263Packets are not forwarded by default, due to RFC requirements. 264.Ss Check DNS 265Use 266.Xr host 1 267or 268.Xr dig 1 269to check that domain name resolution is working properly. 270.Pp 271Most likely, the IP address of at least one domain name server 272was added to 273.Xr resolv.conf 5 274while installing the system. 275If DHCP is in use, it will overwrite 276.Pa /etc/resolv.conf 277every time 278.Xr dhclient-script 8 279is run but 280.Pa /etc/resolv.conf.tail 281can be used to add options and extra name servers to those received 282dynamically. 283.Pp 284A 285.Xr hosts 5 286file can be used if there is a need for system specific name 287resolution entries. 288.Ss Check disk mounts 289Check that the disks are mounted correctly by 290comparing the 291.Pa /etc/fstab 292file against the output of the 293.Xr mount 8 294and 295.Xr df 1 296commands. 297Example: 298.Bd -literal -offset indent 299# cat /etc/fstab 300/dev/sd0a / ffs rw 1 1 301/dev/sd0d /usr ffs rw,nodev 1 2 302/dev/sd0e /var ffs rw,nodev,nosuid 1 3 303/dev/sd0g /tmp ffs rw,nodev,nosuid 1 4 304/dev/sd0h /home ffs rw,nodev,nosuid 1 5 305 306# mount 307/dev/sd0a on / type ffs (local) 308/dev/sd0d on /usr type ffs (local, nodev) 309/dev/sd0e on /var type ffs (local, nodev, nosuid) 310/dev/sd0g on /tmp type ffs (local, nodev, nosuid) 311/dev/sd0h on /home type ffs (local, nodev, nosuid) 312 313# df 314Filesystem 1024-blocks Used Avail Capacity Mounted on 315/dev/sd0a 22311 14589 6606 69% / 316/dev/sd0d 203399 150221 43008 78% /usr 317/dev/sd0e 10447 682 9242 7% /var 318/dev/sd0g 18823 2 17879 0% /tmp 319/dev/sd0h 7519 5255 1888 74% /home 320 321# pstat -s 322Device 512-blocks Used Avail Capacity Priority 323/dev/sd0b 131072 84656 46416 65% 0 324.Ed 325.Pp 326Edit 327.Pa /etc/fstab 328and use the 329.Xr mount 8 330and 331.Xr umount 8 332commands as appropriate. 333Refer to the above example and 334.Xr fstab 5 335for information on the format of this file. 336.Pp 337You may wish to do NFS partitions now too, or you can do them later. 338.Ss Check the running system 339You can use 340.Xr ps 1 , 341.Xr netstat 1 , 342and 343.Xr fstat 1 344to check on running processes, network connections, and opened files, 345respectively. 346.Sh FURTHER CHANGES 347The system should be usable now, but you may wish to do more customizing, 348such as adding users, etc. 349Many of the following sections may be skipped 350if you are not using that package. 351We suggest that you 352.Ic cd /etc 353and edit any files in that directory as necessary. 354.Pp 355Note that the 356.Pa /etc/motd 357file is modified by 358.Pa /etc/rc 359whenever the system is booted. 360To keep any custom message intact, ensure that you leave two blank lines 361at the top, or your message will be overwritten. 362.Ss Add new users 363Add users. 364There is an 365.Xr adduser 8 366script. 367You may use 368.Xr vipw 8 369to add users to the 370.Pa /etc/passwd 371file 372and edit 373.Pa /etc/group 374by hand to add new groups. 375You may also wish to edit 376.Pa /etc/login.conf 377and tune some of the limits documented in 378.Xr login.conf 5 . 379The manual page for 380.Xr su 1 381tells you to make sure to put people in 382the 383.Sq wheel 384group if they need root access (non-Kerberos). 385For example: 386.Pp 387.Dl wheel:*:0:root,myself 388.Pp 389Follow instructions for 390.Xr login_krb5 8 391if using 392Kerberos 393for authentication. 394.Ss System command scripts 395The 396.Pa /etc/rc.*\& 397scripts are invoked at boot time, after single user mode has exited, 398and at shutdown. 399The whole process is controlled, more or less, by the master script 400.Pa /etc/rc . 401This script should not be changed by administrators. 402.Pp 403.Pa /etc/rc 404is in turn influenced by the configuration variables present in 405.Pa /etc/rc.conf . 406Again this script should not be changed by administrators: 407site-specific changes should be made to 408.Pq freshly created if necessary 409.Pa /etc/rc.conf.local . 410.Pp 411Any commands which should be run before the system sets its 412secure level should be made to 413.Pa /etc/rc.securelevel , 414and commands to be run after the system sets its 415secure level should be made to 416.Pa /etc/rc.local . 417Commands to be run before system shutdown should be set in 418.Pa /etc/rc.shutdown . 419.Pp 420For more information about system startup/shutdown files, see 421.Xr rc 8 , 422.Xr rc.conf 8 , 423.Xr securelevel 7 , 424and 425.Xr rc.shutdown 8 . 426.Pp 427If you've installed X, you may want to turn on 428.Xr xdm 1 , 429the X Display Manager. 430To do this, change the value of 431.Va xdm_flags 432in 433.Pa /etc/rc.conf.local . 434.Ss Set keyboard type 435Some architectures permit keyboard type control. 436Use the 437.Xr kbd 8 438command to change the keyboard encoding. 439.Ic kbd -l 440will list all available encodings. 441.Ic kbd xxx 442will select the 443.Ic xxx 444encoding. 445Store the encoding in 446.Pa /etc/kbdtype 447to make sure it is set automatically at boot time. 448.Ss Printers 449Edit 450.Pa /etc/printcap 451and 452.Pa /etc/hosts.lpd 453to get any printers set up. 454Consult 455.Xr lpd 8 456and 457.Xr printcap 5 458if needed. 459.Ss Mail aliases 460Edit 461.Pa /etc/mail/aliases 462and set the three standard aliases to go to either a mailing list, or 463the system administrator. 464.Bd -literal -offset indent 465# Well-known aliases -- these should be filled in! 466root: sysadm 467manager: root 468dumper: root 469.Ed 470.Pp 471Run 472.Xr newaliases 8 473after changes. 474.Ss Sendmail 475The default mail agent on 476.Ox 477is 478.Xr sendmail 8 . 479Details on how to configure an alternative mailer are documented in 480.Xr mailer.conf 5 . 481.Pp 482.Ox 483ships with a default 484.Pa /etc/mail/localhost.cf 485file that will work for simple installations; it was generated from 486.Pa openbsd-localhost.mc 487in 488.Pa /usr/share/sendmail/cf . 489Please see 490.Pa /usr/share/sendmail/README 491for information on generating your own sendmail configuration files. 492For the default installation, sendmail is configured to only accept 493connections from the local host and to not accept connections on 494any external interfaces. 495This makes it possible to send mail locally, but not receive mail from remote 496servers, which is ideal if you have one central incoming mail machine and 497several clients. 498To cause sendmail to accept external network connections, modify the 499.Va sendmail_flags 500variable in 501.Pa /etc/rc.conf.local 502to use the 503.Pa /etc/mail/sendmail.cf 504file in accordance with the comments therein. 505This file was generated from 506.Pa openbsd-proto.mc . 507.Pp 508Note that sendmail now also listens on port 587 by default. 509This is to implement the RFC 2476 message submission protocol. 510You may disable this via the 511.Ic no_default_msa 512option in your sendmail .mc file. 513See 514.Pa /usr/share/sendmail/README 515for more information. 516.Ss Daily, weekly, monthly scripts 517Review 518.Xr daily 8 519to understand what the periodic system maintenance scripts do and 520how to customize them: 521For example, to enable 522.Ev ROOTBACKUP 523or to disable 524.Ev VERBOSESTATUS , 525or to add local maintenance code to 526.Pa /etc/daily.local , /etc/weekly.local , 527or 528.Pa /etc/monthly.local . 529.Ss Tighten up security 530You might wish to tighten up security more by editing 531.Pa /etc/fbtab 532as when installing X. 533In 534.Pa /etc/inetd.conf 535comment out any extra entries you do not need, 536and only add things that are really needed. 537.Ss Other files in /etc 538Look at the other files in 539.Pa /etc 540and edit them as needed. 541(Do not edit files ending in 542.Pa .db 543\(em like 544.Pa pwd.db , spwd.db , 545nor 546.Pa localtime , 547nor 548.Pa rmt , 549nor any directories.) 550.Ss Crontab (background running processes) 551Check what is running by typing 552.Ic crontab -l 553as root 554and see if anything unexpected is present. 555Do you need anything else? 556Do you wish to change things? 557See 558.Xr crontab 5 . 559.Ss Next day cleanup 560After the first night's 561.Xr security 8 562run, change ownerships and permissions 563on files, directories, and devices; root may have received mail 564with subject: "<hostname> daily insecurity output". 565This mail contains a set of security recommendations, 566presented as a list looking something like this: 567.Bd -literal -offset indent 568var/mail: 569 permissions (0755, 0775) 570etc/daily: 571 user (0, 3) 572.Ed 573.Pp 574The best bet is to follow the advice in that list. 575The recommended setting is the first item in parentheses, while 576the current setting is the second one. 577This list is generated by 578.Xr mtree 8 579using 580.Pa /etc/mtree/special . 581Use 582.Xr chmod 1 , 583.Xr chgrp 1 , 584and 585.Xr chown 8 586as needed. 587.Ss Daemons 588Enable/disable any daemon processes as necessary. 589.Xr intro 8 590contains a comprehensive guide to the various daemons available on the 591.Ox 592system. 593.Ss Packages 594Install your own packages. 595The 596.Ox 597ports collection includes a large set of third-party software. 598A lot of it is available as binary packages that you can download from 599.Pa ftp://ftp.openbsd.org 600or a mirror, and install using 601.Xr pkg_add 1 . 602See 603.Xr ports 7 604and 605.Xr packages 7 606for more details. 607.Pp 608Copy vendor binaries and install them. 609You will need to install any shared libraries, etc. 610Read the compat_* man pages 611to find out how to install and use compatibility mode. 612.Pp 613There is also other third-party software that is available 614in source form only, either because it has not been ported to 615.Ox 616yet, or because licensing restrictions make binary redistribution 617impossible. 618Sometimes checking the mailing lists for 619past problems that people have encountered will result in a fix posted. 620.Ss Compiling a kernel 621Information on building and modifying kernels 622is contained within 623.Xr config 8 . 624.Sh SEE ALSO 625.Xr ksh 1 , 626.Xr man 1 , 627.Xr pkg_add 1 , 628.Xr ps 1 , 629.Xr vi 1 , 630.Xr hier 7 , 631.Xr config 8 , 632.Xr dmesg 8 , 633.Xr ifconfig 8 , 634.Xr intro 8 , 635.Xr sudo 8 , 636.Xr sysctl 8 637.Sh HISTORY 638This document first appeared in 639.Ox 2.2 . 640