1.\" $OpenBSD: afterboot.8,v 1.145 2014/04/29 13:48:18 jmc Exp $ 2.\" 3.\" Copyright (c) 1997 Marshall M. Midden 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. All advertising materials mentioning features or use of this software 16.\" must display the following acknowledgement: 17.\" This product includes software developed by Marshall M. Midden. 18.\" 4. The name of the author may not be used to endorse or promote products 19.\" derived from this software without specific prior written permission. 20.\" 21.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31.\" 32.Dd $Mdocdate: April 29 2014 $ 33.Dt AFTERBOOT 8 34.\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu 35.Os 36.Sh NAME 37.Nm afterboot 38.Nd things to check after the first complete boot 39.Sh DESCRIPTION 40.Ss Starting out 41This document attempts to list items for the system administrator 42to check and set up after the installation and first complete boot of the 43system. 44The idea is to create a list of items that can be checked off so that you have 45a warm fuzzy feeling that something obvious has not been missed. 46A basic knowledge of 47.Ux 48is assumed, otherwise type: 49.Pp 50.Dl $ help 51.Pp 52Complete instructions for correcting and fixing items is not provided. 53There are manual pages and other methodologies available for doing that. 54For example, to view the man page for the 55.Xr ls 1 56command, type: 57.Pp 58.Dl $ man 1 ls 59.Pp 60Administrators will rapidly become more familiar with 61.Ox 62if they get used to using the high quality manual pages. 63.Ss Errata 64By the time that you have installed your system, it is quite likely that 65bugs in the release have been found. 66Any security or reliability fixes can be found at 67.Lk http://www.openbsd.org/errata.html . 68It is recommended to check this page regularly. 69.Ss Login 70Log in on the console, or over the network using 71.Xr ssh 1 . 72For security reasons, it is bad practice to log in as root during regular use 73and maintenance of the system. 74Instead, administrators are encouraged to add a 75.Dq regular 76user, add said user to the 77.Dq wheel 78group, then use the 79.Xr su 1 80and 81.Xr sudo 8 82commands when root privileges are required. 83.Pp 84The installation process provides an option to set up a user account. 85By default, accounts created via this method are automatically added to 86the 87.Dq wheel 88group. 89If that option was not used, see the paragraph 90.Sx Add new users 91below. 92.Pp 93To deny root logins over the network, edit the 94.Pa /etc/ssh/sshd_config 95file and set 96.Cm PermitRootLogin 97to 98.Dq no 99(see 100.Xr sshd_config 5 ) . 101.Ss Root password 102Change the password for the root user. 103(Note that throughout the documentation, the term 104.Dq superuser 105is a synonym for the root user.) 106Choose a password that has digits and special characters (not space) 107as well as from the upper and lower case alphabet. 108Do not choose any word in any language. 109It is common for an intruder to use dictionary attacks. 110Type the following command to change it: 111.Pp 112.Dl $ /usr/bin/sudo /usr/bin/passwd root 113.Pp 114It is a good idea to always specify the full path name for the 115.Xr passwd 1 , 116.Xr su 1 117and 118.Xr sudo 8 119commands as this inhibits the possibility of rogue files placed in your 120.Ev PATH 121being executed for most shells. 122Furthermore, the superuser's 123.Ev PATH 124should never contain the current directory 125.Pq Dq \&. . 126.Ss System date 127Check the system date with the 128.Xr date 1 129command. 130If needed, change the date, and/or change the symbolic link of 131.Pa /etc/localtime 132to the correct time zone in the 133.Pa /usr/share/zoneinfo 134directory. 135Alternatively, 136.Xr ntpd 8 137can be used to automatically synchronize clocks with remote NTP servers. 138.Pp 139Examples: 140.Pp 141Set the current date to January 27th, 1999 3:04pm: 142.Dl # date 199901271504 143.Pp 144Set the time zone to Atlantic Standard Time: 145.Dl # ln -fs /usr/share/zoneinfo/Canada/Atlantic /etc/localtime 146.Ss Check hostname 147Use the 148.Ic hostname 149command to verify that the name of your machine is correct. 150See the man page for 151.Xr hostname 1 152if it needs to be changed. 153You will also need to edit the 154.Pa /etc/myname 155file to have it stick around for the next reboot. 156.Ss Verify network interface configuration 157The first thing to do is an 158.Ic ifconfig -a 159to see if the network interfaces are properly configured. 160Correct by editing 161.Pa /etc/hostname. Ns Ar interface 162(where 163.Ar interface 164is the interface name, e.g., 165.Dq le0 ) 166and then using 167.Xr ifconfig 8 168to manually configure it 169if you do not wish to reboot. 170Read the 171.Xr hostname.if 5 172man page for more information on the format of 173.Pa /etc/hostname. Ns Ar interface 174files. 175The loopback interface will look something like: 176.Bd -literal -offset indent 177lo0: flags=8009<UP,LOOPBACK,MULTICAST> mtu 32972 178 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 179 inet6 ::1 prefixlen 128 180 inet 127.0.0.1 netmask 0xff000000 181.Ed 182.Pp 183an Ethernet interface something like: 184.Bd -literal -offset indent 185le0: flags=9863<UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST> 186 inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255 187 inet6 fe80::5ef0:f0f0%le0 prefixlen 64 scopeid 0x1 188.Ed 189.Pp 190and a PPP interface something like: 191.Bd -literal -offset indent 192ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> 193 inet 203.3.131.108 --> 198.181.0.253 netmask 0xffff0000 194.Ed 195.Pp 196See 197.Xr netstart 8 198for instructions on configuring multicast routing. 199.Pp 200See 201.Xr hostname.if 5 202for instructions on configuring interfaces with DHCP. 203.Ss Check routing tables 204Issue a 205.Ic netstat -rn 206command. 207The output will look something like: 208.Bd -literal -offset indent 209Routing tables 210 211Internet: 212Destination Gateway Flags Refs Use Mtu Interface 213default 192.168.4.254 UGS 0 11098028 - le0 214127 127.0.0.1 UGRS 0 0 - lo0 215127.0.0.1 127.0.0.1 UH 3 24 - lo0 216192.168.4 link#1 UC 0 0 - le0 217192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - le0 218192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - le0 219 220Internet6: 221Destination Gateway Flags Refs Use Mtu Interface 222::/96 ::1 UGRS 0 0 32972 lo0 => 223::1 ::1 UH 4 0 32972 lo0 224::ffff:0.0.0.0/96 ::1 UGRS 0 0 32972 lo0 225fc80::/10 ::1 UGRS 0 0 32972 lo0 226fe80::/10 ::1 UGRS 0 0 32972 lo0 227fe80::%le0/64 link#1 UC 0 0 1500 le0 228fe80::%lo0/64 fe80::1%lo0 U 0 0 32972 lo0 229ff01::/32 ::1 U 0 0 32972 lo0 230ff02::%le0/32 link#1 UC 0 0 1500 le0 231ff02::%lo0/32 fe80::1%lo0 UC 0 0 32972 lo0 232.Ed 233.Pp 234The default gateway address is stored in the 235.Pa /etc/mygate 236file. 237If you need to edit this file, a painless way to reconfigure the network 238afterwards is 239.Ic route flush 240followed by a 241.Ic sh -x /etc/netstart 242command. 243Or, you may prefer to manually configure using a series of 244.Ic route add 245and 246.Ic route delete 247commands (see 248.Xr route 8 ) . 249If you run 250.Xr dhclient 8 251you will have to kill it by running 252.Ic pkill dhclient 253after you flush the routes. 254.Pp 255If you wish to route packets between interfaces, add one or both 256of the following directives (depending on whether IPv4 or IPv6 routing 257is required) to 258.Pa /etc/sysctl.conf : 259.Pp 260.Dl net.inet.ip.forwarding=1 261.Dl net.inet6.ip6.forwarding=1 262.Pp 263Packets are not forwarded by default, due to RFC requirements. 264.Ss Check DNS 265Use 266.Xr host 1 267or 268.Xr dig 1 269to check that domain name resolution is working properly. 270.Pp 271Most likely, the IP address of at least one domain name server 272was added to 273.Xr resolv.conf 5 274while installing the system. 275If DHCP is in use, it will overwrite 276.Pa /etc/resolv.conf 277every time 278.Xr dhclient 8 279is run but 280.Pa /etc/resolv.conf.tail 281can be used to add options and extra name servers to those received 282dynamically. 283.Pp 284A 285.Xr hosts 5 286file can be used if there is a need for system specific name 287resolution entries. 288.Ss Check disk mounts 289Check that the disks are mounted correctly by 290comparing the 291.Pa /etc/fstab 292file against the output of the 293.Xr mount 8 294and 295.Xr df 1 296commands. 297Example: 298.Bd -literal -offset indent 299# cat /etc/fstab 300/dev/sd0a / ffs rw 1 1 301/dev/sd0d /usr ffs rw,nodev 1 2 302/dev/sd0e /var ffs rw,nodev,nosuid 1 3 303/dev/sd0g /tmp ffs rw,nodev,nosuid 1 4 304/dev/sd0h /home ffs rw,nodev,nosuid 1 5 305 306# mount 307/dev/sd0a on / type ffs (local) 308/dev/sd0d on /usr type ffs (local, nodev) 309/dev/sd0e on /var type ffs (local, nodev, nosuid) 310/dev/sd0g on /tmp type ffs (local, nodev, nosuid) 311/dev/sd0h on /home type ffs (local, nodev, nosuid) 312 313# df 314Filesystem 1024-blocks Used Avail Capacity Mounted on 315/dev/sd0a 22311 14589 6606 69% / 316/dev/sd0d 203399 150221 43008 78% /usr 317/dev/sd0e 10447 682 9242 7% /var 318/dev/sd0g 18823 2 17879 0% /tmp 319/dev/sd0h 7519 5255 1888 74% /home 320 321# pstat -s 322Device 512-blocks Used Avail Capacity Priority 323/dev/sd0b 131072 84656 46416 65% 0 324.Ed 325.Pp 326Edit 327.Pa /etc/fstab 328and use the 329.Xr mount 8 330and 331.Xr umount 8 332commands as appropriate. 333Refer to the above example and 334.Xr fstab 5 335for information on the format of this file. 336.Pp 337You may wish to do NFS partitions now too, or you can do them later. 338.Ss Check the running system 339You can use 340.Xr ps 1 , 341.Xr netstat 1 , 342and 343.Xr fstat 1 344to check on running processes, network connections, and opened files, 345respectively. 346.Sh FURTHER CHANGES 347The system should be usable now, but you may wish to do more customizing, 348such as adding users, etc. 349Many of the following sections may be skipped 350if you are not using that package. 351We suggest that you 352.Ic cd /etc 353and edit any files in that directory as necessary. 354.Pp 355Note that the 356.Pa /etc/motd 357file is modified by 358.Pa /etc/rc 359whenever the system is booted. 360To keep any custom message intact, ensure that you leave two blank lines 361at the top, or your message will be overwritten. 362.Ss Add new users 363Add users. 364There is an 365.Xr adduser 8 366script. 367You may use 368.Xr vipw 8 369to add users to the 370.Pa /etc/passwd 371file 372and edit 373.Pa /etc/group 374by hand to add new groups. 375You may also wish to edit 376.Pa /etc/login.conf 377and tune some of the limits documented in 378.Xr login.conf 5 . 379The manual page for 380.Xr su 1 381tells you to make sure to put people in 382the 383.Sq wheel 384group if they need root access. 385For example: 386.Pp 387.Dl wheel:*:0:root,myself 388.Ss System command scripts 389The 390.Pa /etc/rc.*\& 391scripts are invoked at boot time, after single user mode has exited, 392and at shutdown. 393The whole process is controlled, more or less, by the master script 394.Pa /etc/rc . 395This script should not be changed by administrators. 396.Pp 397.Pa /etc/rc 398is in turn influenced by the configuration variables present in 399.Pa /etc/rc.conf . 400Again this script should not be changed by administrators: 401site-specific changes should be made to 402.Pq freshly created if necessary 403.Pa /etc/rc.conf.local . 404.Pp 405Any commands which should be run before the system sets its 406secure level should be made to 407.Pa /etc/rc.securelevel , 408and commands to be run after the system sets its 409secure level should be made to 410.Pa /etc/rc.local . 411Commands to be run before system shutdown should be set in 412.Pa /etc/rc.shutdown . 413.Pp 414For more information about system startup/shutdown files, see 415.Xr rc 8 , 416.Xr rc.conf 8 , 417.Xr securelevel 7 , 418and 419.Xr rc.shutdown 8 . 420.Pp 421If you've installed X, you may want to turn on 422.Xr xdm 1 , 423the X Display Manager. 424To do this, change the value of 425.Va xdm_flags 426in 427.Pa /etc/rc.conf.local . 428.Ss Set keyboard type 429Some architectures permit keyboard type control. 430Use the 431.Xr kbd 8 432command to change the keyboard encoding. 433.Ic kbd -l 434will list all available encodings. 435.Ic kbd xxx 436will select the 437.Ic xxx 438encoding. 439Store the encoding in 440.Pa /etc/kbdtype 441to make sure it is set automatically at boot time. 442.Ss Printers 443Edit 444.Pa /etc/printcap 445and 446.Pa /etc/hosts.lpd 447to get any printers set up. 448Consult 449.Xr lpd 8 450and 451.Xr printcap 5 452if needed. 453.Ss Mail aliases 454Edit 455.Pa /etc/mail/aliases 456and set the three standard aliases to go to either a mailing list, or 457the system administrator. 458.Bd -literal -offset indent 459# Well-known aliases -- these should be filled in! 460root: sysadm 461manager: root 462dumper: root 463.Ed 464.Pp 465Run 466.Xr newaliases 8 467after changes. 468.Ss Mail 469The default mail agent on 470.Ox 471is 472.Xr smtpd 8 . 473Details on how to configure an alternative mailer are documented in 474.Xr mailer.conf 5 . 475.Pp 476.Ox 477ships with a default 478.Pa /etc/mail/smtpd.conf 479file that will work for simple installations. 480See 481.Xr smtpd.conf 5 482for information on configuring more complex setups. 483For the default installation, smptd is configured to only accept 484connections from the local host. 485This makes it possible to send mail locally, but not receive mail from remote 486servers, which is ideal if you have one central incoming mail machine and 487several clients. 488To cause smtpd to accept external network connections, modify the 489.Va listen 490directive in 491.Pa /etc/mail/smtpd.conf 492to include the interfaces to listen on. 493.Ss Daily, weekly, monthly scripts 494Review 495.Xr daily 8 496to understand what the periodic system maintenance scripts do and 497how to customize them: 498For example, to enable 499.Ev ROOTBACKUP 500or to disable 501.Ev VERBOSESTATUS , 502or to add local maintenance code to 503.Pa /etc/daily.local , /etc/weekly.local , 504or 505.Pa /etc/monthly.local . 506.Ss Tighten up security 507You might wish to tighten up security more by editing 508.Pa /etc/fbtab 509as when installing X. 510In 511.Pa /etc/inetd.conf 512comment out any extra entries you do not need, 513and only add things that are really needed. 514.Ss Other files in /etc 515Look at the other files in 516.Pa /etc 517and edit them as needed. 518(Do not edit files ending in 519.Pa .db 520\(em like 521.Pa pwd.db , spwd.db , 522nor 523.Pa localtime , 524nor 525.Pa rmt , 526nor any directories.) 527.Ss Crontab (background running processes) 528Check what is running by typing 529.Ic crontab -l 530as root 531and see if anything unexpected is present. 532Do you need anything else? 533Do you wish to change things? 534See 535.Xr crontab 5 . 536.Ss Next day cleanup 537After the first night's 538.Xr security 8 539run, change ownerships and permissions 540on files, directories, and devices; root may have received mail 541with subject: "<hostname> daily insecurity output". 542This mail contains a set of security recommendations, 543presented as a list looking something like this: 544.Bd -literal -offset indent 545var/mail: 546 permissions (0755, 0775) 547etc/daily: 548 user (0, 3) 549.Ed 550.Pp 551The best bet is to follow the advice in that list. 552The recommended setting is the first item in parentheses, while 553the current setting is the second one. 554This list is generated by 555.Xr mtree 8 556using 557.Pa /etc/mtree/special . 558Use 559.Xr chmod 1 , 560.Xr chgrp 1 , 561and 562.Xr chown 8 563as needed. 564.Ss Daemons 565Enable/disable any daemon processes as necessary. 566.Xr intro 8 567contains a comprehensive guide to the various daemons available on the 568.Ox 569system. 570.Ss Packages 571Install your own packages. 572The 573.Ox 574ports collection includes a large set of third-party software. 575A lot of it is available as binary packages that you can install using 576.Xr pkg_add 1 . 577See 578.Xr ports 7 579and 580.Xr packages 7 581for more details. 582To start daemons installed from packages, see 583.Xr rc.d 8 . 584.Pp 585There is also other third-party software that is available 586in source form only, either because it has not been ported to 587.Ox 588yet, or because licensing restrictions make binary redistribution 589impossible. 590Sometimes checking the mailing lists for 591past problems that people have encountered will result in a fix posted. 592.Ss Compiling a kernel 593Information on building and modifying kernels 594is contained within 595.Xr config 8 . 596.Sh SEE ALSO 597.Xr ksh 1 , 598.Xr man 1 , 599.Xr pkg_add 1 , 600.Xr ps 1 , 601.Xr vi 1 , 602.Xr hier 7 , 603.Xr config 8 , 604.Xr dmesg 8 , 605.Xr ifconfig 8 , 606.Xr intro 8 , 607.Xr sudo 8 , 608.Xr sysctl 8 609.Sh HISTORY 610This document first appeared in 611.Ox 2.2 . 612