1.\" $OpenBSD: afterboot.8,v 1.121 2009/03/05 08:27:03 ajacoutot Exp $ 2.\" 3.\" Copyright (c) 1997 Marshall M. Midden 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. All advertising materials mentioning features or use of this software 16.\" must display the following acknowledgement: 17.\" This product includes software developed by Marshall M. Midden. 18.\" 4. The name of the author may not be used to endorse or promote products 19.\" derived from this software without specific prior written permission. 20.\" 21.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31.\" 32.Dd $Mdocdate: March 5 2009 $ 33.Dt AFTERBOOT 8 34\!\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu 35.Os 36.Sh NAME 37.Nm afterboot 38.Nd things to check after the first complete boot 39.Sh DESCRIPTION 40.Ss Starting out 41This document attempts to list items for the system administrator 42to check and set up after the installation and first complete boot of the 43system. 44The idea is to create a list of items that can be checked off so that you have 45a warm fuzzy feeling that something obvious has not been missed. 46A basic knowledge of 47.Ux 48is assumed, otherwise type: 49.Pp 50.Dl # help 51.Pp 52Complete instructions for correcting and fixing items is not provided. 53There are manual pages and other methodologies available for doing that. 54For example, to view the man page for the 55.Xr ls 1 56command, type: 57.Pp 58.Dl # man 1 ls 59.Pp 60Administrators will rapidly become more familiar with 61.Ox 62if they get used to using the high quality manual pages. 63.Ss Errata 64By the time that you have installed your system, it is quite likely that 65bugs in the release have been found. 66All significant and easily fixed problems will be reported at 67.Pa http://www.openbsd.org/errata.html . 68The web page will mention if a problem is security related. 69It is recommended that you check this page regularly. 70.Ss Login 71Log in as 72.Dq root . 73You can do so on the console, or over the network using 74.Xr ssh 1 . 75If you wish to deny root logins over the network, edit the 76.Pa /etc/ssh/sshd_config 77file and set 78.Cm PermitRootLogin 79to 80.Dq no 81(see 82.Xr sshd_config 5 ) . 83.Pp 84For security reasons, it is bad practice to log in as root during regular use 85and maintenance of the system. 86Instead, administrators are encouraged to add a 87.Dq regular 88user, add said user to the 89.Dq wheel 90group, then use the 91.Xr su 1 92and 93.Xr sudo 8 94commands when root privileges are required. 95This process is described in more detail later. 96.Ss Root password 97Change the password for the root user. 98(Note that throughout the documentation, the term 99.Dq superuser 100is a synonym for the root user.) 101Choose a password that has digits and special characters (not space) 102as well as from the upper and lower case alphabet. 103Do not choose any word in any language. 104It is common for an intruder to use dictionary attacks. 105Type the command 106.Ic /usr/bin/passwd 107to change it. 108.Pp 109It is a good idea to always specify the full path name for the 110.Xr passwd 1 , 111.Xr su 1 112and 113.Xr sudo 8 114commands as this inhibits the possibility of files placed in your execution 115.Ev PATH 116for most shells. 117Furthermore, the superuser's 118.Ev PATH 119should never contain the current directory 120.Pq Dq \&. . 121.Ss System date 122Check the system date with the 123.Xr date 1 124command. 125If needed, change the date, and/or change the symbolic link of 126.Pa /etc/localtime 127to the correct time zone in the 128.Pa /usr/share/zoneinfo 129directory. 130.Pp 131Examples: 132.Pp 133Set the current date to January 27th, 1999 3:04pm: 134.Dl # date 199901271504 135.Pp 136Set the time zone to Atlantic Standard Time: 137.Dl # ln -fs /usr/share/zoneinfo/Canada/Atlantic /etc/localtime 138.Ss Check hostname 139Use the 140.Ic hostname 141command to verify that the name of your machine is correct. 142See the man page for 143.Xr hostname 1 144if it needs to be changed. 145You will also need to edit the 146.Pa /etc/myname 147file to have it stick around for the next reboot. 148.Ss Verify network interface configuration 149The first thing to do is an 150.Ic ifconfig -a 151to see if the network interfaces are properly configured. 152Correct by editing 153.Pa /etc/hostname. Ns Ar interface 154(where 155.Ar interface 156is the interface name, e.g., 157.Dq le0 ) 158and then using 159.Xr ifconfig 8 160to manually configure it 161if you do not wish to reboot. 162Read the 163.Xr hostname.if 5 164man page for more information on the format of 165.Pa /etc/hostname. Ns Ar interface 166files. 167The loopback interface will look something like: 168.Bd -literal -offset indent 169lo0: flags=8009<UP,LOOPBACK,MULTICAST> mtu 32972 170 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 171 inet6 ::1 prefixlen 128 172 inet 127.0.0.1 netmask 0xff000000 173.Ed 174.Pp 175an Ethernet interface something like: 176.Bd -literal -offset indent 177le0: flags=9863<UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST> 178 inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255 179 inet6 fe80::5ef0:f0f0%le0 prefixlen 64 scopeid 0x1 180.Ed 181.Pp 182and a PPP interface something like: 183.Bd -literal -offset indent 184ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> 185 inet 203.3.131.108 --> 198.181.0.253 netmask 0xffff0000 186.Ed 187.Pp 188See 189.Xr netstart 8 190for instructions on configuring multicast routing. 191.Pp 192See 193.Xr dhcp 8 194for instructions on configuring interfaces with DHCP. 195.Ss Check routing tables 196Issue a 197.Ic netstat -rn 198command. 199The output will look something like: 200.Bd -literal -offset indent 201Routing tables 202 203Internet: 204Destination Gateway Flags Refs Use Mtu Interface 205default 192.168.4.254 UGS 0 11098028 - le0 206127 127.0.0.1 UGRS 0 0 - lo0 207127.0.0.1 127.0.0.1 UH 3 24 - lo0 208192.168.4 link#1 UC 0 0 - le0 209192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - le0 210192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - le0 211 212Internet6: 213Destination Gateway Flags Refs Use Mtu Interface 214::/96 ::1 UGRS 0 0 32972 lo0 => 215::1 ::1 UH 4 0 32972 lo0 216::ffff:0.0.0.0/96 ::1 UGRS 0 0 32972 lo0 217fc80::/10 ::1 UGRS 0 0 32972 lo0 218fe80::/10 ::1 UGRS 0 0 32972 lo0 219fe80::%le0/64 link#1 UC 0 0 1500 le0 220fe80::%lo0/64 fe80::1%lo0 U 0 0 32972 lo0 221ff01::/32 ::1 U 0 0 32972 lo0 222ff02::%le0/32 link#1 UC 0 0 1500 le0 223ff02::%lo0/32 fe80::1%lo0 UC 0 0 32972 lo0 224.Ed 225.Pp 226The default gateway address is stored in the 227.Pa /etc/mygate 228file. 229If you need to edit this file, a painless way to reconfigure the network 230afterwards is 231.Ic route flush 232followed by a 233.Ic sh -x /etc/netstart 234command. 235Or, you may prefer to manually configure using a series of 236.Ic route add 237and 238.Ic route delete 239commands (see 240.Xr route 8 ) . 241If you run 242.Xr dhclient 8 243you will have to kill it by running 244.Ic kill `cat /var/run/dhclient.pid` 245after you flush the routes. 246.Pp 247If you wish to route packets between interfaces, add one or both 248of the following directives (depending on whether IPv4 or IPv6 routing 249is required) to 250.Pa /etc/sysctl.conf : 251.Pp 252.Dl net.inet.ip.forwarding=1 253.Dl net.inet6.ip6.forwarding=1 254.Pp 255Packets are not forwarded by default, due to RFC requirements. 256.Ss Check disk mounts 257Check that the disks are mounted correctly by 258comparing the 259.Pa /etc/fstab 260file against the output of the 261.Xr mount 8 262and 263.Xr df 1 264commands. 265Example: 266.Bd -literal -offset indent 267# cat /etc/fstab 268/dev/sd0a / ffs rw 1 1 269/dev/sd0d /usr ffs rw,nodev 1 2 270/dev/sd0e /var ffs rw,nodev,nosuid 1 3 271/dev/sd0g /tmp ffs rw,nodev,nosuid 1 4 272/dev/sd0h /home ffs rw,nodev,nosuid 1 5 273 274# mount 275/dev/sd0a on / type ffs (local) 276/dev/sd0d on /usr type ffs (local, nodev) 277/dev/sd0e on /var type ffs (local, nodev, nosuid) 278/dev/sd0g on /tmp type ffs (local, nodev, nosuid) 279/dev/sd0h on /home type ffs (local, nodev, nosuid) 280 281# df 282Filesystem 1024-blocks Used Avail Capacity Mounted on 283/dev/sd0a 22311 14589 6606 69% / 284/dev/sd0d 203399 150221 43008 78% /usr 285/dev/sd0e 10447 682 9242 7% /var 286/dev/sd0g 18823 2 17879 0% /tmp 287/dev/sd0h 7519 5255 1888 74% /home 288 289# pstat -s 290Device 512-blocks Used Avail Capacity Priority 291swap_device 131072 84656 46416 65% 0 292.Ed 293.Pp 294Edit 295.Pa /etc/fstab 296and use the 297.Xr mount 8 298and 299.Xr umount 8 300commands as appropriate. 301Refer to the above example and 302.Xr fstab 5 303for information on the format of this file. 304.Pp 305You may wish to do NFS partitions now too, or you can do them later. 306.Ss Check the running system 307You can use 308.Xr ps 1 , 309.Xr netstat 1 , 310and 311.Xr fstat 1 312to check on running processes, network connections, and opened files, 313respectively. 314.Sh FURTHER CHANGES 315The system should be usable now, but you may wish to do more customizing, 316such as adding users, etc. 317Many of the following sections may be skipped 318if you are not using that package. 319We suggest that you 320.Ic cd /etc 321and edit any files in that directory as necessary. 322.Pp 323Note that the 324.Pa /etc/motd 325file is modified by 326.Pa /etc/rc 327whenever the system is booted. 328To keep any custom message intact, ensure that you leave two blank lines 329at the top, or your message will be overwritten. 330.Ss Add new users 331Add users. 332There is an 333.Xr adduser 8 334script. 335You may use 336.Xr vipw 8 337to add users to the 338.Pa /etc/passwd 339file 340and edit 341.Pa /etc/group 342by hand to add new groups. 343You may also wish to edit 344.Pa /etc/login.conf 345and tune some of the limits documented in 346.Xr login.conf 5 . 347The manual page for 348.Xr su 1 349tells you to make sure to put people in 350the 351.Sq wheel 352group if they need root access (non-Kerberos). 353For example: 354.Pp 355.Dl wheel:*:0:root,myself 356.Pp 357Follow instructions for 358.Xr login_krb5 8 359if using 360Kerberos 361for authentication. 362.Ss System command scripts 363The 364.Pa /etc/rc.*\& 365scripts are invoked at boot time, after single user mode has exited, 366and at shutdown. 367The whole process is controlled, more or less, by the master script 368.Pa /etc/rc . 369This script should not be changed by administrators. 370.Pp 371.Pa /etc/rc 372is in turn influenced by the configuration variables present in 373.Pa /etc/rc.conf . 374Again this script should not be changed by administrators: 375site-specific changes should be made to 376.Pq freshly created if necessary 377.Pa /etc/rc.conf.local . 378.Pp 379Any commands which should be run before the system sets its 380secure level should be made to 381.Pa /etc/rc.securelevel , 382and commands to be run after the system sets its 383secure level should be made to 384.Pa /etc/rc.local . 385Commands to be run before system shutdown should be set in 386.Pa /etc/rc.shutdown . 387.Pp 388For more information about system startup/shutdown files, see 389.Xr rc 8 , 390.Xr rc.conf 8 , 391.Xr securelevel 7 , 392and 393.Xr rc.shutdown 8 . 394.Pp 395If you've installed X, you may want to turn on 396.Xr xdm 1 , 397the X Display Manager. 398To do this, change the value of 399.Va xdm_flags 400in 401.Pa /etc/rc.conf.local . 402.Ss Set keyboard type 403Some architectures permit keyboard type control. 404Use the 405.Xr kbd 8 406command to change the keyboard encoding. 407.Ic kbd -l 408will list all available encodings. 409.Ic kbd xxx 410will select the 411.Ic xxx 412encoding. 413Store the encoding in 414.Pa /etc/kbdtype 415to make sure it is set automatically at boot time. 416.Ss Printers 417Edit 418.Pa /etc/printcap 419and 420.Pa /etc/hosts.lpd 421to get any printers set up. 422Consult 423.Xr lpd 8 424and 425.Xr printcap 5 426if needed. 427.Ss Mail aliases 428Edit 429.Pa /etc/mail/aliases 430and set the three standard aliases to go to either a mailing list, or 431the system administrator. 432.Bd -literal -offset indent 433# Well-known aliases -- these should be filled in! 434root: sysadm 435manager: root 436dumper: root 437.Ed 438.Pp 439Run 440.Xr newaliases 8 441after changes. 442.Ss Sendmail 443The default mail agent on 444.Ox 445is 446.Xr sendmail 8 . 447Details on how to configure an alternative mailer are documented in 448.Xr mailer.conf 5 . 449.Pp 450.Ox 451ships with a default 452.Pa /etc/mail/localhost.cf 453file that will work for simple installations; it was generated from 454.Pa openbsd-localhost.mc 455in 456.Pa /usr/share/sendmail/cf . 457Please see 458.Pa /usr/share/sendmail/README 459and 460.Pa /usr/share/doc/smm/08.sendmailop/op.me 461for information on generating your own sendmail configuration files. 462For the default installation, sendmail is configured to only accept 463connections from the local host and to not accept connections on 464any external interfaces. 465This makes it possible to send mail locally, but not receive mail from remote 466servers, which is ideal if you have one central incoming mail machine and 467several clients. 468To cause sendmail to accept external network connections, modify the 469.Va sendmail_flags 470variable in 471.Pa /etc/rc.conf.local 472to use the 473.Pa /etc/mail/sendmail.cf 474file in accordance with the comments therein. 475This file was generated from 476.Pa openbsd-proto.mc . 477.Pp 478Note that sendmail now also listens on port 587 by default. 479This is to implement the RFC 2476 message submission protocol. 480You may disable this via the 481.Ic no_default_msa 482option in your sendmail .mc file. 483See 484.Pa /usr/share/sendmail/README 485for more information. 486.Ss Daily, weekly, monthly scripts 487Look at and possibly edit the 488.Pa /etc/daily , /etc/weekly , 489and 490.Pa /etc/monthly 491scripts. 492Your site specific things should go into 493.Pa /etc/daily.local , /etc/weekly.local , 494and 495.Pa /etc/monthly.local . 496.Pp 497These scripts have been limited so as to keep the system running without 498filling up disk space from normal running processes and database updates. 499(You probably do not need to understand them.) 500.Pp 501The 502.Pa /etc/daily 503script provides a means to perform a daily backup of the root filesystem. 504See 505.Xr daily 8 506for more information. 507.Ss Tighten up security 508You might wish to tighten up security more by editing 509.Pa /etc/fbtab 510as when installing X. 511In 512.Pa /etc/inetd.conf 513comment out any extra entries you do not need, 514and only add things that are really needed. 515.Ss Other files in /etc 516Look at the other files in 517.Pa /etc 518and edit them as needed. 519(Do not edit files ending in 520.Pa .db 521\(em like 522.Pa pwd.db , spwd.db , 523nor 524.Pa localtime , 525nor 526.Pa rmt , 527nor any directories.) 528.Ss Crontab (background running processes) 529Check what is running by typing 530.Ic crontab -l 531as root 532and see if anything unexpected is present. 533Do you need anything else? 534Do you wish to change things? 535For example, if you do not 536like root getting standard output of the daily scripts, and want only 537the security scripts that are mailed internally, you can type 538.Ic crontab -e 539and change some of the lines to read: 540.Bd -literal -offset indent 54130 1 * * * /bin/sh /etc/daily 2>&1 > /var/log/daily.out 54230 3 * * 6 /bin/sh /etc/weekly 2>&1 > /var/log/weekly.out 54330 5 1 * * /bin/sh /etc/monthly 2>&1 > /var/log/monthly.out 544.Ed 545.Pp 546See 547.Xr crontab 5 . 548.Ss Next day cleanup 549After the first night's security run, change ownerships and permissions 550on files, directories, and devices; root should have received mail 551with subject: "<hostname> daily insecurity output.". 552This mail contains 553a set of security recommendations, presented as a list looking like this: 554.Bd -literal -offset indent 555var/mail: 556 permissions (0755, 0775) 557etc/daily: 558 user (0, 3) 559.Ed 560.Pp 561The best bet is to follow the advice in that list. 562The recommended setting is the first item in parentheses, while 563the current setting is the second one. 564This list is generated by 565.Xr mtree 8 566using 567.Pa /etc/mtree/special . 568Use 569.Xr chmod 1 , 570.Xr chgrp 1 , 571and 572.Xr chown 8 573as needed. 574.Ss Daemons 575Enable/disable any daemon processes as necessary. 576.Xr intro 8 577contains a comprehensive guide to the various daemons available on the 578.Ox 579system. 580.Ss Packages 581Install your own packages. 582The 583.Ox 584ports collection includes a large set of third-party software. 585A lot of it is available as binary packages that you can download from 586.Pa ftp://ftp.openbsd.org 587or a mirror, and install using 588.Xr pkg_add 1 . 589See 590.Xr ports 7 591and 592.Xr packages 7 593for more details. 594.Pp 595Copy vendor binaries and install them. 596You will need to install any shared libraries, etc. 597Read the compat_* man pages 598to find out how to install and use compatibility mode. 599.Pp 600There is also other third-party software that is available 601in source form only, either because it has not been ported to 602.Ox 603yet, or because licensing restrictions make binary redistribution 604impossible. 605Sometimes checking the mailing lists for 606past problems that people have encountered will result in a fix posted. 607.Ss Compiling a kernel 608Information on building and modifying kernels 609is contained within 610.Xr config 8 . 611.Sh SEE ALSO 612.Xr ksh 1 , 613.Xr man 1 , 614.Xr pkg_add 1 , 615.Xr ps 1 , 616.Xr vi 1 , 617.Xr hier 7 , 618.Xr config 8 , 619.Xr dmesg 8 , 620.Xr ifconfig 8 , 621.Xr intro 8 , 622.Xr sudo 8 , 623.Xr sysctl 8 624.Sh HISTORY 625This document first appeared in 626.Ox 2.2 . 627