1.\" $OpenBSD: afterboot.8,v 1.135 2011/06/11 17:52:00 lum Exp $ 2.\" 3.\" Copyright (c) 1997 Marshall M. Midden 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. All advertising materials mentioning features or use of this software 16.\" must display the following acknowledgement: 17.\" This product includes software developed by Marshall M. Midden. 18.\" 4. The name of the author may not be used to endorse or promote products 19.\" derived from this software without specific prior written permission. 20.\" 21.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31.\" 32.Dd $Mdocdate: June 11 2011 $ 33.Dt AFTERBOOT 8 34.\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu 35.Os 36.Sh NAME 37.Nm afterboot 38.Nd things to check after the first complete boot 39.Sh DESCRIPTION 40.Ss Starting out 41This document attempts to list items for the system administrator 42to check and set up after the installation and first complete boot of the 43system. 44The idea is to create a list of items that can be checked off so that you have 45a warm fuzzy feeling that something obvious has not been missed. 46A basic knowledge of 47.Ux 48is assumed, otherwise type: 49.Pp 50.Dl $ help 51.Pp 52Complete instructions for correcting and fixing items is not provided. 53There are manual pages and other methodologies available for doing that. 54For example, to view the man page for the 55.Xr ls 1 56command, type: 57.Pp 58.Dl $ man 1 ls 59.Pp 60Administrators will rapidly become more familiar with 61.Ox 62if they get used to using the high quality manual pages. 63.Ss Errata 64By the time that you have installed your system, it is quite likely that 65bugs in the release have been found. 66Any security or reliability fixes can be found at 67.Pa http://www.openbsd.org/errata.html . 68It is recommended to check this page regularly. 69.Ss Login 70Log in on the console, or over the network using 71.Xr ssh 1 . 72For security reasons, it is bad practice to log in as root during regular use 73and maintenance of the system. 74Instead, administrators are encouraged to add a 75.Dq regular 76user, add said user to the 77.Dq wheel 78group, then use the 79.Xr su 1 80and 81.Xr sudo 8 82commands when root privileges are required. 83.Pp 84The installation process provides an option to set up a user account. 85By default, accounts created via this method are automatically added to 86the 87.Dq wheel 88group. 89If that option was not used, see the paragraph 90.Sx Add new users 91below. 92.Pp 93To deny root logins over the network, edit the 94.Pa /etc/ssh/sshd_config 95file and set 96.Cm PermitRootLogin 97to 98.Dq no 99(see 100.Xr sshd_config 5 ) . 101.Ss Root password 102Change the password for the root user. 103(Note that throughout the documentation, the term 104.Dq superuser 105is a synonym for the root user.) 106Choose a password that has digits and special characters (not space) 107as well as from the upper and lower case alphabet. 108Do not choose any word in any language. 109It is common for an intruder to use dictionary attacks. 110Type the following command to change it: 111.Pp 112.Dl $ /usr/bin/sudo /usr/bin/passwd root 113.Pp 114It is a good idea to always specify the full path name for the 115.Xr passwd 1 , 116.Xr su 1 117and 118.Xr sudo 8 119commands as this inhibits the possibility of rogue files placed in your 120.Ev PATH 121being executed for most shells. 122Furthermore, the superuser's 123.Ev PATH 124should never contain the current directory 125.Pq Dq \&. . 126.Ss System date 127Check the system date with the 128.Xr date 1 129command. 130If needed, change the date, and/or change the symbolic link of 131.Pa /etc/localtime 132to the correct time zone in the 133.Pa /usr/share/zoneinfo 134directory. 135.Pp 136Examples: 137.Pp 138Set the current date to January 27th, 1999 3:04pm: 139.Dl # date 199901271504 140.Pp 141Set the time zone to Atlantic Standard Time: 142.Dl # ln -fs /usr/share/zoneinfo/Canada/Atlantic /etc/localtime 143.Ss Check hostname 144Use the 145.Ic hostname 146command to verify that the name of your machine is correct. 147See the man page for 148.Xr hostname 1 149if it needs to be changed. 150You will also need to edit the 151.Pa /etc/myname 152file to have it stick around for the next reboot. 153.Ss Verify network interface configuration 154The first thing to do is an 155.Ic ifconfig -a 156to see if the network interfaces are properly configured. 157Correct by editing 158.Pa /etc/hostname. Ns Ar interface 159(where 160.Ar interface 161is the interface name, e.g., 162.Dq le0 ) 163and then using 164.Xr ifconfig 8 165to manually configure it 166if you do not wish to reboot. 167Read the 168.Xr hostname.if 5 169man page for more information on the format of 170.Pa /etc/hostname. Ns Ar interface 171files. 172The loopback interface will look something like: 173.Bd -literal -offset indent 174lo0: flags=8009<UP,LOOPBACK,MULTICAST> mtu 32972 175 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 176 inet6 ::1 prefixlen 128 177 inet 127.0.0.1 netmask 0xff000000 178.Ed 179.Pp 180an Ethernet interface something like: 181.Bd -literal -offset indent 182le0: flags=9863<UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST> 183 inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255 184 inet6 fe80::5ef0:f0f0%le0 prefixlen 64 scopeid 0x1 185.Ed 186.Pp 187and a PPP interface something like: 188.Bd -literal -offset indent 189ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> 190 inet 203.3.131.108 --> 198.181.0.253 netmask 0xffff0000 191.Ed 192.Pp 193See 194.Xr netstart 8 195for instructions on configuring multicast routing. 196.Pp 197See 198.Xr dhcp 8 199for instructions on configuring interfaces with DHCP. 200.Ss Check routing tables 201Issue a 202.Ic netstat -rn 203command. 204The output will look something like: 205.Bd -literal -offset indent 206Routing tables 207 208Internet: 209Destination Gateway Flags Refs Use Mtu Interface 210default 192.168.4.254 UGS 0 11098028 - le0 211127 127.0.0.1 UGRS 0 0 - lo0 212127.0.0.1 127.0.0.1 UH 3 24 - lo0 213192.168.4 link#1 UC 0 0 - le0 214192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - le0 215192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - le0 216 217Internet6: 218Destination Gateway Flags Refs Use Mtu Interface 219::/96 ::1 UGRS 0 0 32972 lo0 => 220::1 ::1 UH 4 0 32972 lo0 221::ffff:0.0.0.0/96 ::1 UGRS 0 0 32972 lo0 222fc80::/10 ::1 UGRS 0 0 32972 lo0 223fe80::/10 ::1 UGRS 0 0 32972 lo0 224fe80::%le0/64 link#1 UC 0 0 1500 le0 225fe80::%lo0/64 fe80::1%lo0 U 0 0 32972 lo0 226ff01::/32 ::1 U 0 0 32972 lo0 227ff02::%le0/32 link#1 UC 0 0 1500 le0 228ff02::%lo0/32 fe80::1%lo0 UC 0 0 32972 lo0 229.Ed 230.Pp 231The default gateway address is stored in the 232.Pa /etc/mygate 233file. 234If you need to edit this file, a painless way to reconfigure the network 235afterwards is 236.Ic route flush 237followed by a 238.Ic sh -x /etc/netstart 239command. 240Or, you may prefer to manually configure using a series of 241.Ic route add 242and 243.Ic route delete 244commands (see 245.Xr route 8 ) . 246If you run 247.Xr dhclient 8 248you will have to kill it by running 249.Ic pkill dhclient 250after you flush the routes. 251.Pp 252If you wish to route packets between interfaces, add one or both 253of the following directives (depending on whether IPv4 or IPv6 routing 254is required) to 255.Pa /etc/sysctl.conf : 256.Pp 257.Dl net.inet.ip.forwarding=1 258.Dl net.inet6.ip6.forwarding=1 259.Pp 260Packets are not forwarded by default, due to RFC requirements. 261.Ss Check DNS 262Use 263.Xr host 1 264or 265.Xr dig 1 266to check that domain name resolution is working properly. 267.Pp 268Most likely, the IP address of at least one domain name server 269was added to 270.Xr resolv.conf 5 271while installing the system. 272If DHCP is in use, it will overwrite 273.Pa /etc/resolv.conf 274every time 275.Xr dhclient-script 8 276is run but 277.Pa /etc/resolv.conf.tail 278can be used to add options and extra name servers to those received 279dynamically. 280.Pp 281A 282.Xr hosts 5 283file can be used if there is a need for system specific name 284resolution entries. 285.Ss Check disk mounts 286Check that the disks are mounted correctly by 287comparing the 288.Pa /etc/fstab 289file against the output of the 290.Xr mount 8 291and 292.Xr df 1 293commands. 294Example: 295.Bd -literal -offset indent 296# cat /etc/fstab 297/dev/sd0a / ffs rw 1 1 298/dev/sd0d /usr ffs rw,nodev 1 2 299/dev/sd0e /var ffs rw,nodev,nosuid 1 3 300/dev/sd0g /tmp ffs rw,nodev,nosuid 1 4 301/dev/sd0h /home ffs rw,nodev,nosuid 1 5 302 303# mount 304/dev/sd0a on / type ffs (local) 305/dev/sd0d on /usr type ffs (local, nodev) 306/dev/sd0e on /var type ffs (local, nodev, nosuid) 307/dev/sd0g on /tmp type ffs (local, nodev, nosuid) 308/dev/sd0h on /home type ffs (local, nodev, nosuid) 309 310# df 311Filesystem 1024-blocks Used Avail Capacity Mounted on 312/dev/sd0a 22311 14589 6606 69% / 313/dev/sd0d 203399 150221 43008 78% /usr 314/dev/sd0e 10447 682 9242 7% /var 315/dev/sd0g 18823 2 17879 0% /tmp 316/dev/sd0h 7519 5255 1888 74% /home 317 318# pstat -s 319Device 512-blocks Used Avail Capacity Priority 320/dev/sd0b 131072 84656 46416 65% 0 321.Ed 322.Pp 323Edit 324.Pa /etc/fstab 325and use the 326.Xr mount 8 327and 328.Xr umount 8 329commands as appropriate. 330Refer to the above example and 331.Xr fstab 5 332for information on the format of this file. 333.Pp 334You may wish to do NFS partitions now too, or you can do them later. 335.Ss Check the running system 336You can use 337.Xr ps 1 , 338.Xr netstat 1 , 339and 340.Xr fstat 1 341to check on running processes, network connections, and opened files, 342respectively. 343.Sh FURTHER CHANGES 344The system should be usable now, but you may wish to do more customizing, 345such as adding users, etc. 346Many of the following sections may be skipped 347if you are not using that package. 348We suggest that you 349.Ic cd /etc 350and edit any files in that directory as necessary. 351.Pp 352Note that the 353.Pa /etc/motd 354file is modified by 355.Pa /etc/rc 356whenever the system is booted. 357To keep any custom message intact, ensure that you leave two blank lines 358at the top, or your message will be overwritten. 359.Ss Add new users 360Add users. 361There is an 362.Xr adduser 8 363script. 364You may use 365.Xr vipw 8 366to add users to the 367.Pa /etc/passwd 368file 369and edit 370.Pa /etc/group 371by hand to add new groups. 372You may also wish to edit 373.Pa /etc/login.conf 374and tune some of the limits documented in 375.Xr login.conf 5 . 376The manual page for 377.Xr su 1 378tells you to make sure to put people in 379the 380.Sq wheel 381group if they need root access (non-Kerberos). 382For example: 383.Pp 384.Dl wheel:*:0:root,myself 385.Pp 386Follow instructions for 387.Xr login_krb5 8 388if using 389Kerberos 390for authentication. 391.Ss System command scripts 392The 393.Pa /etc/rc.*\& 394scripts are invoked at boot time, after single user mode has exited, 395and at shutdown. 396The whole process is controlled, more or less, by the master script 397.Pa /etc/rc . 398This script should not be changed by administrators. 399.Pp 400.Pa /etc/rc 401is in turn influenced by the configuration variables present in 402.Pa /etc/rc.conf . 403Again this script should not be changed by administrators: 404site-specific changes should be made to 405.Pq freshly created if necessary 406.Pa /etc/rc.conf.local . 407.Pp 408Any commands which should be run before the system sets its 409secure level should be made to 410.Pa /etc/rc.securelevel , 411and commands to be run after the system sets its 412secure level should be made to 413.Pa /etc/rc.local . 414Commands to be run before system shutdown should be set in 415.Pa /etc/rc.shutdown . 416.Pp 417For more information about system startup/shutdown files, see 418.Xr rc 8 , 419.Xr rc.conf 8 , 420.Xr securelevel 7 , 421and 422.Xr rc.shutdown 8 . 423.Pp 424If you've installed X, you may want to turn on 425.Xr xdm 1 , 426the X Display Manager. 427To do this, change the value of 428.Va xdm_flags 429in 430.Pa /etc/rc.conf.local . 431.Ss Set keyboard type 432Some architectures permit keyboard type control. 433Use the 434.Xr kbd 8 435command to change the keyboard encoding. 436.Ic kbd -l 437will list all available encodings. 438.Ic kbd xxx 439will select the 440.Ic xxx 441encoding. 442Store the encoding in 443.Pa /etc/kbdtype 444to make sure it is set automatically at boot time. 445.Ss Printers 446Edit 447.Pa /etc/printcap 448and 449.Pa /etc/hosts.lpd 450to get any printers set up. 451Consult 452.Xr lpd 8 453and 454.Xr printcap 5 455if needed. 456.Ss Mail aliases 457Edit 458.Pa /etc/mail/aliases 459and set the three standard aliases to go to either a mailing list, or 460the system administrator. 461.Bd -literal -offset indent 462# Well-known aliases -- these should be filled in! 463root: sysadm 464manager: root 465dumper: root 466.Ed 467.Pp 468Run 469.Xr newaliases 8 470after changes. 471.Ss Sendmail 472The default mail agent on 473.Ox 474is 475.Xr sendmail 8 . 476Details on how to configure an alternative mailer are documented in 477.Xr mailer.conf 5 . 478.Pp 479.Ox 480ships with a default 481.Pa /etc/mail/localhost.cf 482file that will work for simple installations; it was generated from 483.Pa openbsd-localhost.mc 484in 485.Pa /usr/share/sendmail/cf . 486Please see 487.Pa /usr/share/sendmail/README 488for information on generating your own sendmail configuration files. 489For the default installation, sendmail is configured to only accept 490connections from the local host and to not accept connections on 491any external interfaces. 492This makes it possible to send mail locally, but not receive mail from remote 493servers, which is ideal if you have one central incoming mail machine and 494several clients. 495To cause sendmail to accept external network connections, modify the 496.Va sendmail_flags 497variable in 498.Pa /etc/rc.conf.local 499to use the 500.Pa /etc/mail/sendmail.cf 501file in accordance with the comments therein. 502This file was generated from 503.Pa openbsd-proto.mc . 504.Pp 505Note that sendmail now also listens on port 587 by default. 506This is to implement the RFC 2476 message submission protocol. 507You may disable this via the 508.Ic no_default_msa 509option in your sendmail .mc file. 510See 511.Pa /usr/share/sendmail/README 512for more information. 513.Ss Daily, weekly, monthly scripts 514Review 515.Xr daily 8 516to understand what the periodic system maintenance scripts do and 517how to customize them: 518For example, to enable 519.Ev ROOTBACKUP 520or to disable 521.Ev VERBOSESTATUS , 522or to add local maintenance code to 523.Pa /etc/daily.local , /etc/weekly.local , 524or 525.Pa /etc/monthly.local . 526.Ss Tighten up security 527You might wish to tighten up security more by editing 528.Pa /etc/fbtab 529as when installing X. 530In 531.Pa /etc/inetd.conf 532comment out any extra entries you do not need, 533and only add things that are really needed. 534.Ss Other files in /etc 535Look at the other files in 536.Pa /etc 537and edit them as needed. 538(Do not edit files ending in 539.Pa .db 540\(em like 541.Pa pwd.db , spwd.db , 542nor 543.Pa localtime , 544nor 545.Pa rmt , 546nor any directories.) 547.Ss Crontab (background running processes) 548Check what is running by typing 549.Ic crontab -l 550as root 551and see if anything unexpected is present. 552Do you need anything else? 553Do you wish to change things? 554See 555.Xr crontab 5 . 556.Ss Next day cleanup 557After the first night's 558.Xr security 8 559run, change ownerships and permissions 560on files, directories, and devices; root may have received mail 561with subject: "<hostname> daily insecurity output". 562This mail contains a set of security recommendations, 563presented as a list looking something like this: 564.Bd -literal -offset indent 565var/mail: 566 permissions (0755, 0775) 567etc/daily: 568 user (0, 3) 569.Ed 570.Pp 571The best bet is to follow the advice in that list. 572The recommended setting is the first item in parentheses, while 573the current setting is the second one. 574This list is generated by 575.Xr mtree 8 576using 577.Pa /etc/mtree/special . 578Use 579.Xr chmod 1 , 580.Xr chgrp 1 , 581and 582.Xr chown 8 583as needed. 584.Ss Daemons 585Enable/disable any daemon processes as necessary. 586.Xr intro 8 587contains a comprehensive guide to the various daemons available on the 588.Ox 589system. 590.Ss Packages 591Install your own packages. 592The 593.Ox 594ports collection includes a large set of third-party software. 595A lot of it is available as binary packages that you can download from 596.Pa ftp://ftp.openbsd.org 597or a mirror, and install using 598.Xr pkg_add 1 . 599See 600.Xr ports 7 601and 602.Xr packages 7 603for more details. 604.Pp 605Copy vendor binaries and install them. 606You will need to install any shared libraries, etc. 607Read the compat_* man pages 608to find out how to install and use compatibility mode. 609.Pp 610There is also other third-party software that is available 611in source form only, either because it has not been ported to 612.Ox 613yet, or because licensing restrictions make binary redistribution 614impossible. 615Sometimes checking the mailing lists for 616past problems that people have encountered will result in a fix posted. 617.Ss Compiling a kernel 618Information on building and modifying kernels 619is contained within 620.Xr config 8 . 621.Sh SEE ALSO 622.Xr ksh 1 , 623.Xr man 1 , 624.Xr pkg_add 1 , 625.Xr ps 1 , 626.Xr vi 1 , 627.Xr hier 7 , 628.Xr config 8 , 629.Xr dmesg 8 , 630.Xr ifconfig 8 , 631.Xr intro 8 , 632.Xr sudo 8 , 633.Xr sysctl 8 634.Sh HISTORY 635This document first appeared in 636.Ox 2.2 . 637