1.\" $OpenBSD: afterboot.8,v 1.157 2016/09/05 12:58:17 jmc Exp $ 2.\" 3.\" Copyright (c) 1997 Marshall M. Midden 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. All advertising materials mentioning features or use of this software 16.\" must display the following acknowledgement: 17.\" This product includes software developed by Marshall M. Midden. 18.\" 4. The name of the author may not be used to endorse or promote products 19.\" derived from this software without specific prior written permission. 20.\" 21.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31.\" 32.Dd $Mdocdate: September 5 2016 $ 33.Dt AFTERBOOT 8 34.\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu 35.Os 36.Sh NAME 37.Nm afterboot 38.Nd things to check after the first complete boot 39.Sh DESCRIPTION 40.Ss Starting out 41This document attempts to list items for the system administrator 42to check and set up after the installation and first complete boot of the 43system. 44The idea is to create a list of items that can be checked off so that you have 45a warm fuzzy feeling that something obvious has not been missed. 46A basic knowledge of 47.Ux 48is assumed, otherwise type: 49.Pp 50.Dl $ help 51.Pp 52Complete instructions for correcting and fixing items is not provided. 53There are manual pages and other methodologies available for doing that. 54For example, to view the man page for the 55.Xr ls 1 56command, type: 57.Pp 58.Dl $ man 1 ls 59.Pp 60Administrators will rapidly become more familiar with 61.Ox 62if they get used to using the high quality manual pages. 63.Ss Errata 64By the time that you have installed your system, it is quite likely that 65bugs in the release have been found. 66Any security or reliability fixes can be found at 67.Lk https://www.openbsd.org/errata.html . 68It is recommended to check this page regularly. 69.Ss Login 70Log in on the console, or over the network using 71.Xr ssh 1 . 72For security reasons, it is bad practice to log in as root during regular use 73and maintenance of the system. 74Instead, administrators are encouraged to add a 75.Dq regular 76user, add said user to the 77.Dq wheel 78group, then use the 79.Xr su 1 80and 81.Xr doas 1 82commands when root privileges are required. 83.Pp 84The installation process provides an option to set up a user account. 85By default, accounts created via this method are automatically added to 86the 87.Dq wheel 88group. 89If that option was not used, see the paragraph 90.Sx Add new users 91below. 92.Pp 93To deny root logins over the network, edit the 94.Pa /etc/ssh/sshd_config 95file and set 96.Cm PermitRootLogin 97to 98.Dq no 99(see 100.Xr sshd_config 5 ) . 101.Ss Root password 102Change the password for the root user. 103(Note that throughout the documentation, the term 104.Dq superuser 105is a synonym for the root user.) 106Choose a password that has digits and special characters 107as well as from the upper and lower case alphabet. 108Do not choose any word in any language. 109It is common for an intruder to use dictionary attacks. 110Type the following command to change it: 111.Pp 112.Dl $ doas passwd root 113.Pp 114To avoid the possibility of rogue files placed in 115the superuser's 116.Ev PATH , 117it should never contain the current directory 118.Pq Dq \&. . 119.Ss System date 120.Xr ntpd 8 121is used to automatically synchronize clocks with remote NTP servers. 122You can use 123.Xr ntpctl 8 124to check the status. 125To change the NTP server see 126.Xr ntpd.conf 5 . 127.Pp 128Check the system date with the 129.Xr date 1 130command. 131If needed, change the date, and/or change the symbolic link of 132.Pa /etc/localtime 133to the correct time zone in the 134.Pa /usr/share/zoneinfo 135directory. 136.Pp 137Examples: 138.Pp 139Set the current date to January 27th, 2016 3:04pm: 140.Dl # date 201601271504 141.Pp 142Set the time zone to Atlantic Standard Time: 143.Dl # ln -fs /usr/share/zoneinfo/Canada/Atlantic /etc/localtime 144.Ss Check hostname 145Use the 146.Ic hostname 147command to verify that the name of your machine is correct. 148See the man page for 149.Xr hostname 1 150if it needs to be changed. 151You will also need to edit the 152.Pa /etc/myname 153file to have it stick around for the next reboot. 154.Ss Verify network interface configuration 155The first thing to do is an 156.Ic ifconfig -a 157to see if the network interfaces are properly configured. 158Correct by editing 159.Pa /etc/hostname. Ns Ar interface 160(where 161.Ar interface 162is the interface name, e.g., 163.Dq em0 ) 164and then using 165.Xr ifconfig 8 166to manually configure it 167if you do not wish to reboot. 168Read the 169.Xr hostname.if 5 170man page for more information on the format of 171.Pa /etc/hostname. Ns Ar interface 172files. 173The loopback interface will look something like: 174.Bd -literal -offset indent 175lo0: flags=8009<UP,LOOPBACK,MULTICAST> mtu 32972 176 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 177 inet6 ::1 prefixlen 128 178 inet 127.0.0.1 netmask 0xff000000 179.Ed 180.Pp 181an Ethernet interface something like: 182.Bd -literal -offset indent 183em0: flags=9863<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> 184 inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255 185 inet6 fe80::5ef0:f0f0%em0 prefixlen 64 scopeid 0x1 186.Ed 187.Pp 188and a PPP interface something like: 189.Bd -literal -offset indent 190ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> 191 inet 203.3.131.108 --> 198.181.0.253 netmask 0xffff0000 192.Ed 193.Pp 194See 195.Xr netstart 8 196for instructions on configuring multicast routing. 197.Pp 198See 199.Xr hostname.if 5 200for instructions on configuring interfaces with DHCP. 201.Ss Check routing tables 202Issue a 203.Ic netstat -rn 204command. 205The output will look something like: 206.Bd -literal -offset indent 207Routing tables 208 209Internet: 210Destination Gateway Flags Refs Use Mtu Interface 211default 192.168.4.254 UGS 0 11098028 - em0 212127 127.0.0.1 UGRS 0 0 - lo0 213127.0.0.1 127.0.0.1 UH 3 24 - lo0 214192.168.4 link#1 UC 0 0 - em0 215192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - em0 216192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - em0 217 218Internet6: 219Destination Gateway Flags Refs Use Mtu Interface 220::/96 ::1 UGRS 0 0 32972 lo0 => 221::1 ::1 UH 4 0 32972 lo0 222::ffff:0.0.0.0/96 ::1 UGRS 0 0 32972 lo0 223fc80::/10 ::1 UGRS 0 0 32972 lo0 224fe80::/10 ::1 UGRS 0 0 32972 lo0 225fe80::%em0/64 link#1 UC 0 0 1500 em0 226fe80::%lo0/64 fe80::1%lo0 U 0 0 32972 lo0 227ff01::/32 ::1 U 0 0 32972 lo0 228ff02::%em0/32 link#1 UC 0 0 1500 em0 229ff02::%lo0/32 fe80::1%lo0 UC 0 0 32972 lo0 230.Ed 231.Pp 232The default gateway address is stored in the 233.Pa /etc/mygate 234file. 235If you need to edit this file, a painless way to reconfigure the network 236afterwards is 237.Ic route flush 238followed by a 239.Ic sh -x /etc/netstart 240command. 241Or, you may prefer to manually configure using a series of 242.Ic route add 243and 244.Ic route delete 245commands (see 246.Xr route 8 ) . 247If you run 248.Xr dhclient 8 249you will have to kill it by running 250.Ic pkill dhclient 251after you flush the routes. 252.Pp 253If you wish to route packets between interfaces, add one or both 254of the following directives (depending on whether IPv4 or IPv6 routing 255is required) to 256.Pa /etc/sysctl.conf : 257.Pp 258.Dl net.inet.ip.forwarding=1 259.Dl net.inet6.ip6.forwarding=1 260.Pp 261Packets are not forwarded by default, due to RFC requirements. 262.Ss Check DNS 263Use 264.Xr host 1 265or 266.Xr dig 1 267to check that domain name resolution is working properly. 268.Pp 269Most likely, the IP address of at least one domain name server 270was added to 271.Xr resolv.conf 5 272while installing the system. 273If DHCP is in use, it will overwrite 274.Pa /etc/resolv.conf 275every time 276.Xr dhclient 8 277is run but 278.Pa /etc/resolv.conf.tail 279can be used to add options and extra name servers to those received 280dynamically. 281.Pp 282A 283.Xr hosts 5 284file can be used if there is a need for system specific name 285resolution entries. 286.Ss Check disk mounts 287Check that the disks are mounted correctly by 288comparing the 289.Pa /etc/fstab 290file against the output of the 291.Xr mount 8 292and 293.Xr df 1 294commands. 295Example: 296.Bd -literal -offset indent 297# cat /etc/fstab 298/dev/sd0a / ffs rw 1 1 299/dev/sd0d /usr ffs rw,nodev 1 2 300/dev/sd0e /var ffs rw,nodev,nosuid 1 3 301/dev/sd0g /tmp ffs rw,nodev,nosuid 1 4 302/dev/sd0h /home ffs rw,nodev,nosuid 1 5 303 304# mount 305/dev/sd0a on / type ffs (local) 306/dev/sd0d on /usr type ffs (local, nodev) 307/dev/sd0e on /var type ffs (local, nodev, nosuid) 308/dev/sd0g on /tmp type ffs (local, nodev, nosuid) 309/dev/sd0h on /home type ffs (local, nodev, nosuid) 310 311# df 312Filesystem 1024-blocks Used Avail Capacity Mounted on 313/dev/sd0a 22311 14589 6606 69% / 314/dev/sd0d 203399 150221 43008 78% /usr 315/dev/sd0e 10447 682 9242 7% /var 316/dev/sd0g 18823 2 17879 0% /tmp 317/dev/sd0h 7519 5255 1888 74% /home 318 319# pstat -s 320Device 512-blocks Used Avail Capacity Priority 321/dev/sd0b 131072 84656 46416 65% 0 322.Ed 323.Pp 324Edit 325.Pa /etc/fstab 326and use the 327.Xr mount 8 328and 329.Xr umount 8 330commands as appropriate. 331Refer to the above example and 332.Xr fstab 5 333for information on the format of this file. 334.Pp 335You may wish to do NFS partitions now too, or you can do them later. 336.Ss Check the running system 337You can use 338.Xr ps 1 , 339.Xr netstat 1 , 340and 341.Xr fstat 1 342to check on running processes, network connections, and opened files, 343respectively. 344.Sh FURTHER CHANGES 345The system should be usable now, but you may wish to do more customizing, 346such as adding users, etc. 347Many of the following sections may be skipped 348if you are not using that package. 349We suggest that you 350.Ic cd /etc 351and edit any files in that directory as necessary. 352.Pp 353Note that the 354.Pa /etc/motd 355file is modified by 356.Pa /etc/rc 357whenever the system is booted. 358To keep any custom message intact, ensure that you leave two blank lines 359at the top, or your message will be overwritten. 360.Ss Add new users 361Add users. 362There is an 363.Xr adduser 8 364script. 365You may use 366.Xr vipw 8 367to add users to the 368.Pa /etc/passwd 369file 370and edit 371.Pa /etc/group 372by hand to add new groups. 373You may also wish to edit 374.Pa /etc/login.conf 375and tune some of the limits documented in 376.Xr login.conf 5 . 377The manual page for 378.Xr su 1 379tells you to make sure to put people in 380the 381.Sq wheel 382group if they need root access. 383For example: 384.Pp 385.Dl wheel:*:0:root,myself 386.Ss System command scripts 387The 388.Pa /etc/rc.*\& 389scripts are invoked at boot time, after single-user mode has exited, 390and at shutdown. 391The whole process is controlled, more or less, by the master script 392.Pa /etc/rc . 393This script should not be changed by administrators. 394.Pp 395.Pa /etc/rc 396is in turn influenced by the configuration variables present in 397.Pa /etc/rc.conf . 398Again this script should not be changed by administrators: 399site-specific changes should be made to 400.Pq freshly created if necessary 401.Pa /etc/rc.conf.local 402or by using the 403.Xr rcctl 8 404utility. 405.Pp 406Any commands which should be run before the system sets its 407secure level should be made to 408.Pa /etc/rc.securelevel , 409and commands to be run after the system sets its 410secure level should be made to 411.Pa /etc/rc.local . 412Commands to be run before system shutdown should be set in 413.Pa /etc/rc.shutdown . 414.Pp 415For more information about system startup/shutdown files, see 416.Xr rc 8 , 417.Xr rc.conf 8 , 418.Xr securelevel 7 , 419and 420.Xr rc.shutdown 8 . 421.Pp 422If you've installed X, you may want to turn on 423.Xr xdm 1 , 424the X Display Manager. 425To do this, change the value of 426.Va xdm_flags 427in 428.Pa /etc/rc.conf.local . 429.Ss Set keyboard type 430Some architectures permit keyboard type control. 431Use the 432.Xr kbd 8 433command to change the keyboard encoding. 434.Ic kbd -l 435will list all available encodings. 436.Ic kbd xxx 437will select the 438.Ic xxx 439encoding. 440Store the encoding in 441.Pa /etc/kbdtype 442to make sure it is set automatically at boot time. 443.Ss Printers 444Edit 445.Pa /etc/printcap 446and 447.Pa /etc/hosts.lpd 448to get any printers set up. 449Consult 450.Xr lpd 8 451and 452.Xr printcap 5 453if needed. 454.Ss Mail aliases 455Edit 456.Pa /etc/mail/aliases 457and set the three standard aliases to go to either a mailing list, or 458the system administrator. 459.Bd -literal -offset indent 460# Well-known aliases -- these should be filled in! 461root: sysadm 462manager: root 463dumper: root 464.Ed 465.Ss Mail 466The default mail agent on 467.Ox 468is 469.Xr smtpd 8 . 470Details on how to configure an alternative mailer are documented in 471.Xr mailer.conf 5 . 472.Pp 473.Ox 474ships with a default 475.Pa /etc/mail/smtpd.conf 476file that will work for simple installations. 477See 478.Xr smtpd.conf 5 479for information on configuring more complex setups. 480For the default installation, 481.Xr smtpd 8 482is configured to only accept connections from the local host. 483This makes it possible to send mail locally, but not receive mail from remote 484servers, which is ideal if you have one central incoming mail machine and 485several clients. 486To cause smtpd to accept external network connections, modify the 487.Va listen 488directive in 489.Pa /etc/mail/smtpd.conf 490to include the interfaces to listen on. 491.Ss Daily, weekly, monthly scripts 492Review 493.Xr daily 8 494to understand what the periodic system maintenance scripts do and 495how to customize them: 496For example, to enable 497.Ev ROOTBACKUP 498or to disable 499.Ev VERBOSESTATUS , 500or to add local maintenance code to 501.Pa /etc/daily.local , /etc/weekly.local , 502or 503.Pa /etc/monthly.local . 504.Ss Tighten up security 505You might wish to tighten up security more by editing 506.Pa /etc/fbtab 507as when installing X. 508Look at the other files in 509.Pa /etc 510and edit them as needed. 511(Do not edit files ending in 512.Pa .db 513\(em like 514.Pa pwd.db , spwd.db , 515nor 516.Pa localtime , 517nor 518.Pa rmt , 519nor any directories.) 520.Ss Crontab (background running processes) 521Check what is running by typing 522.Ic crontab -l 523as root 524and see if anything unexpected is present. 525Do you need anything else? 526Do you wish to change things? 527See 528.Xr crontab 5 . 529.Ss Next day cleanup 530After the first night's 531.Xr security 8 532run, change ownerships and permissions 533on files, directories, and devices; root may have received mail 534with subject: "<hostname> daily insecurity output". 535This mail contains a set of security recommendations, 536presented as a list looking something like this: 537.Bd -literal -offset indent 538var/mail: 539 permissions (0755, 0775) 540etc/daily: 541 user (0, 3) 542.Ed 543.Pp 544The best bet is to follow the advice in that list. 545The recommended setting is the first item in parentheses, while 546the current setting is the second one. 547This list is generated by 548.Xr mtree 8 549using 550.Pa /etc/mtree/special . 551Use 552.Xr chmod 1 , 553.Xr chgrp 1 , 554and 555.Xr chown 8 556as needed. 557.Ss Daemons 558Enable/disable any daemon processes as necessary. 559.Xr intro 8 560contains a comprehensive guide to the various daemons available on the 561.Ox 562system. 563.Ss Packages 564Install your own packages. 565The 566.Ox 567ports collection includes a large set of third-party software. 568A lot of it is available as binary packages that you can install using 569.Xr pkg_add 1 . 570See 571.Xr ports 7 572and 573.Xr packages 7 574for more details. 575To start daemons installed from packages, see 576.Xr rc.d 8 . 577.Pp 578There is also other third-party software that is available 579in source form only, either because it has not been ported to 580.Ox 581yet, or because licensing restrictions make binary redistribution 582impossible. 583Sometimes checking the mailing lists for 584past problems that people have encountered will result in a fix posted. 585.Ss Compiling a kernel 586Information on building and modifying kernels 587is contained within 588.Xr config 8 . 589.Sh SEE ALSO 590.Xr doas 1 , 591.Xr ksh 1 , 592.Xr man 1 , 593.Xr pkg_add 1 , 594.Xr ps 1 , 595.Xr vi 1 , 596.Xr hier 7 , 597.Xr config 8 , 598.Xr dmesg 8 , 599.Xr ifconfig 8 , 600.Xr intro 8 , 601.Xr rcctl 8 , 602.Xr sysctl 8 603.Sh HISTORY 604This document first appeared in 605.Ox 2.2 . 606