| blob | aaa182bc861e6a56753384037b8b2636e1613b32 |
1 .\" $NetBSD: afterboot.8,v 1.41 2009/10/24 11:24:19 reed Exp $
2 .\" $OpenBSD: afterboot.8,v 1.72 2002/02/22 02:02:33 miod Exp $
3 .\"
4 .\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu
5 .\" Adapted to NetBSD by Julio Merino -- 2002-05-10, jmmv@NetBSD.org
6 .\"
7 .\"
8 .\" Copyright (c) 2002-2008 The NetBSD Foundation, Inc.
9 .\" All rights reserved.
10 .\"
11 .\" Redistribution and use in source and binary forms, with or without
12 .\" modification, are permitted provided that the following conditions
13 .\" are met:
14 .\" 1. Redistributions of source code must retain the above copyright
15 .\" notice, this list of conditions and the following disclaimer.
16 .\" 2. Redistributions in binary form must reproduce the above copyright
17 .\" notice, this list of conditions and the following disclaimer in the
18 .\" documentation and/or other materials provided with the distribution.
19 .\"
20 .\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21 .\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22 .\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23 .\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24 .\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25 .\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26 .\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27 .\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28 .\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30 .\" POSSIBILITY OF SUCH DAMAGE.
31 .\"
32 .\"
33 .\" Copyright (c) 1997 Marshall M. Midden
34 .\" All rights reserved.
35 .\"
36 .\" Redistribution and use in source and binary forms, with or without
37 .\" modification, are permitted provided that the following conditions
38 .\" are met:
39 .\"
40 .\" 1. Redistributions of source code must retain the above copyright
41 .\" notice, this list of conditions and the following disclaimer.
42 .\" 2. Redistributions in binary form must reproduce the above copyright
43 .\" notice, this list of conditions and the following disclaimer in the
44 .\" documentation and/or other materials provided with the distribution.
45 .\" 3. All advertising materials mentioning features or use of this software
46 .\" must display the following acknowledgement:
47 .\" This product includes software developed by Marshall M. Midden.
48 .\" 4. The name of the author may not be used to endorse or promote products
49 .\" derived from this software without specific prior written permission.
50 .\"
51 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
52 .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
53 .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
54 .\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
55 .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
56 .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
57 .\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
58 .\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
59 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
60 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
61 .\"
62 .Dd May 18, 2009
63 .Dt AFTERBOOT 8
64 .Os
65 .Sh NAME
66 .Nm afterboot
67 .Nd things to check after the first complete boot
68 .Sh DESCRIPTION
69 .Ss Starting Out
70 This document attempts to list items for the system administrator
71 to check and set up after the installation and first complete boot of the
72 system.
73 The idea is to create a list of items that can be checked off so that you have
74 a warm fuzzy feeling that something obvious has not been missed.
75 A basic knowledge of
76 .Ux
77 is assumed.
78 .Pp
79 Complete instructions for correcting and fixing items is not provided.
80 There are manual pages and other methodologies available for doing that.
81 For example, to view the man page for the
82 .Xr ls 1
83 command, type:
84 .Bd -literal -offset indent
85 .Ic man 1 ls
86 .Ed
87 .Pp
88 Administrators will rapidly become more familiar with
89 .Nx
90 if they get used to using the manual pages.
91 .Ss Security alerts
92 By the time that you have installed your system, it is quite likely that
93 bugs in the release have been found.
94 All significant and easily fixed problems will be reported at
95 .Pa http://www.NetBSD.org/support/security/ .
96 It is recommended that you check this page regularly.
97 .Ss Login
98 Login as
99 .Dq Ic root .
100 You can do so on the console, or over the network using
101 .Xr ssh 1 .
102 If you have enabled the ssh daemon and wish to allow root logins over
103 the network, edit the
104 .Pa /etc/ssh/sshd_config
105 file and set
106 .Cm PermitRootLogin
107 to
108 .Dq yes
109 (see
110 .Xr sshd_config 5 ) .
111 The default is to not permit root logins over the network
112 after fresh install in
113 .Nx .
114 .Pp
115 Upon successful login on the console, you may see the message
116 .Dq We recommend creating a non-root account... .
117 For security reasons, it is bad practice to login as root during
118 regular use and maintenance of the system.
119 In fact, the system will only let you login as root on a secure
120 terminal.
121 By default, only the console is considered to be a secure terminal.
122 Instead, administrators are encouraged to add a
123 .Dq regular
124 user, add said user to the
125 .Dq wheel
126 group, then use the
127 .Xr su 1
128 command when root privileges are required.
129 This process is described in more detail later.
130 .Ss Root password
131 Change the password for the root user.
132 (Note that throughout the documentation, the term
133 .Dq superuser
134 is a synonym for the root user.)
135 Choose a password that has numbers, digits, and special characters (not space)
136 as well as from the upper and lower case alphabet.
137 Do not choose any word in any language.
138 It is common for an intruder to use dictionary attacks.
139 Type the command
140 .Ic /usr/bin/passwd
141 to change it.
142 .Pp
143 It is a good idea to always specify the full path name for both the
144 .Xr passwd 1
145 and
146 .Xr su 1
147 commands as this inhibits the possibility of files placed in your execution
148 .Ev PATH
149 for most shells.
150 Furthermore, the superuser's
151 .Ev PATH
152 should never contain the current directory
153 .Po Dq \&.
154 .Pc .
155 .Ss System date
156 Check the system date with the
157 .Xr date 1
158 command.
159 If needed, change the date, and/or change the symbolic link of
160 .Pa /etc/localtime
161 to the correct time zone in the
162 .Pa /usr/share/zoneinfo
163 directory.
164 .Pp
165 Examples:
166 .Bl -tag -width date
167 .It Cm date 200205101820
168 Set the current date to May 10th, 2002 6:20pm.
169 .It Cm ln -fs /usr/share/zoneinfo/Europe/Helsinki /etc/localtime
170 Set the time zone to Eastern Europe Summer Time.
171 .El
172 .Ss Console settings
173 One of the first things you will likely need to do is to set up your
174 keyboard map (and maybe some other aspects about the system console).
175 To change your keyboard encoding, edit the
176 .Dq Va encoding
177 variable found in
178 .Pa /etc/wscons.conf .
179 .Pp
180 .Xr wscons.conf 5
181 contains more information about this file.
182 .Ss Check hostname
183 Use the
184 .Ic hostname
185 command to verify that the name of your machine is correct.
186 See the man page for
187 .Xr hostname 1
188 if it needs to be changed.
189 You will also need to change the contents of the
190 .Dq Va hostname
191 variable in
192 .Pa /etc/rc.conf
193 or edit the
194 .Pa /etc/myname
195 file to have it stick around for the next reboot.
196 Note that
197 .Dq Va hostname
198 is supposed include a domainname, and that this should
199 not be confused with YP (NIS)
200 .Xr domainname 1 .
201 If you are using
202 .Xr dhclient 8
203 to configure network interfaces, it might override these local hostname
204 settings if your DHCP server specifies client's hostname with other network
205 configurations.
206 .Ss Verify network interface configuration
207 The first thing to do is an
208 .Ic ifconfig -a
209 to see if the network interfaces are properly configured.
210 Correct by editing
211 .Pa /etc/ifconfig. Ns Ar interface
212 or the corresponding
213 .Dq Va ifconfig_ Ns Ar interface
214 variable in
215 .Xr rc.conf 5
216 (where
217 .Ar interface
218 is the interface name, e.g.,
219 .Dq le0 )
220 and then using
221 .Xr ifconfig 8
222 to manually configure it
223 if you do not wish to reboot.
224 .Pp
225 Alternatively, you can configure interfaces automatically via DHCP with
226 .Xr dhclient 8
227 if you have a DHCP server running somewhere on your network.
228 To get
229 .Xr dhclient 8
230 to start automatically on boot,
231 you will need to have this line in
232 .Pa /etc/rc.conf :
233 .Pp
234 .Dl dhclient=YES
235 .Pp
236 See
237 .Xr dhclient 8
238 and
239 .Xr dhclient.conf 5
240 for more information on setting up a DHCP client.
241 .Pp
242 You can add new
243 .Dq virtual interfaces
244 by adding the required entries to
245 .Pa /etc/ifconfig. Ns Ar interface .
246 Read the
247 .Xr ifconfig.if 5
248 man page for more information on the format of
249 .Pa /etc/ifconfig. Ns Ar interface
250 files.
251 The loopback interface will look something like:
252 .Bd -literal -offset indent
253 lo0: flags=8009\*[Lt]UP,LOOPBACK,MULTICAST\*[Gt] mtu 32972
254 inet 127.0.0.1 netmask 0xff000000
255 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3
256 inet6 ::1 prefixlen 128
257 .Ed
258 .Pp
259 an Ethernet interface something like:
260 .Bd -literal -offset indent
261 le0: flags=9863\*[Lt]UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST\*[Gt]
262 inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255
263 inet6 fe80::5ef0:f0f0%le0 prefixlen 64 scopeid 0x1
264 .Ed
265 .Pp
266 and a PPP interface something like:
267 .Bd -literal -offset indent
268 ppp0: flags=8051\*[Lt]UP,POINTOPOINT,RUNNING,MULTICAST\*[Gt]
269 inet 203.3.131.108 --\*[Gt] 198.181.0.253 netmask 0xffff0000
270 .Ed
271 .Pp
272 See
273 .Xr mrouted 8
274 for instructions on configuring multicast routing.
275 .Ss Check routing tables
276 Issue a
277 .Ic netstat -rn
278 command.
279 The output will look something like:
280 .Bd -literal -offset indent
281 Routing tables
283 Internet:
284 Destination Gateway Flags Refs Use Mtu Interface
285 default 192.168.4.254 UGS 0 11098028 - le0
286 127 127.0.0.1 UGRS 0 0 - lo0
287 127.0.0.1 127.0.0.1 UH 3 24 - lo0
288 192.168.4 link#1 UC 0 0 - le0
289 192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - le0
290 192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - le0
292 Internet6:
293 Destination Gateway Flags Refs Use Mtu Interface
294 ::/96 ::1 UGRS 0 0 32972 lo0 =\*[Gt]
295 ::1 ::1 UH 4 0 32972 lo0
296 ::ffff:0.0.0.0/96 ::1 UGRS 0 0 32972 lo0
297 fc80::/10 ::1 UGRS 0 0 32972 lo0
298 fe80::/10 ::1 UGRS 0 0 32972 lo0
299 fe80::%le0/64 link#1 UC 0 0 1500 le0
300 fe80::%lo0/64 fe80::1%lo0 U 0 0 32972 lo0
301 ff01::/32 ::1 U 0 0 32972 lo0
302 ff02::%le0/32 link#1 UC 0 0 1500 le0
303 ff02::%lo0/32 fe80::1%lo0 UC 0 0 32972 lo0
304 .Ed
305 .Pp
306 The default gateway address is stored in the
307 .Dq Va defaultroute
308 variable in
309 .Pa /etc/rc.conf ,
310 or in the file
311 .Pa /etc/mygate .
312 If you need to edit this file, a painless way to reconfigure the network
313 afterwards is to issue
314 .Bd -literal -offset indent
315 .Ic /etc/rc.d/network restart
316 .Ed
317 .Pp
318 Or, you may prefer to manually configure using a series of
319 .Ic route add
320 and
321 .Ic route delete
322 commands (see
323 .Xr route 8 ) .
324 If you run
325 .Xr dhclient 8
326 you will have to kill it by running
327 .Bd -literal -offset indent
328 .Ic /etc/rc.d/dhclient stop
329 .Pp
330 .Ed
331 after you flush the routes.
332 .Pp
333 If you wish to route packets between interfaces, add one or both
334 of the following directives (depending on whether IPv4 or IPv6 routing
335 is required) to
336 .Pa /etc/sysctl.conf :
337 .Pp
338 .Dl net.inet.ip.forwarding=1
339 .Dl net.inet6.ip6.forwarding=1
340 .Pp
341 As an alternative, compile a new kernel with the
342 .Cm GATEWAY
343 option.
344 Packets are not forwarded by default, due to RFC requirements.
345 .Ss Secure Shell (ssh)
346 By default, all services are disabled in a fresh
347 .Nx
348 installation, and ssh is no exception.
349 You may wish to enable it so you can remotely control your system.
350 Set
351 .Dq Va sshd=yes
352 in
353 .Pa /etc/rc.conf
354 and then starting the server with the command
355 .Bd -literal -offset indent
356 .Ic /etc/rc.d/sshd start
357 .Ed
358 .Pp
359 The first time the server is started, it will generate a new keypair,
360 which will be stored inside the directory
361 .Pa /etc/ssh .
362 .Ss BIND Name Server (DNS)
363 If you are using the BIND Name Server, check the
364 .Pa /etc/resolv.conf
365 file.
366 It may look something like:
367 .Bd -literal -offset indent
368 domain some.thing.dom
369 nameserver 192.168.0.1
370 nameserver 192.168.4.55
371 search some.thing.dom. thing.dom.
372 .Ed
373 .Pp
374 For further details, see
375 .Xr resolv.conf 5 .
376 Note the name service lookup order is set via
377 .Xr nsswitch.conf 5
378 mechanism.
379 .Pp
380 If using a caching name server add the line "nameserver 127.0.0.1" first.
381 To get a local caching name server to run
382 you will need to set "named=yes" in
383 .Pa /etc/rc.conf
384 and create the
385 .Pa named.conf
386 file in the appropriate place for
387 .Xr named 8 ,
388 usually in
389 .Pa /etc/namedb .
390 The same holds true if the machine is going to be a
391 name server for your domain.
392 In both these cases, make sure that
393 .Xr named 8
394 is running
395 (otherwise there are long waits for resolver timeouts).
396 .Ss RPC-based network services
397 Several services depend on the RPC portmapper
398 .Xr rpcbind 8
399 - formerly known as
400 .Ic portmap
401 - being running for proper operation.
402 This includes YP (NIS) and NFS exports, among other services.
403 To get the RPC portmapper to start automatically on boot,
404 you will need to have this line in
405 .Pa /etc/rc.conf :
406 .Pp
407 .Dl rpcbind=YES
408 .Ss YP (NIS) Setup
409 Check the YP domain name with the
410 .Xr domainname 1
411 command.
412 If necessary, correct it by editing the
413 .Pa /etc/defaultdomain
414 file or by setting the
415 .Dq Va domainname
416 variable in
417 .Pa /etc/rc.conf .
418 The
419 .Pa /etc/rc.d/network
420 script reads this file on bootup to determine and set the domain name.
421 You may also set the running system's domain name with the
422 .Xr domainname 1
423 command.
424 To start YP client services, simply run
425 .Ic ypbind ,
426 then perform the remaining
427 YP activation as described in
428 .Xr passwd 5
429 and
430 .Xr group 5 .
431 .Pp
432 In particular, to enable YP passwd support, you'll need to update
433 .Pa /etc/nsswitch.conf
434 to include
435 .Dq nis
436 for the
437 .Dq passwd
438 and
439 .Dq group
440 entries.
441 A traditional way to accomplish the same thing is to
442 add following entry to local passwd database via
443 .Xr vipw 8 :
444 .Bd -literal -offset indent
445 .Li +:*::::::::
446 .Pp
447 .Ed
448 Note this entry has to be the very last one.
449 This traditional way works with the default
450 .Xr nsswitch.conf 5
451 setting of
452 .Dq passwd ,
453 which is
454 .Dq compat .
455 .Pp
456 There are many more YP man pages available to help you.
457 You can find more information by starting with
458 .Xr nis 8 .
459 .Ss Check disk mounts
460 Check that the disks are mounted correctly by
461 comparing the
462 .Pa /etc/fstab
463 file against the output of the
464 .Xr mount 8
465 and
466 .Xr df 1
467 commands.
468 Example:
469 .Bd -literal -offset indent
470 .Li # Ic cat /etc/fstab
471 /dev/sd0a / ffs rw 1 1
472 /dev/sd0b none swap sw
473 /dev/sd0e /usr ffs rw 1 2
474 /dev/sd0f /var ffs rw 1 3
475 /dev/sd0g /tmp ffs rw 1 4
476 /dev/sd0h /home ffs rw 1 5
478 .Li # Ic mount
479 /dev/sd0a on / type ffs (local)
480 /dev/sd0e on /usr type ffs (local)
481 /dev/sd0f on /var type ffs (local)
482 /dev/sd0g on /tmp type ffs (local)
483 /dev/sd0h on /home type ffs (local)
485 .Li # Ic df
486 Filesystem 1024-blocks Used Avail Capacity Mounted on
487 /dev/sd0a 22311 14589 6606 69% /
488 /dev/sd0e 203399 150221 43008 78% /usr
489 /dev/sd0f 10447 682 9242 7% /var
490 /dev/sd0g 18823 2 17879 0% /tmp
491 /dev/sd0h 7519 5255 1888 74% /home
493 .Li # Ic pstat -s
494 Device 512-blocks Used Avail Capacity Priority
495 /dev/sd0b 131072 84656 46416 65% 0
496 .Ed
497 .Pp
498 Edit
499 .Pa /etc/fstab
500 and use the
501 .Xr mount 8
502 and
503 .Xr umount 8
504 commands as appropriate.
505 Refer to the above example and
506 .Xr fstab 5
507 for information on the format of this file.
508 .Pp
509 You may wish to do NFS mounts now too, or you can do them later.
510 .Ss Concatenated disks (ccd)
511 If you are using
512 .Xr ccd 4
513 concatenated disks, edit
514 .Pa /etc/ccd.conf .
515 You may wish to take a look to
516 .Xr ccdconfig 8
517 for more information about this file.
518 Use the
519 .Ic ccdconfig -U
520 command to unload and the
521 .Ic ccdconfig -C
522 command to create tables internal to the kernel for the concatenated disks.
523 You then
524 .Xr mount 8 ,
525 .Xr umount 8 ,
526 and edit
527 .Pa /etc/fstab
528 as needed.
529 .Ss Automounter daemon (AMD)
530 To use the
531 .Xr amd 8
532 automounter, create the
533 .Pa /etc/amd
534 directory, copy example config files from
535 .Pa /usr/share/examples/amd
536 to
537 .Pa /etc/amd
538 and customize them as needed.
539 Alternatively, you can get your maps with YP.
540 .Ss Clock synchronization
541 In order to make sure the system clock is synchronized
542 to that of a publicly accessible NTP server,
543 make sure that
544 .Pa /etc/rc.conf
545 contains the following:
546 .Pp
547 .Dl ntpdate=yes
548 .Dl ntpd=yes
549 .Pp
550 See
551 .Xr date 1 ,
552 .Xr ntpdate 8 ,
553 .Xr ntpd 8 ,
554 .Xr rdate 8 ,
555 and
556 .Xr timed 8
557 for more information on setting the system's date.
558 .Sh CHANGING /etc FILES
559 The system should be usable now, but you may wish to do more customizing,
560 such as adding users, etc.
561 Many of the following sections may be skipped
562 if you are not using that package (for example, skip the
563 .Sx Kerberos
564 section if you won't be using Kerberos).
565 We suggest that you
566 .Ic cd /etc
567 and edit most of the files in that directory.
568 .Pp
569 Note that the
570 .Pa /etc/motd
571 file is modified by
572 .Pa /etc/rc.d/motd
573 whenever the system is booted.
574 To keep any custom message intact, ensure that you leave two blank lines
575 at the top, or your message will be overwritten.
576 .Ss Add new users
577 To add new users and groups, there are
578 .Xr useradd 8
579 and
580 .Xr groupadd 8 ,
581 see also
582 .Xr user 8
583 for further programs for user and group manipulation.
584 You may use
585 .Xr vipw 8
586 to add users to the
587 .Pa /etc/passwd
588 file
589 and edit
590 .Pa /etc/group
591 by hand to add new groups.
592 The manual page for
593 .Xr su 1 ,
594 tells you to make sure to put people in
595 the
596 .Sq wheel
597 group if they need root access (non-Kerberos).
598 For example:
599 .Bd -literal -offset indent
600 wheel:*:0:root,myself
601 .Ed
602 .Pp
603 Follow instructions for
604 .Xr kerberos 8
605 if using
606 Kerberos
607 for authentication.
608 .Ss System boot scripts and /etc/rc.local
609 .Pa /etc/rc
610 and the
611 .Pa /etc/rc.d/*
612 scripts are invoked at boot time after single user mode has exited,
613 and at shutdown.
614 The whole process is controlled by the master script
615 .Pa /etc/rc .
616 This script should not be changed by administrators.
617 .Pp
618 The directory
619 .Pa /etc/rc.d
620 contains a series of scripts used at startup/shutdown, called by
621 .Pa /etc/rc .
622 .Pa /etc/rc
623 is in turn influenced by the configuration variables present in
624 .Pa /etc/rc.conf .
625 .Pp
626 The script
627 .Pa /etc/rc.local
628 is run as the last thing during multiuser boot, and is provided
629 to allow any other local hooks necessary for the system.
630 .Ss rc.conf
631 To enable or disable various services on system startup,
632 corresponding entries can be made in
633 .Pa /etc/rc.conf .
634 You can take a look at
635 .Pa /etc/defaults/rc.conf
636 to see a list of default system variables, which you can override in
637 .Pa /etc/rc.conf .
638 Note you are
639 .Em not
640 supposed to change
641 .Pa /etc/defaults/rc.conf
642 directly, edit only
643 .Pa /etc/rc.conf .
644 See
645 .Xr rc.conf 5
646 for further information.
647 .Pp
648 If you've installed X, you may want to turn on
649 .Xr xdm 1 ,
650 the X Display Manager.
651 To do this, set the variable
652 .Dq xdm
653 to yes in
654 .Pa /etc/rc.conf ,
655 i.e.:
656 .Dq xdm=yes
657 .Ss Printers
658 Edit
659 .Pa /etc/printcap
660 and
661 .Pa /etc/hosts.lpd
662 to get any printers set up.
663 Consult
664 .Xr lpd 8
665 and
666 .Xr printcap 5
667 if needed.
668 .Ss Tighten up security
669 In
670 .Pa /etc/inetd.conf
671 comment out any extra entries you do not need, and only add things
672 that are really needed.
673 Note that by default all services are disabled for security reasons.
674 .Ss Kerberos
675 If you are going to use Kerberos for authentication,
676 see
677 .Xr kerberos 8
678 and
679 .Dq info heimdal
680 for more information.
681 If you already have a Kerberos master, change directory to
682 .Pa /etc/kerberosV
683 and configure.
684 Remember to get a
685 .Pa srvtab
686 from the master so that the remote commands work.
687 .Ss Mail Aliases
688 Check
689 .Pa /etc/mail/aliases
690 and update appropriately if you want e-mail to be routed
691 to non-local addresses or to different users.
692 .Pp
693 Run
694 .Xr newaliases 1
695 after changes.
696 .Ss Postfix
697 .Nx
698 uses Postfix as its MTA.
699 Postfix is started by default, but its initial configuration does not
700 cause it to listen on the network for incoming connections.
701 To configure Postfix, see
702 .Pa /etc/postfix/main.cf
703 and
704 .Pa /etc/postfix/master.cf .
705 If you wish to use a different MTA (e.g., sendmail), install your MTA of
706 choice and edit
707 .Pa /etc/mailer.conf
708 to point to the proper binaries.
709 .Ss DHCP server
710 If this is a
711 DHCP
712 server, edit
713 .Pa /etc/dhcpd.conf
714 and
715 .Pa /etc/dhcpd.interfaces
716 as needed.
717 You will have to make sure
718 .Pa /etc/rc.conf
719 has "dhcpd=yes"
720 or run
721 .Xr dhcpd 8
722 manually.
723 .Ss Bootparam server
724 If this is a
725 Bootparam
726 server, edit
727 .Pa /etc/bootparams
728 as needed.
729 You will have to turn it on in
730 .Pa /etc/rc.conf
731 by adding "bootparamd=yes".
732 .Ss NFS server
733 If this is an NFS server, make sure
734 .Pa /etc/rc.conf
735 has:
736 .Bd -literal -offset indent
737 nfs_server=yes
738 mountd=yes
739 rpcbind=yes
740 .Ed
741 .Pp
742 Edit
743 .Pa /etc/exports
744 and get it correct.
745 After this, you can start the server by issuing:
746 .Bd -literal -offset indent
747 .Ic /etc/rc.d/rpcbind start
748 .Ic /etc/rc.d/mountd start
749 .Ic /etc/rc.d/nfsd start
750 .Ed
751 which will also start dependencies.
752 .Ss HP remote boot server
753 Edit
754 .Pa /etc/rbootd.conf
755 if needed for remote booting.
756 If you do not have HP computers doing remote booting, do not enable this.
757 .Ss Daily, weekly, monthly scripts
758 Look at and possibly edit the
759 .Pa /etc/daily.conf , /etc/weekly.conf ,
760 and
761 .Pa /etc/monthly.conf
762 configuration files.
763 You can check which values you can set by looking
764 to their matching files in
765 .Pa /etc/defaults .
766 Your site specific things should go into
767 .Pa /etc/daily.local , /etc/weekly.local ,
768 and
769 .Pa /etc/monthly.local .
770 .Pp
771 These scripts have been limited so as to keep the system running without
772 filling up disk space from normal running processes and database updates.
773 (You probably do not need to understand them.)
774 .Ss Other files in /etc
775 Look at the other files in
776 .Pa /etc
777 and edit them as needed.
778 (Do not edit files ending in
779 .Pa .db
780 \(em like
781 .Pa pwd.db , spwd.db ,
782 nor
783 .Pa localtime ,
784 nor
785 .Pa rmt ,
786 nor any directories.)
787 .Ss Crontab (background running processes)
788 Check what is running by typing
789 .Ic crontab -l
790 as root
791 and see if anything unexpected is present.
792 Do you need anything else?
793 Do you wish to change things?
794 For example, if you do not
795 like root getting standard output of the daily scripts, and want only
796 the security scripts that are mailed internally, you can type
797 .Ic crontab -e
798 and change some of the lines to read:
799 .Bd -literal -offset indent
800 30 1 * * * /bin/sh /etc/daily 2\*[Gt]\*[Am]1 \*[Gt] /var/log/daily.out
801 30 3 * * 6 /bin/sh /etc/weekly 2\*[Gt]\*[Am]1 \*[Gt] /var/log/weekly.out
802 30 5 1 * * /bin/sh /etc/monthly 2\*[Gt]\*[Am]1 \*[Gt] /var/log/monthly.out
803 .Ed
804 .Pp
805 See
806 .Xr crontab 5 .
807 .Ss Next day cleanup
808 After the first night's security run, change ownerships and permissions
809 on files, directories, and devices; root should have received mail
810 with subject: "\*[Lt]hostname\*[Gt] daily insecurity output.".
811 This mail contains
812 a set of security recommendations, presented as a list looking like this:
813 .Bd -literal -offset indent
814 var/mail:
815 permissions (0755, 0775)
816 etc/daily:
817 user (0, 3)
818 .Ed
819 .Pp
820 The best bet is to follow the advice in that list.
821 The recommended setting is the first item in parentheses, while
822 the current setting is the second one.
823 This list is generated by
824 .Xr mtree 8
825 using
826 .Pa /etc/mtree/special .
827 Use
828 .Xr chmod 1 ,
829 .Xr chgrp 1 ,
830 and
831 .Xr chown 8
832 as needed.
833 .Ss Packages
834 Install your own packages.
835 The
836 .Nx
837 packages collection, pkgsrc, includes a large set of third-party software.
838 A lot of it is available as binary packages that you can download from
839 .Pa ftp://ftp.NetBSD.org/pub/NetBSD/packages/
840 or a mirror, and install using
841 .Xr pkg_add 1 .
842 See
843 .Pa http://www.NetBSD.org/docs/pkgsrc/
844 and
845 .Pa pkgsrc/doc/pkgsrc.txt
846 for more details.
847 .Pp
848 Copy vendor binaries and install them.
849 You will need to install any shared libraries, etc.
850 (Hint:
851 .Ic man -k compat
852 to find out how to install and use compatibility mode.)
853 .Pp
854 There is also other third-party software that is available
855 in source form only, either because it has not been ported to
856 .Nx
857 yet, because licensing restrictions make binary redistribution
858 impossible, or simply because you want to build your own binaries.
859 Sometimes checking the mailing lists for
860 past problems that people have encountered will result in a fix posted.
861 .Ss Check the running system
862 You can use
863 .Xr ps 1 ,
864 .Xr netstat 1 ,
865 and
866 .Xr fstat 1
867 to check on running processes, network connections, and opened files,
868 respectively.
869 Other tools you may find useful are
870 .Xr systat 1
871 and
872 .Xr top 1 .
873 .Sh COMPILING A KERNEL
874 Note:
875 The standard
876 .Nx
877 kernel configuration (GENERIC) is suitable for most purposes.
878 .Pp
879 First, review the system message buffer in
880 .Pa /var/run/dmesg.boot
881 and by using the
882 .Xr dmesg 8
883 command to find out information on your system's devices as probed by the
884 kernel at boot.
885 In particular, note which devices were not configured.
886 This information will prove useful when editing kernel configuration files.
887 .Pp
888 To compile a kernel inside a writable source tree, do the following:
889 .Bd -literal -offset indent
890 $ cd /usr/src/sys/arch/SOMEARCH/conf
891 $ cp GENERIC SOMEFILE (only the first time)
892 $ vi SOMEFILE (adapt to your needs)
893 $ config SOMEFILE
894 $ cd ../compile/SOMEFILE
895 $ make depend
896 $ make
897 .Ed
898 .Pp
899 where
900 .Ar SOMEARCH
901 is the architecture (e.g., i386), and
902 .Ar SOMEFILE
903 should be a name indicative of a particular configuration (often
904 that of the hostname).
905 .Pp
906 If you are building your kernel again, before you do a
907 .Ic make
908 you should do a
909 .Ic make clean
910 after making changes to your kernel options.
911 .Pp
912 After either of these two methods, you can place the new kernel (called
913 .Pa netbsd )
914 in
915 .Pa /
916 (i.e.,
917 .Pa /netbsd )
918 by issuing
919 .Ic make install
920 and the system will boot it next time.
921 The old kernel is stored as
922 .Pa /onetbsd
923 so you can boot it in case of failure.
924 .Pp
925 If you are using toolchain to build your kernel, you will also need to
926 build a new set of toolchain binaries.
927 You can do it by changing into
928 .Pa /usr/src
929 and issuing:
930 .Bd -literal -offset indent
931 $ cd /usr/src
932 $ K=sys/arch/`uname -m`/conf
933 $ cp $K/GENERIC $K/SOMEFILE
934 $ vi $K/SOMEFILE (adapt to your needs)
935 $ ./build.sh tools
936 $ ./build.sh kernel=SOMEFILE
937 .Ed
938 .Sh SYSTEM TESTING
939 At this point, the system should be fully configured to your liking.
940 It is now a good time to ensure that the system behaves according to
941 its specifications and that it is stable on your hardware.
942 You can easily do so by running the test suites available at
943 .Pa /usr/tests/ ,
944 assuming that you installed the
945 .Pa tests.tgz
946 set.
947 If not, you can install it now by running:
948 .Bd -literal -offset indent
949 # cd /
950 # tar xzpf /path/to/tests.tgz
951 .Ed
952 .Pp
953 Once done, edit the
954 .Pa /etc/atf/NetBSD.conf
955 file to tune the configuration of the test suite, go to
956 .Pa /usr/tests/
957 hierarchy and use the
958 .Xr atf-run 1
959 and
960 .Xr atf-report 1
961 utilities to run all the tests in an automated way:
962 .Bd -literal -offset indent
963 # cd /usr/tests/
964 # atf-run | atf-report
965 .Ed
966 .Pp
967 Should any problems appear when running the test suite, please let the
968 .Nx
969 developers know by sending a message to the appropriate mailing list or
970 by sending a problem report.
971 For more details see:
972 .Bl -bullet -offset indent
973 .It
974 .Pa http://www.netbsd.org/mailinglists/
975 .It
976 .Pa http://www.netbsd.org/support/send-pr.html
977 .El
978 .Sh SEE ALSO
979 .Xr atf-report 1 ,
980 .Xr atf-run 1 ,
981 .Xr chgrp 1 ,
982 .Xr chmod 1 ,
983 .Xr config 1 ,
984 .Xr crontab 1 ,
985 .Xr date 1 ,
986 .Xr df 1 ,
987 .Xr domainname 1 ,
988 .Xr hostname 1 ,
989 .Xr make 1 ,
990 .Xr man 1 ,
991 .Xr netstat 1 ,
992 .Xr newaliases 1 ,
993 .Xr passwd 1 ,
994 .Xr su 1 ,
995 .Xr ccd 4 ,
996 .Xr aliases 5 ,
997 .Xr crontab 5 ,
998 .Xr exports 5 ,
999 .Xr fstab 5 ,
1000 .Xr group 5 ,
1001 .Xr mailer.conf 5 ,
1002 .Xr passwd 5 ,
1003 .Xr rc.conf 5 ,
1004 .Xr resolv.conf 5 ,
1005 .Xr hier 7 ,
1006 .Xr hostname 7 ,
1007 .Xr pkgsrc 7 ,
1008 .Xr amd 8 ,
1009 .Xr ccdconfig 8 ,
1010 .Xr chown 8 ,
1011 .Xr dhcpd 8 ,
1012 .Xr ifconfig 8 ,
1013 .Xr inetd 8 ,
1014 .Xr kerberos 8 ,
1015 .Xr mount 8 ,
1016 .Xr mrouted 8 ,
1017 .Xr mtree 8 ,
1018 .Xr named 8 ,
1019 .Xr nis 8 .
1020 .Xr rbootd 8 ,
1021 .Xr rc 8 ,
1022 .Xr rmt 8 ,
1023 .Xr route 8 ,
1024 .Xr rpc.bootparamd 8 ,
1025 .Xr umount 8 ,
1026 .Xr useradd 8 ,
1027 .Xr vipw 8 ,
1028 .Xr ypbind 8
1029 .Sh HISTORY
1030 This document first appeared in
1031 .Ox 2.2 .
1032 It has been adapted to
1033 .Nx
1034 and first appeared in
1035 .Nx 2.0 .