1.\" $OpenBSD: afterboot.8,v 1.170 2021/07/18 17:44:46 kn Exp $ 2.\" 3.\" Copyright (c) 1997 Marshall M. Midden 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. All advertising materials mentioning features or use of this software 16.\" must display the following acknowledgement: 17.\" This product includes software developed by Marshall M. Midden. 18.\" 4. The name of the author may not be used to endorse or promote products 19.\" derived from this software without specific prior written permission. 20.\" 21.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31.\" 32.Dd $Mdocdate: July 18 2021 $ 33.Dt AFTERBOOT 8 34.\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu 35.Os 36.Sh NAME 37.Nm afterboot 38.Nd things to check after the first complete boot 39.Sh DESCRIPTION 40.Ss Starting out 41This document attempts to list items for the system administrator 42to check and set up after the installation and first complete boot of the 43system. 44The idea is to create a list of items that can be checked off so that you have 45a warm fuzzy feeling that something obvious has not been missed. 46A basic knowledge of 47.Ux 48is assumed, otherwise type: 49.Pp 50.Dl $ help 51.Pp 52Complete instructions for correcting and fixing items are not provided. 53There are manual pages and other methodologies available for doing that. 54For example, to view the man page for the 55.Xr ls 1 56command, type: 57.Pp 58.Dl $ man 1 ls 59.Pp 60Administrators will rapidly become more familiar with 61.Ox 62if they get used to using the high quality manual pages. 63.Pp 64Some base programs and subsystems also come with sample configuration 65files in 66.Pa /etc/examples . 67.Ss Errata 68By the time that you have installed your system, it is possible that 69bugs in the release have been found. 70Security or reliability fixes can be found at 71.Lk https://www.openbsd.org/errata.html , 72and can be installed using 73.Xr syspatch 8 . 74.Ss Login 75Log in on the console, or over the network using 76.Xr ssh 1 . 77For security reasons, it is bad practice to log in as root during regular use 78and maintenance of the system. 79Instead, administrators are encouraged to add a 80.Dq regular 81user, add said user to the 82.Dq wheel 83group, then use the 84.Xr su 1 85and 86.Xr doas 1 87commands when root privileges are required. 88.Pp 89The installation process provides an option to set up a user account. 90By default, accounts created via this method are automatically added to 91the 92.Dq wheel 93group. 94If that option was not used, see the paragraph 95.Sx Add new users 96below. 97.Pp 98To deny root logins over the network, edit the 99.Pa /etc/ssh/sshd_config 100file and set 101.Cm PermitRootLogin 102to 103.Dq no 104(see 105.Xr sshd_config 5 ) . 106.Ss Root password 107Change the password for the root user. 108(Note that throughout the documentation, the term 109.Dq superuser 110is a synonym for the root user.) 111Choose a password that has digits and special characters 112as well as from the upper and lower case alphabet. 113Do not choose any word in any language. 114It is common for an intruder to use dictionary attacks. 115Type the following command to change it: 116.Pp 117.Dl # passwd root 118.Pp 119To avoid the possibility of rogue files placed in 120the superuser's 121.Ev PATH , 122it should never contain the current directory 123.Pq Dq \&. . 124.Ss System date 125.Xr ntpd 8 126is used to automatically synchronize clocks with remote NTP servers. 127You can use 128.Xr ntpctl 8 129to check the status. 130To change the NTP server, see 131.Xr ntpd.conf 5 . 132.Pp 133Check the system date with the 134.Xr date 1 135command. 136If needed, change the date, and/or change the symbolic link of 137.Pa /etc/localtime 138to the correct time zone in the 139.Pa /usr/share/zoneinfo 140directory. 141.Pp 142Examples: 143.Pp 144Set the current date to January 27th, 2016 3:04pm: 145.Dl # date 201601271504 146.Pp 147Set the time zone to Atlantic Standard Time: 148.Dl # ln -fs /usr/share/zoneinfo/Canada/Atlantic /etc/localtime 149.Ss Check hostname 150Use the 151.Ic hostname 152command to verify that the name of your machine is correct. 153See the man page for 154.Xr hostname 1 155if it needs to be changed. 156You will also need to edit the 157.Pa /etc/myname 158file to have it stick around for the next reboot. 159.Ss Verify network interface configuration and routing tables 160The first thing to do is an 161.Ic ifconfig -a 162to see if the network interfaces are properly configured. 163Correct by editing 164.Pa /etc/hostname. Ns Ar interface 165(where 166.Ar interface 167is the interface name, e.g., 168.Dq em0 ) 169and then using 170.Xr ifconfig 8 171to manually configure it 172if you do not wish to reboot. 173Read the 174.Xr hostname.if 5 175man page for more information on the format of 176.Pa /etc/hostname. Ns Ar interface 177files. 178.Pp 179See 180.Xr multicast 4 181for instructions on configuring multicast routing. 182See 183.Xr hostname.if 5 184for instructions on configuring interfaces with DHCP. 185.Pp 186Routing tables can be viewed by issuing a 187.Ic netstat -rn 188command. 189The default gateway address is stored in the 190.Pa /etc/mygate 191file. 192If you need to edit this file, a painless way to reconfigure the network 193afterwards is 194.Ic route flush 195followed by a 196.Ic sh -x /etc/netstart 197command. 198Or, you may prefer to manually configure using a series of 199.Ic route add 200and 201.Ic route delete 202commands (see 203.Xr route 8 ) . 204.Pp 205If you wish to route packets between interfaces, add one or both 206of the following directives (depending on whether IPv4 or IPv6 routing 207is required) to 208.Pa /etc/sysctl.conf : 209.Pp 210.Dl net.inet.ip.forwarding=1 211.Dl net.inet6.ip6.forwarding=1 212.Pp 213Packets are not forwarded by default, due to RFC requirements. 214.Ss Check DNS 215Use 216.Xr host 1 217or 218.Xr dig 1 219to check that domain name resolution is working properly. 220.Pp 221Most likely, the IP address of at least one domain name server 222was added to 223.Xr resolv.conf 5 224while installing the system. 225.Xr resolvd 8 226maintains 227.Pa /etc/resolv.conf 228at runtime. 229.Pp 230A 231.Xr hosts 5 232file can be used if there is a need for system specific name 233resolution entries. 234.Ss Check disk mounts 235Check that the disks are mounted correctly by 236comparing the 237.Pa /etc/fstab 238file against the output of the 239.Xr mount 8 240and 241.Xr df 1 242commands. 243Example: 244.Bd -literal -offset indent 245# cat /etc/fstab 246/dev/sd0a / ffs rw 1 1 247/dev/sd0d /usr ffs rw,nodev 1 2 248/dev/sd0e /var ffs rw,nodev,nosuid 1 3 249/dev/sd0g /tmp ffs rw,nodev,nosuid 1 4 250/dev/sd0h /home ffs rw,nodev,nosuid 1 5 251 252# mount 253/dev/sd0a on / type ffs (local) 254/dev/sd0d on /usr type ffs (local, nodev) 255/dev/sd0e on /var type ffs (local, nodev, nosuid) 256/dev/sd0g on /tmp type ffs (local, nodev, nosuid) 257/dev/sd0h on /home type ffs (local, nodev, nosuid) 258 259# df 260Filesystem 1024-blocks Used Avail Capacity Mounted on 261/dev/sd0a 22311 14589 6606 69% / 262/dev/sd0d 203399 150221 43008 78% /usr 263/dev/sd0e 10447 682 9242 7% /var 264/dev/sd0g 18823 2 17879 0% /tmp 265/dev/sd0h 7519 5255 1888 74% /home 266 267# pstat -s 268Device 512-blocks Used Avail Capacity Priority 269/dev/sd0b 131072 84656 46416 65% 0 270.Ed 271.Pp 272Edit 273.Pa /etc/fstab 274and use the 275.Xr mount 8 276and 277.Xr umount 8 278commands as appropriate. 279Refer to the above example and 280.Xr fstab 5 281for information on the format of this file. 282.Pp 283You may wish to do NFS partitions now too, or you can do them later. 284.Ss Check the running system 285You can use 286.Xr ps 1 , 287.Xr netstat 1 , 288and 289.Xr fstat 1 290to check on running processes, network connections, and opened files, 291respectively. 292.Sh FURTHER CHANGES 293The system should be usable now, but you may wish to do more customizing, 294such as adding users, etc. 295We suggest that you 296.Ic cd /etc 297and edit any files in that directory as necessary. 298.Pp 299Note that the 300.Pa /etc/motd 301file is modified by 302.Pa /etc/rc 303whenever the system is booted. 304To keep any custom message intact, ensure that you leave two blank lines 305at the top, or your message will be overwritten. 306.Ss Add new users 307Add users. 308There is an 309.Xr adduser 8 310script. 311You may use 312.Xr vipw 8 313to add users to the 314.Pa /etc/passwd 315file 316and edit 317.Pa /etc/group 318by hand to add new groups. 319You may also wish to edit 320.Pa /etc/login.conf 321and tune some of the limits documented in 322.Xr login.conf 5 . 323The manual page for 324.Xr su 1 325tells you to make sure to put people in 326the 327.Sq wheel 328group if they need root access. 329For example: 330.Pp 331.Dl wheel:*:0:root,myself 332.Ss System command scripts 333The 334.Pa /etc/rc.*\& 335scripts are invoked at boot time, after single-user mode has exited, 336and at shutdown. 337The whole process is controlled, more or less, by the master script 338.Pa /etc/rc . 339This script should not be changed by administrators. 340.Pp 341.Pa /etc/rc 342is in turn influenced by the configuration variables present in 343.Pa /etc/rc.conf . 344Again, this script should not be changed by administrators: 345site-specific changes should be made to 346.Pq freshly created if necessary 347.Pa /etc/rc.conf.local 348or by using the 349.Xr rcctl 8 350utility. 351.Pp 352Any commands which should be run before the system sets its 353secure level should be made to 354.Pa /etc/rc.securelevel , 355and commands to be run after the system sets its 356secure level should be made to 357.Pa /etc/rc.local . 358Commands to be run before system shutdown should be set in 359.Pa /etc/rc.shutdown . 360.Pp 361For more information about system startup/shutdown files, see 362.Xr rc 8 , 363.Xr rc.conf 8 , 364.Xr securelevel 7 , 365and 366.Xr rc.shutdown 8 . 367.Pp 368If you've installed X, you may want to turn on 369.Xr xenodm 1 , 370the X Display Manager. 371To do this, change the value of 372.Va xenodm_flags 373in 374.Pa /etc/rc.conf.local . 375.Ss Set keyboard type 376Some architectures permit keyboard type control. 377Use the 378.Xr kbd 8 379command to change the keyboard encoding. 380.Ic kbd -l 381will list all available encodings. 382.Ic kbd xxx 383will select the 384.Ic xxx 385encoding. 386Store the encoding in 387.Pa /etc/kbdtype 388to make sure it is set automatically at boot time. 389.Ss Printers 390Edit 391.Pa /etc/printcap 392and 393.Pa /etc/hosts.lpd 394to get any printers set up. 395Consult 396.Xr lpd 8 397and 398.Xr printcap 5 399if needed. 400.Ss Audio and video recording 401The 402.Xr audio 4 403and 404.Xr video 4 405drivers by default record only silence and blanked images. 406Normal recording can be enabled by adding the following directives to 407.Xr sysctl.conf 5 : 408.Bd -literal -offset indent 409kern.audio.record=1 410kern.video.record=1 411.Ed 412.Ss Power management 413If the BIOS supports it, 414.Xr apmd 8 415can be configured to act on different events and adjust device performance. 416In the following example it is configured to start on boot in automatic 417performance adjustment mode and suspend the system if no AC is connected and 418the estimated battery life is equal or below 15%: 419.Bd -literal -offset indent 420# rcctl set apmd status on 421# rcctl set apmd flags -A -z 15 422.Ed 423.Ss Mail aliases 424Edit 425.Pa /etc/mail/aliases 426and set the three standard aliases to go to either a mailing list, or 427the system administrator. 428.Bd -literal -offset indent 429# Well-known aliases -- these should be filled in! 430root: sysadm 431manager: root 432dumper: root 433.Ed 434.Ss Mail 435The default mail agent on 436.Ox 437is 438.Xr smtpd 8 . 439Details on how to configure an alternative mailer are documented in 440.Xr mailer.conf 5 . 441.Pp 442.Ox 443ships with a default 444.Pa /etc/mail/smtpd.conf 445file that will work for simple installations. 446See 447.Xr smtpd.conf 5 448for information on configuring more complex setups. 449For the default installation, 450.Xr smtpd 8 451is configured to only accept connections from the local host. 452This makes it possible to send mail locally, but not receive mail from remote 453servers, which is ideal if you have one central incoming mail machine and 454several clients. 455To cause smtpd to accept external network connections, modify the 456.Ic listen on 457directive in 458.Pa /etc/mail/smtpd.conf 459to include the interfaces to listen on. 460.Ss Daily, weekly, monthly scripts 461Review 462.Xr daily 8 463to understand what the periodic system maintenance scripts do and 464how to customize them: 465For example, to enable 466.Ev ROOTBACKUP 467or to add local maintenance code to 468.Pa /etc/daily.local , /etc/weekly.local , 469or 470.Pa /etc/monthly.local . 471.Ss Tighten up security 472You might wish to tighten up security more by editing 473.Pa /etc/fbtab 474as when installing X. 475Look at the other files in 476.Pa /etc 477and edit them as needed. 478(Do not edit files ending in 479.Pa .db 480\(em like 481.Pa pwd.db , spwd.db , 482nor 483.Pa localtime , 484nor 485.Pa rmt , 486nor any directories.) 487.Ss Crontab (background running processes) 488Check what is running by typing 489.Ic crontab -l 490as root 491and see if anything unexpected is present. 492Do you need anything else? 493Do you wish to change things? 494See 495.Xr crontab 5 . 496.Ss Next day cleanup 497After the first night's 498.Xr security 8 499run, change ownerships and permissions 500on files, directories, and devices; root may have received mail 501with subject: "<hostname> daily insecurity output". 502This mail contains a set of security recommendations, 503presented as a list looking something like this: 504.Bd -literal -offset indent 505var/mail: 506 permissions (0755, 0775) 507etc/daily: 508 user (0, 3) 509.Ed 510.Pp 511The best bet is to follow the advice in that list. 512The recommended setting is the first item in parentheses, while 513the current setting is the second one. 514This list is generated by 515.Xr mtree 8 516using 517.Pa /etc/mtree/special . 518Use 519.Xr chmod 1 , 520.Xr chgrp 1 , 521and 522.Xr chown 8 523as needed. 524.Ss Daemons 525Enable/disable any daemon processes as necessary. 526.Xr intro 8 527contains a comprehensive guide to the various daemons available on the 528.Ox 529system. 530.Ss Packages 531Install your own packages. 532The 533.Ox 534ports collection includes a large set of third-party software. 535A lot of it is available as binary packages that you can install using 536.Xr pkg_add 1 . 537See 538.Xr ports 7 539and 540.Xr packages 7 541for more details. 542To start daemons installed from packages, see 543.Xr rc.d 8 . 544.Pp 545There is also other third-party software that is available 546in source form only, either because it has not been ported to 547.Ox 548yet, or because licensing restrictions make binary redistribution 549impossible. 550Sometimes checking the mailing lists for 551past problems that people have encountered will result in a fix posted. 552.Ss Compiling a kernel 553Information on building and modifying kernels 554is contained within 555.Xr config 8 . 556.Sh SEE ALSO 557.Xr doas 1 , 558.Xr ksh 1 , 559.Xr man 1 , 560.Xr pkg_add 1 , 561.Xr ps 1 , 562.Xr vi 1 , 563.Xr multicast 4 , 564.Xr hier 7 , 565.Xr config 8 , 566.Xr dmesg 8 , 567.Xr ifconfig 8 , 568.Xr intro 8 , 569.Xr rcctl 8 , 570.Xr sysctl 8 571.Sh HISTORY 572This document first appeared in 573.Ox 2.2 . 574