1.\" $OpenBSD: afterboot.8,v 1.142 2014/01/22 01:29:33 juanfra Exp $ 2.\" 3.\" Copyright (c) 1997 Marshall M. Midden 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. All advertising materials mentioning features or use of this software 16.\" must display the following acknowledgement: 17.\" This product includes software developed by Marshall M. Midden. 18.\" 4. The name of the author may not be used to endorse or promote products 19.\" derived from this software without specific prior written permission. 20.\" 21.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31.\" 32.Dd $Mdocdate: January 22 2014 $ 33.Dt AFTERBOOT 8 34.\" Originally created by Marshall M. Midden -- 1997-10-20, m4@umn.edu 35.Os 36.Sh NAME 37.Nm afterboot 38.Nd things to check after the first complete boot 39.Sh DESCRIPTION 40.Ss Starting out 41This document attempts to list items for the system administrator 42to check and set up after the installation and first complete boot of the 43system. 44The idea is to create a list of items that can be checked off so that you have 45a warm fuzzy feeling that something obvious has not been missed. 46A basic knowledge of 47.Ux 48is assumed, otherwise type: 49.Pp 50.Dl $ help 51.Pp 52Complete instructions for correcting and fixing items is not provided. 53There are manual pages and other methodologies available for doing that. 54For example, to view the man page for the 55.Xr ls 1 56command, type: 57.Pp 58.Dl $ man 1 ls 59.Pp 60Administrators will rapidly become more familiar with 61.Ox 62if they get used to using the high quality manual pages. 63.Ss Errata 64By the time that you have installed your system, it is quite likely that 65bugs in the release have been found. 66Any security or reliability fixes can be found at 67.Lk http://www.openbsd.org/errata.html . 68It is recommended to check this page regularly. 69.Ss Login 70Log in on the console, or over the network using 71.Xr ssh 1 . 72For security reasons, it is bad practice to log in as root during regular use 73and maintenance of the system. 74Instead, administrators are encouraged to add a 75.Dq regular 76user, add said user to the 77.Dq wheel 78group, then use the 79.Xr su 1 80and 81.Xr sudo 8 82commands when root privileges are required. 83.Pp 84The installation process provides an option to set up a user account. 85By default, accounts created via this method are automatically added to 86the 87.Dq wheel 88group. 89If that option was not used, see the paragraph 90.Sx Add new users 91below. 92.Pp 93To deny root logins over the network, edit the 94.Pa /etc/ssh/sshd_config 95file and set 96.Cm PermitRootLogin 97to 98.Dq no 99(see 100.Xr sshd_config 5 ) . 101.Ss Root password 102Change the password for the root user. 103(Note that throughout the documentation, the term 104.Dq superuser 105is a synonym for the root user.) 106Choose a password that has digits and special characters (not space) 107as well as from the upper and lower case alphabet. 108Do not choose any word in any language. 109It is common for an intruder to use dictionary attacks. 110Type the following command to change it: 111.Pp 112.Dl $ /usr/bin/sudo /usr/bin/passwd root 113.Pp 114It is a good idea to always specify the full path name for the 115.Xr passwd 1 , 116.Xr su 1 117and 118.Xr sudo 8 119commands as this inhibits the possibility of rogue files placed in your 120.Ev PATH 121being executed for most shells. 122Furthermore, the superuser's 123.Ev PATH 124should never contain the current directory 125.Pq Dq \&. . 126.Ss System date 127Check the system date with the 128.Xr date 1 129command. 130If needed, change the date, and/or change the symbolic link of 131.Pa /etc/localtime 132to the correct time zone in the 133.Pa /usr/share/zoneinfo 134directory. 135Alternatively, 136.Xr ntpd 8 137can be used to automatically synchronize clocks with remote NTP servers. 138.Pp 139Examples: 140.Pp 141Set the current date to January 27th, 1999 3:04pm: 142.Dl # date 199901271504 143.Pp 144Set the time zone to Atlantic Standard Time: 145.Dl # ln -fs /usr/share/zoneinfo/Canada/Atlantic /etc/localtime 146.Ss Check hostname 147Use the 148.Ic hostname 149command to verify that the name of your machine is correct. 150See the man page for 151.Xr hostname 1 152if it needs to be changed. 153You will also need to edit the 154.Pa /etc/myname 155file to have it stick around for the next reboot. 156.Ss Verify network interface configuration 157The first thing to do is an 158.Ic ifconfig -a 159to see if the network interfaces are properly configured. 160Correct by editing 161.Pa /etc/hostname. Ns Ar interface 162(where 163.Ar interface 164is the interface name, e.g., 165.Dq le0 ) 166and then using 167.Xr ifconfig 8 168to manually configure it 169if you do not wish to reboot. 170Read the 171.Xr hostname.if 5 172man page for more information on the format of 173.Pa /etc/hostname. Ns Ar interface 174files. 175The loopback interface will look something like: 176.Bd -literal -offset indent 177lo0: flags=8009<UP,LOOPBACK,MULTICAST> mtu 32972 178 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 179 inet6 ::1 prefixlen 128 180 inet 127.0.0.1 netmask 0xff000000 181.Ed 182.Pp 183an Ethernet interface something like: 184.Bd -literal -offset indent 185le0: flags=9863<UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST> 186 inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255 187 inet6 fe80::5ef0:f0f0%le0 prefixlen 64 scopeid 0x1 188.Ed 189.Pp 190and a PPP interface something like: 191.Bd -literal -offset indent 192ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> 193 inet 203.3.131.108 --> 198.181.0.253 netmask 0xffff0000 194.Ed 195.Pp 196See 197.Xr netstart 8 198for instructions on configuring multicast routing. 199.Pp 200See 201.Xr hostname.if 5 202for instructions on configuring interfaces with DHCP. 203.Ss Check routing tables 204Issue a 205.Ic netstat -rn 206command. 207The output will look something like: 208.Bd -literal -offset indent 209Routing tables 210 211Internet: 212Destination Gateway Flags Refs Use Mtu Interface 213default 192.168.4.254 UGS 0 11098028 - le0 214127 127.0.0.1 UGRS 0 0 - lo0 215127.0.0.1 127.0.0.1 UH 3 24 - lo0 216192.168.4 link#1 UC 0 0 - le0 217192.168.4.52 8:0:20:73:b8:4a UHL 1 6707 - le0 218192.168.4.254 0:60:3e:99:67:ea UHL 1 0 - le0 219 220Internet6: 221Destination Gateway Flags Refs Use Mtu Interface 222::/96 ::1 UGRS 0 0 32972 lo0 => 223::1 ::1 UH 4 0 32972 lo0 224::ffff:0.0.0.0/96 ::1 UGRS 0 0 32972 lo0 225fc80::/10 ::1 UGRS 0 0 32972 lo0 226fe80::/10 ::1 UGRS 0 0 32972 lo0 227fe80::%le0/64 link#1 UC 0 0 1500 le0 228fe80::%lo0/64 fe80::1%lo0 U 0 0 32972 lo0 229ff01::/32 ::1 U 0 0 32972 lo0 230ff02::%le0/32 link#1 UC 0 0 1500 le0 231ff02::%lo0/32 fe80::1%lo0 UC 0 0 32972 lo0 232.Ed 233.Pp 234The default gateway address is stored in the 235.Pa /etc/mygate 236file. 237If you need to edit this file, a painless way to reconfigure the network 238afterwards is 239.Ic route flush 240followed by a 241.Ic sh -x /etc/netstart 242command. 243Or, you may prefer to manually configure using a series of 244.Ic route add 245and 246.Ic route delete 247commands (see 248.Xr route 8 ) . 249If you run 250.Xr dhclient 8 251you will have to kill it by running 252.Ic pkill dhclient 253after you flush the routes. 254.Pp 255If you wish to route packets between interfaces, add one or both 256of the following directives (depending on whether IPv4 or IPv6 routing 257is required) to 258.Pa /etc/sysctl.conf : 259.Pp 260.Dl net.inet.ip.forwarding=1 261.Dl net.inet6.ip6.forwarding=1 262.Pp 263Packets are not forwarded by default, due to RFC requirements. 264.Ss Check DNS 265Use 266.Xr host 1 267or 268.Xr dig 1 269to check that domain name resolution is working properly. 270.Pp 271Most likely, the IP address of at least one domain name server 272was added to 273.Xr resolv.conf 5 274while installing the system. 275If DHCP is in use, it will overwrite 276.Pa /etc/resolv.conf 277every time 278.Xr dhclient 8 279is run but 280.Pa /etc/resolv.conf.tail 281can be used to add options and extra name servers to those received 282dynamically. 283.Pp 284A 285.Xr hosts 5 286file can be used if there is a need for system specific name 287resolution entries. 288.Ss Check disk mounts 289Check that the disks are mounted correctly by 290comparing the 291.Pa /etc/fstab 292file against the output of the 293.Xr mount 8 294and 295.Xr df 1 296commands. 297Example: 298.Bd -literal -offset indent 299# cat /etc/fstab 300/dev/sd0a / ffs rw 1 1 301/dev/sd0d /usr ffs rw,nodev 1 2 302/dev/sd0e /var ffs rw,nodev,nosuid 1 3 303/dev/sd0g /tmp ffs rw,nodev,nosuid 1 4 304/dev/sd0h /home ffs rw,nodev,nosuid 1 5 305 306# mount 307/dev/sd0a on / type ffs (local) 308/dev/sd0d on /usr type ffs (local, nodev) 309/dev/sd0e on /var type ffs (local, nodev, nosuid) 310/dev/sd0g on /tmp type ffs (local, nodev, nosuid) 311/dev/sd0h on /home type ffs (local, nodev, nosuid) 312 313# df 314Filesystem 1024-blocks Used Avail Capacity Mounted on 315/dev/sd0a 22311 14589 6606 69% / 316/dev/sd0d 203399 150221 43008 78% /usr 317/dev/sd0e 10447 682 9242 7% /var 318/dev/sd0g 18823 2 17879 0% /tmp 319/dev/sd0h 7519 5255 1888 74% /home 320 321# pstat -s 322Device 512-blocks Used Avail Capacity Priority 323/dev/sd0b 131072 84656 46416 65% 0 324.Ed 325.Pp 326Edit 327.Pa /etc/fstab 328and use the 329.Xr mount 8 330and 331.Xr umount 8 332commands as appropriate. 333Refer to the above example and 334.Xr fstab 5 335for information on the format of this file. 336.Pp 337You may wish to do NFS partitions now too, or you can do them later. 338.Ss Check the running system 339You can use 340.Xr ps 1 , 341.Xr netstat 1 , 342and 343.Xr fstat 1 344to check on running processes, network connections, and opened files, 345respectively. 346.Sh FURTHER CHANGES 347The system should be usable now, but you may wish to do more customizing, 348such as adding users, etc. 349Many of the following sections may be skipped 350if you are not using that package. 351We suggest that you 352.Ic cd /etc 353and edit any files in that directory as necessary. 354.Pp 355Note that the 356.Pa /etc/motd 357file is modified by 358.Pa /etc/rc 359whenever the system is booted. 360To keep any custom message intact, ensure that you leave two blank lines 361at the top, or your message will be overwritten. 362.Ss Add new users 363Add users. 364There is an 365.Xr adduser 8 366script. 367You may use 368.Xr vipw 8 369to add users to the 370.Pa /etc/passwd 371file 372and edit 373.Pa /etc/group 374by hand to add new groups. 375You may also wish to edit 376.Pa /etc/login.conf 377and tune some of the limits documented in 378.Xr login.conf 5 . 379The manual page for 380.Xr su 1 381tells you to make sure to put people in 382the 383.Sq wheel 384group if they need root access (non-Kerberos). 385For example: 386.Pp 387.Dl wheel:*:0:root,myself 388.Pp 389Follow instructions for 390.Xr login_krb5 8 391if using 392Kerberos 393for authentication. 394.Ss System command scripts 395The 396.Pa /etc/rc.*\& 397scripts are invoked at boot time, after single user mode has exited, 398and at shutdown. 399The whole process is controlled, more or less, by the master script 400.Pa /etc/rc . 401This script should not be changed by administrators. 402.Pp 403.Pa /etc/rc 404is in turn influenced by the configuration variables present in 405.Pa /etc/rc.conf . 406Again this script should not be changed by administrators: 407site-specific changes should be made to 408.Pq freshly created if necessary 409.Pa /etc/rc.conf.local . 410.Pp 411Any commands which should be run before the system sets its 412secure level should be made to 413.Pa /etc/rc.securelevel , 414and commands to be run after the system sets its 415secure level should be made to 416.Pa /etc/rc.local . 417Commands to be run before system shutdown should be set in 418.Pa /etc/rc.shutdown . 419.Pp 420For more information about system startup/shutdown files, see 421.Xr rc 8 , 422.Xr rc.conf 8 , 423.Xr securelevel 7 , 424and 425.Xr rc.shutdown 8 . 426.Pp 427If you've installed X, you may want to turn on 428.Xr xdm 1 , 429the X Display Manager. 430To do this, change the value of 431.Va xdm_flags 432in 433.Pa /etc/rc.conf.local . 434.Ss Set keyboard type 435Some architectures permit keyboard type control. 436Use the 437.Xr kbd 8 438command to change the keyboard encoding. 439.Ic kbd -l 440will list all available encodings. 441.Ic kbd xxx 442will select the 443.Ic xxx 444encoding. 445Store the encoding in 446.Pa /etc/kbdtype 447to make sure it is set automatically at boot time. 448.Ss Printers 449Edit 450.Pa /etc/printcap 451and 452.Pa /etc/hosts.lpd 453to get any printers set up. 454Consult 455.Xr lpd 8 456and 457.Xr printcap 5 458if needed. 459.Ss Mail aliases 460Edit 461.Pa /etc/mail/aliases 462and set the three standard aliases to go to either a mailing list, or 463the system administrator. 464.Bd -literal -offset indent 465# Well-known aliases -- these should be filled in! 466root: sysadm 467manager: root 468dumper: root 469.Ed 470.Pp 471Run 472.Xr newaliases 8 473after changes. 474.Ss Sendmail 475The default mail agent on 476.Ox 477is 478.Xr sendmail 8 . 479Details on how to configure an alternative mailer are documented in 480.Xr mailer.conf 5 . 481.Pp 482.Ox 483ships with a default 484.Pa /etc/mail/localhost.cf 485file that will work for simple installations; it was generated from 486.Pa openbsd-localhost.mc 487in 488.Pa /usr/share/sendmail/cf . 489Please see 490.Pa /usr/share/sendmail/README 491for information on generating your own sendmail configuration files. 492For the default installation, sendmail is configured to only accept 493connections from the local host. 494This makes it possible to send mail locally, but not receive mail from remote 495servers, which is ideal if you have one central incoming mail machine and 496several clients. 497To cause sendmail to accept external network connections, modify the 498.Va sendmail_flags 499variable in 500.Pa /etc/rc.conf.local 501to use the 502.Pa /etc/mail/sendmail.cf 503file in accordance with the comments therein. 504This file was generated from 505.Pa openbsd-proto.mc . 506.Pp 507Note that sendmail now also listens on port 587 by default. 508This is to implement the RFC 6409 message submission protocol. 509You may disable this via the 510.Ic no_default_msa 511option in your sendmail .mc file. 512See 513.Pa /usr/share/sendmail/README 514for more information. 515.Ss Daily, weekly, monthly scripts 516Review 517.Xr daily 8 518to understand what the periodic system maintenance scripts do and 519how to customize them: 520For example, to enable 521.Ev ROOTBACKUP 522or to disable 523.Ev VERBOSESTATUS , 524or to add local maintenance code to 525.Pa /etc/daily.local , /etc/weekly.local , 526or 527.Pa /etc/monthly.local . 528.Ss Tighten up security 529You might wish to tighten up security more by editing 530.Pa /etc/fbtab 531as when installing X. 532In 533.Pa /etc/inetd.conf 534comment out any extra entries you do not need, 535and only add things that are really needed. 536.Ss Other files in /etc 537Look at the other files in 538.Pa /etc 539and edit them as needed. 540(Do not edit files ending in 541.Pa .db 542\(em like 543.Pa pwd.db , spwd.db , 544nor 545.Pa localtime , 546nor 547.Pa rmt , 548nor any directories.) 549.Ss Crontab (background running processes) 550Check what is running by typing 551.Ic crontab -l 552as root 553and see if anything unexpected is present. 554Do you need anything else? 555Do you wish to change things? 556See 557.Xr crontab 5 . 558.Ss Next day cleanup 559After the first night's 560.Xr security 8 561run, change ownerships and permissions 562on files, directories, and devices; root may have received mail 563with subject: "<hostname> daily insecurity output". 564This mail contains a set of security recommendations, 565presented as a list looking something like this: 566.Bd -literal -offset indent 567var/mail: 568 permissions (0755, 0775) 569etc/daily: 570 user (0, 3) 571.Ed 572.Pp 573The best bet is to follow the advice in that list. 574The recommended setting is the first item in parentheses, while 575the current setting is the second one. 576This list is generated by 577.Xr mtree 8 578using 579.Pa /etc/mtree/special . 580Use 581.Xr chmod 1 , 582.Xr chgrp 1 , 583and 584.Xr chown 8 585as needed. 586.Ss Daemons 587Enable/disable any daemon processes as necessary. 588.Xr intro 8 589contains a comprehensive guide to the various daemons available on the 590.Ox 591system. 592.Ss Packages 593Install your own packages. 594The 595.Ox 596ports collection includes a large set of third-party software. 597A lot of it is available as binary packages that you can install using 598.Xr pkg_add 1 . 599See 600.Xr ports 7 601and 602.Xr packages 7 603for more details. 604To start daemons installed from packages, see 605.Xr rc.d 8 . 606.Pp 607There is also other third-party software that is available 608in source form only, either because it has not been ported to 609.Ox 610yet, or because licensing restrictions make binary redistribution 611impossible. 612Sometimes checking the mailing lists for 613past problems that people have encountered will result in a fix posted. 614.Ss Compiling a kernel 615Information on building and modifying kernels 616is contained within 617.Xr config 8 . 618.Sh SEE ALSO 619.Xr ksh 1 , 620.Xr man 1 , 621.Xr pkg_add 1 , 622.Xr ps 1 , 623.Xr vi 1 , 624.Xr hier 7 , 625.Xr config 8 , 626.Xr dmesg 8 , 627.Xr ifconfig 8 , 628.Xr intro 8 , 629.Xr sudo 8 , 630.Xr sysctl 8 631.Sh HISTORY 632This document first appeared in 633.Ox 2.2 . 634