AFTERBOOT(8)            OpenBSD System Manager's Manual           AFTERBOOT(8)

NAME
     afterboot - things to check after the first complete boot

DESCRIPTION
     This document attempts to list items for the system administrator to
     check and set up after the installation and first complete boot of the
     system.  The idea is to create a list of items that can be checked off so
     that you have a warm fuzzy feeling that something obvious has not been
     missed.

     Complete instructions for correcting and fixing items is not provided.
     There are man pages and other methodologies available for doing that.
     For example, to view the manual page on the ls(1) command, type: man 1
     ls.

   Errata
     By the time that you have installed your system, it is quite likely that
     bugs in the release have been found.  All significant and easily fixed
     problems will be reported at http://www.openbsd.org/errata.html. The web
     page will mention if a problem is security related.  And it is good ad-
     vice to check this page regularly.

   Login
     Login on the console as ``root''. You will not be able to login over the
     network -- only on the console. This behavior is controlled through the
     /etc/ttys file. See ttys(5) for more information.

   System Date
     Check the system date with the date(1) command.  If needed, change the
     date, and/or change the symbolic link of /etc/localtime to the correct
     time zone in the /usr/share/zoneinfo directory.

     Examples:

     date 199901271504
           Set the current date to January 27th, 1999 3:04pm.

     ln -fs /usr/share/zoneinfo/Canada/Atlantic /etc/localtime
           Set the time zone to Atlantic Standard Time.

   Root password
     Check the password for the root user.  Choose a password that has num-
     bers, digits, and special characters (not space) as well as from the up-
     per and lower case alphabet.  Do not choose any word in any language.  It
     is common for an intruder to use dictionary attacks.  Type the command
     /usr/bin/passwd to change it.

     It is a good idea to always specify the full path name for both the pass-
     wd(1) and su(1) commands as this inhibits the possibility of files placed
     in your execution PATH for most shells. Furthermore, the super-user's
     PATH should never contain the current directory (``.'').

   Check hostname
     Use the hostname(1) command to verify that the name of your machine is
     correct.  See the man page for hostname if you need to change it.  You
     will also need to edit the /etc/myname file to have it stick around for
     the next reboot.

   Verify network interfaces configured correctly
     The first thing to do is an ifconfig -a to see if the network interfaces
     are properly configured.  Correct by editing /etc/hostname.interface
     (where interface is the interface name, e.g.  ``le0'') and then using if-
     config(8) to manually configure it if you do not wish to reboot.  The
     loopback interface will look something like:

           lo0: flags=8009<UP,LOOPBACK,MULTICAST>
                   inet 127.0.0.1 netmask 0xff000000

     an ethernet interface something like:

           le0: flags=9863<UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST>
                   inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255

     and, a PPP interface something like:

           ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST>
                   inet 203.3.131.108 --> 198.181.0.253 netmask 0xffff0000

     You may wish to turn off multicast routing in /etc/netstart by commenting
     it out, i.e. by placing a # sign at the start of the line:

           # route add -net 224.0.0.0 -interface $hostname

     See dhcp(8) for instructions on configuring interfaces with DHCP.

   Check for correct routing
     Do a netstat -r -n command.  The output will look something like:

           Routing tables

           Internet:
           Destination    Gateway           Flags  Refs     Use  Mtu
           Interface
           default        192.168.4.254     UGS      0 11098028    -  le0
           127            127.0.0.1         UGRS     0        0    -  lo0
           127.0.0.1      127.0.0.1         UH       3       24    -  lo0
           192.168.4      link#1            UC       0        0    -  le0
           192.168.4.52   8:0:20:73:b8:4a   UHL      1     6707    -  le0
           192.168.4.254  0:60:3e:99:67:ea  UHL      1        0    -  le0

     Fix by editing the file /etc/mygate and using route delete and route add
     if you do not wish to reboot.  See route(8).

     If you wish to route packets between interfaces you do that by putting

           net.inet.ip.forwarding=1

     in /etc/sysctl.conf, or by compiling a new kernel with the GATEWAY op-
     tion.  Packets are not forwarded by default, due to RFC requirements.

     You can add new "virtual interfaces" by adding the required entries to
     /etc/ifaliases.

   BIND Name Server (DNS)
     If you are using the BIND Name Server, check the /etc/resolv.conf file.
     It may look something like:

           domain nts.umn.edu
           nameserver 128.101.101.101
           nameserver 134.84.84.84
           search nts.umn.edu. umn.edu.
           lookup file bind

     If using a caching name server add the line "nameserver 127.0.0.1" first.
     For a local caching name server to run you will need to set "named_flags"
     in /etc/rc.conf and create the named.boot file in the appropriate place
     for named(8).  The same holds true if the machine is going to be a name
     server for your domain.  In both these cases, make sure that named(8) is
     running (otherwise there are long waits for resolver timeouts).
   YP verification (NIS)
     Check the YP domain name with the domainname(1) command. If necessary,
     correct it by editing the /etc/defaultdomain file. The /etc/netstart
     script reads this file on bootup to determine and set the domain name.
     You may also set the running system's domain name with the domainname(1)
     command.  To start YP client services, simply run ypbind, then perform
     the remaining YP activation as described in passwd(5) and group(5).

     In particular, to enable YP passwd support, you'll need to add the fol-
     lowing line to /etc/master.passwd:

     +:*::::::::

     Once this is done, you'll need to run pwd_mkdb /etc/master.passwd to re-
     generate the password databases.

     There are many more YP man pages available to help you. You can find more
     information by starting with yp(8).

   Check disks are mounted correctly
     Check that the disks are mounted correctly by comparing the file
     /etc/fstab against the output of the mount(8) and df(1) commands.  Exam-
     ple:

           # cat /etc/fstab
           /dev/sd0a / ffs rw 1 1
           /dev/sd0b none swap sw 0 0
           /dev/sd0d /usr ffs rw,nodev 1 2
           /dev/sd0e /var ffs rw,nodev,noexec 1 2
           /dev/sd0g /tmp ffs rw,nodev,noexec,nosuid 1 2
           /dev/sd0h /home ffs rw,nodev,nosuid 1 2
           # mount
           /dev/sd0a on / type ffs (local)
           /dev/sd0d on /usr type ffs (local, nodev)
           /dev/sd0e on /var type ffs (local, nodev, noexec)
           /dev/sd0g on /tmp type ffs (local, nodev, noexec, nosuid)
           /dev/sd0h on /home type ffs (local, nodev, nosuid)
           # df
           Filesystem  1024-blocks     Used    Avail Capacity  Mounted on
           /dev/sd0a         22311    14589     6606    69%    /
           /dev/sd0d        203399   150221    43008    78%    /usr
           /dev/sd0e         10447      682     9242     7%    /var
           /dev/sd0g         18823        2    17879     0%    /tmp
           /dev/sd0h          7519     5255     1888    74%    /home
           # pstat -s
           Device      512-blocks     Used    Avail Capacity  Priority
           /dev/sd0b       131072    84656    46416    65%    0

     Edit /etc/fstab and use the mount(8) and umount(8) commands as appropri-
     ate.

     You may wish to do NFS partitions now too, or you can do them later.

   Concatenated disks (ccd)
     If you are using ccd(4) concatenated disks, edit /etc/ccd.conf and use
     the ccdconfig -U command to unload, and the ccdconfig -C command to cre-
     ate tables internal to the kernel for the concatenated disks.  You then
     mount(8),  umount(8) and edit /etc/fstab as needed.

   Automounter daemon (AMD)
     If using the amd(8) package, go into the /etc/amd directory and set it up
     by renaming master.sample to master and editing it and creating other
     maps as needed.  Alternatively, you can get your maps with YP.

INSTALLING SHARED CRYPTO LIBRARIES WITH RSA INCLUDED
     Two OpenBSD libraries ( libssl and libcrypto , based on OpenSSL) imple-
     ment many cryptographic functions which are used by OpenBSD programs like
     ssh(1),  httpd(8),  and isakmpd(8).  Due to patent licensing reasons,
     those libraries may not be included on the CD -- instead the base distri-
     bution contains libraries which have had the troublesome code removed --
     the programs listed above will not be fully functional as a result.  Li-
     braries which _include_ the troublesome routines are available and can be
     FTP installed, as long as you meet the following (legal) criteria:

   Outside the USA, no restrictions apply
     Since the RSA algorithm patent by RSA inc. only applies in the United
     States you can use the free ssl26.tgz package. System install scripts on
     machine architectures that support shared libraries will offer to let you
     install this package when you are installing your system.  To see if you
     have it installed, type

     pkg_info ssl26

     If the ssl26 package is not installed, pkg_info(8) will display a message
     that it can't find package `ssl26'. If you did not install the package
     when you installed your system, You can install it with a pkg_add(8) com-
     mand similar to:

     pkg_add ftp://ftp.openbsd.org/pub/OpenBSD/2.6/packages/<a>/ssl26.tgz

     replacing <a> with your machine architechture, e.g. i386.

   Inside the USA, non-commercial use of RSAREF is permitted.
     Non-commercial entities in the USA may install the sslUSA26.tgz package,
     which uses RSAREF. You install this with a pkg_add(8) command similar to:

     pkg_add ftp://ftp.openbsd.org/pub/OpenBSD/2.6/packages/<a>/sslUSA26.tgz
     replacing <a> with your machine architechture, e.g. i386.

   Commercial entities in the USA are left in the
     While unfortunate, this is due to the way RSA inc. licences their patent
     in the USA. (This is how the USA crypto export policy feels to the rest
     of the world).

   Shared Library Support is Required.
     These packages update your system by installing shared libraries in
     /usr/local/lib. This only works if your machine architecture supports
     shared libraries.  the ssl26 and sslUSA26 packages are only available for
     machines which support shared libraries.  If your architecture does not
     support shared libraries and you wish it did, consider donating hardware,
     cash, or quality time to the project to assist developers in supporting
     your platform better.

CHANGING /ETC FILES
     The system should be usable now, but you may wish to do more customizing,
     such as adding users, etc.  Many of the following sections may be skipped
     if you are not using that package (for example, skip the Kerberos section
     if you won't be using Kerberos). We suggest that you cd /etc and edit
     most of the files in that directory.

   /etc/motd
     Edit motd to make lawyers comfortable and make sure that no mention of
     the word "Welcome" appears.  (Some U.S. lawyers have stated that the word
     "Welcome" is an invitation to come on in.)

   Add new users
     Add users.  There is an adduser(8) script.  You may use vipw(8) to add
     users to the /etc/passwd file and edit /etc/group by hand to add new
     groups.  The manual page for su(8),  tells you to make sure to put people
     in the `wheel' group if they need root access (non-Kerberos).  For exam-
     ple:

           wheel:*:0:root,myself

     Follow instructions for kerberos(1) if using Kerberos for authentication.

   rc.conf, netstart, rc.local, rc.securelevel
     Check for any local changes needed in the files: /etc/rc.conf,
     /etc/netstart, /etc/rc.local, rc.securelevel. Turning on something like
     the Network Time Protocol in /etc/rc.securelevel requires making sure the
     package is installed.

     If you've installed X, you may want to turn on xdm(1),  the X Display
     Manager. To do this, change the value of xdm_flags in /etc/rc.conf.

   Printers
     Edit /etc/printcap and /etc/hosts.lpd to get any printers set up.  Con-
     sult lpd(8) and printcap(5) if needed.

   Tighten up security
     You might wish to tighten up security more by editing /etc/fbtab as when
     installing X.  In /etc/inetd.conf turn off extra stuff that you do not
     need, and only add things that are really needed.

   Kerberos
     If you are going to use kerberos(1) for authentication, and you already
     have a Kerberos master, go into the directory /etc/kerberosIV and config-
     ure.  Remember to get a srvtab from the master so that the remote com-
     mands work.

   Mail Aliases
     Edit /etc/aliases and set the four standard aliases to go to either a
     mailing list, or the system administrator.

           # Well-known aliases -- these should be filled in!
           root:           sysadm
           manager:        sysadm
           dumper:         sysadm
           operator:       sysadm

     Run newaliases(1) after changes.

   Sendmail
     OpenBSD ships with a default /etc/sendmail.cf file that will work for
     simple installations; it was generated from openbsd-proto.mc in
     /usr/share/sendmail/cf. Please see /usr/share/sendmail/README and
     /usr/share/doc/smm/08.sendmailop/op.me for information on generating your
     own sendmail configuration files.

   BOOTP server
     If this is a BOOTP server, edit /etc/bootptab as needed.  You will have
     to turn it on in /etc/inetd.conf or run bootpd(8) in its standalone mode.

   NFS server
     If this is an NFS server make sure /etc/rc.conf has:

           nfs_server=YES

     Edit /etc/exports and get it correct.  It is probably easier to reboot
     than to get the daemons running manually, but you can get the order cor-
     rect by looking at /etc/netstart.

   HP remote boot server
     Edit /etc/rbootd.config if needed for remote booting.  If you do not have
     HP computers doing remote booting, do not enable this.

   Daily, Weekly, Monthly scripts
     Look at and possibly edit the /etc/daily, /etc/weekly, and /etc/monthly
     scripts.  Your site specific things should go into /etc/daily.local,
     /etc/weekly.local, and /etc/monthly.local.

     These scripts have been limited so as to keep the system running without
     filling up disk space from normal running processes and database updates.
     (You probably do not need to understand them.)

   Other files in /etc
     Look at the other files in /etc and edit them as needed.  (Do not edit
     files ending in .db -- like aliases.db, pwd.db, spwd.db, nor localtime,
     nor rmt, nor any directories.)

   Crontab (background running processes)
     Check what is running by typing crontab -l as root and see if anything
     unexpected is present.  Do you need anything else?  Do you wish to change
     things?  e.g. if you do not like root getting standard output of the dai-
     ly scripts, and want only the security scripts that are mailed internal-
     ly, you can type crontab -e and change some of the lines to read:

           30  1  *  *  *   /bin/sh /etc/daily 2>&1 > /var/log/daily.out
           30  3  *  *  6   /bin/sh /etc/weekly 2>&1 > /var/log/weekly.out
           30  5  1  *  *   /bin/sh /etc/monthly 2>&1 > /var/log/monthly.out
     See crontab(5).

   Next day cleanup
     After the first night's security run, change ownerships and permissions
     on things.  The best bet is to have permissions as in the security list.
     (The first of the two listed permissions, and the first group number of
     the two).  Use chmod(1),  chgrp(1),  and chown(8) as needed.

   Packages
     Install your own packages.  The simple way is to copy source and compile
     and link/load.

     Copy vendor binaries and install them.  You will need to install any
     shared libraries, etc.  (Hint: man -k compat to find out how to install
     and use compatibility mode.)

     Install any of a large group of Third-Party Software that is available in
     source form.  See http://www.openbsd.org under `Ports: a Nice Way to Get
     Third-Party Software'.

     You may have some difficulty installing due to various compiling errors.
     Don't get discouraged easily!  Sometimes checking the mailing lists for
     past problems that people have encountered will result in a fix posted.
     One recent item says to delete -lcrypt from Makefile s as the crypt rou-
     tines are now present in the standard libraries.

COMPILING A KERNEL
     First, review the system message buffer using the dmesg(8) command to
     find out information on your system's devices as probed by the kernel at
     boot. In particular, note which devices were not configured. This infor-
     mation will prove useful when editing kernel configuration files.

     To compile your own kernel off a CDROM do the following:

           # cd /somedir
           # cp /usr/src/sys/arch/somearch/conf/SOMEFILE .
           # vi SOMEFILE   (to make any changes)
           # config -s /usr/src/sys -b . SOMEFILE
           # make

     To compile a kernel inside a writable source tree, do the following:

           # cd /usr/src/sys/arch/somearch/conf
           # vi SOMEFILE   (to make any changes)
           # config SOMEFILE
           # cd ../compile/SOMEFILE
           # make

     where somedir is a writable directory, somearch is the architecture (e.g.
     i386), and SOMEFILE should be a name indicative of a particular configu-
     ration (often that of the hostname).  You can also do a make depend so
     that you will have dependencies there the next time you do a compile.

     After either of these two methods, you can place the new kernel (called
     bsd) in / (i.e.  /bsd) and the system will boot it next time.  Most peo-
     ple save their backup kernels as /bsd.1, /bsd.2, etc.

     It is not always necessary to recompile the kernel if only configuration
     changes are required.  With config(8),  you can change the device config-
     uration in the kernel file directly:

     #  config -e -o bsd.new /bsd
     OpenBSD 2.6-beta (GENERIC.rz0) #0: Mon Oct  4 03:57:22 MEST 1999
         root@winona:/usr/src/sys/arch/pmax/compile/GENERIC.rz0
     Enter 'help' for information
     ukc>

     Additionally, you can permantly save the changes made with UKC during boot
     time in the kernel image.

SEE ALSO
     chgrp(1),  chmod(1),  crontab(1),  date(1),  df(1),  hostname(1),
     kerberos(1),  make(1),  man(1),  netstat(1),  newaliases(1),  passwd(1),
     su(1),  ccd(4),  aliases(5),  bootptab(5),  crontab(5),  exports(5),
     fbtab(5),  fstab(5),  group(5),  krb.conf(5),  krb.realms(5),  passwd(5),
      rbootd(5),  resolv.conf(5),  hostname(7),  adduser(8),  amd(8),
     bootpd(8),  ccdconfig(8),  chown(8),  config(8),  dhcp(8),
     domainname(8),  ext_srvtab(8),  ifconfig(8),  inetd(8),  mount(8),
     named(8),  rc(8),  rmt(8),  route(8),  umount(8),  vipw(8),  ypbind(8)

HISTORY
     This document first appeared in OpenBSD 2.2.

OpenBSD 2.6                    October 20, 1997                              7
