AFTERBOOT(8)

🌸 NAME 🌸

afterboot — things to check after the first complete boot 💖

(this is AFTERBOOT(8), straight out of the System Manager's Manual, and yes bestie we're doing the whole glow-up checklist)

---

✨ DESCRIPTION ✨

🎀 Starting Out 🎀

Okay so picture this: you just installed the system, you did the first complete boot, and now you're sitting there like… now what 😭. This doc is literally a checklist of stuff for the sysadmin to peep and set up post-install, so you get that warm fuzzy "nothing obvious got missed" feeling 🫶. It assumes you already have a basic knowledge of Unix, no cap.

Heads up though: this page does not hand you full step-by-step instructions for fixing every single thing. For that there's manual pages and other methodologies — they exist, go use them 💅. Example: to view the man page for the ls(1) command, you type:

man 1 ls

Administrators will rapidly become more familiar with NetBSD if they get used to using the manual pages. (Real. The man pages are the moment, iykyk.)

🔑 Login 🔑

On a fresh install with no other user accounts, you log in as root. You can do it on the console, or over the network using ssh(1). If you've enabled the SSH daemon (see sshd(8)) and you're like "yes I want root logins over the network," edit the /etc/ssh/sshd_config file and set PermitRootLogin to yes (see sshd_config(5)). The default is to not permit root logins over the network after a fresh install in NetBSD. Periodt.

Upon successful login on the console, you may see the message "We recommend creating a non-root account...". Listen to it 🥺 — for security reasons it's bad practice to login as root during regular use and maintenance of the system. In fact, the system will only let you login as root on a secure terminal, and by default only the console is considered a secure terminal. Instead, administrators are encouraged to add a "regular" user, add said user to the wheel group, then use the su(1) command when root privileges are required:

useradd -G wheel -m myuser
passwd myuser

🛡️ Root password 🛡️

Change the password for the root user. (Quick note that gets said throughout the documentation: the term "superuser" is a synonym for the root user — same thing, different little nickname 💜.) Choose a password that has numbers, digits, and special characters (not space) as well as from the upper and lower case alphabet. Do not choose any word in any language. It is common for an intruder to use dictionary attacks, and we are not giving them that win 🙈. Type the command /usr/bin/passwd to change it.

It is a good idea to always specify the full path name for both the passwd(1) and su(1) commands, as this inhibits the possibility of files placed in your execution PATH for most shells. Furthermore, the superuser's PATH should never contain the current directory (.) 👑.

📅 System date 📅

Check the system date with the date(1) command. If needed, change the date, and/or change the symbolic link of /etc/localtime to the correct time zone in the /usr/share/zoneinfo directory.

Examples:

date 202010051820

• Set the current date to October 5th, 2020 6:20pm.

ln -fs /usr/share/zoneinfo/Europe/Helsinki /etc/localtime

• Set the time zone to Eastern Europe Summer Time.

⌨️ Console settings ⌨️

One of the first things you will likely need to do is to set up your keyboard map (and maybe some other aspects about the system console). To change your keyboard layout, edit the encoding variable found in /etc/wscons.conf.

wscons.conf(5) contains more information about this file 💅.

🚨 Security alerts 🚨

All significant and easily fixed problems will be reported at the security advisories web page: https://www.NetBSD.org/support/security/ — it is recommended that you check this page regularly, bestie, like it's your fave account's story 🌈.

Additionally, you should set fetch_pkg_vulnerabilities=YES in /etc/daily.conf to allow your system to automatically update the local database of known vulnerable packages to the latest version available on-line. The system will later check, on a daily basis, if any of your installed packages are vulnerable based on the contents of this database. See daily.conf(5) and security.conf(5) for more details 🔥.

🎲 Entropy 🎲

If your machine does not have a hardware random number generator, it may not be safe to use on the internet until it has enough entropy to generate unpredictable secrets for programs like web browsers and ssh(1). You can use rndctl(8) to list the entropy sources with rndctl -l, or save entropy from another machine running NetBSD with rndctl -S and load it on this one with rndctl -L (as long as there are no eavesdroppers on the medium between the two machines 👀). See entropy(7) for more details.

🏷️ Check hostname 🏷️

Use the hostname command to verify that the name of your machine is correct. See the man page for hostname(1) if it needs to be changed. You will also need to change the contents of the hostname variable in /etc/rc.conf or edit the /etc/myname file to have it stick around for the next reboot. Note that hostname is supposed to include a domainname, and that this should not be confused with YP (NIS) domainname(1). If you are using dhcpcd(8) to configure network interfaces, it might override these local hostname settings if your DHCP server specifies client's hostname with other network configurations 😬.

🌐 Verify network interface configuration 🌐

The first thing to do is an ifconfig -a to see if the network interfaces are properly configured. Correct by editing /etc/ifconfig.interface or the corresponding ifconfig_interface variable in rc.conf(5) (where interface is the interface name, e.g. le0) and then using ifconfig(8) to manually configure it if you do not wish to reboot.

Alternatively, many networks allow interfaces to be configured automatically via DHCP. To get dhcpcd(8) to start automatically on boot, you will need to have this line in /etc/rc.conf:

dhcpcd=YES

See dhcpcd(8) and dhcpcd.conf(5) for more information on setting up a DHCP client. For information on setting up Wi-Fi, see "Wireless networking".

You can add new "virtual interfaces" by adding the required entries to /etc/ifconfig.interface. Read the ifconfig.if(5) man page for more information on the format of /etc/ifconfig.interface files. The loopback interface will look something like:

lo0: flags=8009<UP,LOOPBACK,MULTICAST> mtu 32972
        inet 127.0.0.1 netmask 0xff000000
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3
        inet6 ::1 prefixlen 128

an Ethernet interface something like:

le0: flags=9863<UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST>
        inet 192.168.4.52 netmask 0xffffff00 broadcast 192.168.4.255
        inet6 fe80::5ef0:f0f0%le0 prefixlen 64 scopeid 0x1

and a PPP interface something like:

ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST>
        inet 203.3.131.108 --> 198.181.0.253 netmask 0xffff0000

See mrouted(8) for instructions on configuring multicast routing 🦋.

🗺️ Check routing tables 🗺️

Issue a netstat -rn command. The output will look something like:

Routing tables

Internet:
Destination    Gateway           Flags  Refs     Use  Mtu  Interface
default        192.168.4.254     UGS      0 11098028    -  le0
127            127.0.0.1         UGRS     0        0    -  lo0
127.0.0.1      127.0.0.1         UH       3       24    -  lo0
192.168.4      link#1            UC       0        0    -  le0
192.168.4.52   8:0:20:73:b8:4a   UHL      1     6707    -  le0
192.168.4.254  0:60:3e:99:67:ea  UHL      1        0    -  le0

Internet6:
Destination        Gateway       Flags  Refs  Use     Mtu  Interface
::/96              ::1           UGRS     0     0   32972  lo0 =>
::1                ::1           UH       4     0   32972  lo0
::ffff:0.0.0.0/96  ::1           UGRS     0     0   32972  lo0
fc80::/10          ::1           UGRS     0     0   32972  lo0
fe80::/10          ::1           UGRS     0     0   32972  lo0
fe80::%le0/64      link#1        UC       0     0    1500  le0
fe80::%lo0/64      fe80::1%lo0   U        0     0   32972  lo0
ff01::/32          ::1           U        0     0   32972  lo0
ff02::%le0/32      link#1        UC       0     0    1500  le0
ff02::%lo0/32      fe80::1%lo0   UC       0     0   32972  lo0

The default gateway address is stored in the defaultroute variable in /etc/rc.conf, or in the file /etc/mygate. If you need to edit this file, a painless way to reconfigure the network afterwards is to issue

service network restart

Or, you may prefer to manually configure using a series of route add and route delete commands (see route(8)). If you run dhcpcd(8) you will have to kill it by running

service dhcpcd stop

before you flush the routes ⭐.

If you wish to route packets between interfaces, add one or both of the following directives (depending on whether IPv4 or IPv6 routing is required) to /etc/sysctl.conf:

net.inet.ip.forwarding=1
net.inet6.ip6.forwarding=1

As an alternative, compile a new kernel with the GATEWAY option. Packets are not forwarded by default, due to RFC requirements 💀.

🧩 Device nodes 🧩

By default, nodes are created in /dev for a fairly typical number of devices.

However, if this system has a large number of devices connected (e.g. for large scale storage), you may want to enable devpubd(8) to ensure a sufficient number of nodes are available. Set devpubd=YES in /etc/rc.conf to create nodes automatically during system runtime. You can also run the node creation script by hand:

cd /dev && sh MAKEDEV

🐚 Secure Shell (SSH) 🐚

By default, all services are disabled in a fresh NetBSD installation, and SSH is no exception. You may wish to enable it so you can remotely control your system. Set sshd=YES in /etc/rc.conf and then starting the server with the command

service sshd start

The first time the server is started, it will generate a new keypair, which will be stored inside the directory /etc/ssh 🔐.

🌍 Host names and DNS 🌍

The system resolves host names according the rules for hosts in the name service switch configuration at /etc/nsswitch.conf. By default, it will query /etc/hosts first, and then the DNS resolver specified in /etc/resolv.conf.

Multicast DNS and DNS Service Discovery are usually not enabled by default on a fresh NetBSD system, and can be enabled by setting mdnsd=YES in /etc/rc.conf, and either rebooting or running the following command:

service mdnsd start

You may also wish to enable mdnsd as a source for host lookups in /etc/nsswitch.conf, see nsswitch.conf(5) 💖.

If your network does not have a usable DNS resolver, e.g. one provided by DHCP, you can run a local caching recursive resolver by setting unbound=YES or named=YES (BIND) in /etc/rc.conf and either rebooting or running the following command:

service unbound start

or

service named start

no cap, unbound(8) and named(8) ship pre-configured in /etc/unbound/unbound.conf and /etc/named.conf (respectively, bestie, keep up 💅) to run as your local caching recursive resolver. then like, to actually make the system use it, drop this into /etc/resolv.conf:

nameserver 127.0.0.1

and boom, you're your own DNS plug now ✨

🦋 Wireless networking 🦋

okay so to get your system connecting to a Wi-Fi network that has a password, using WPA:

wpa_passphrase networkname password >> /etc/wpa_supplicant.conf

and if it's an open wireless network with no password at all? don't use wpa_passphrase(8) for that, just edit /etc/wpa_supplicant.conf yourself like the main character you are:

network={
        ssid="Public-WiFi"
        key_mgmt=NONE
        priority=100
}

then bring up the interface and start the necessary daemons:

ifconfig iwm0 up
service wpa_supplicant onestart
service dhcpcd onestart

and to make it auto-connect at boot (so you literally never think about it again, slay), add this to /etc/rc.conf:

ifconfig_iwm0="up"
dhcpcd=YES
wpa_supplicant=YES

while you're vibing in wpa_supplicant(8), you can pull network scan results so easily with wpa_cli(8):

wpa_cli scan_results

or if you wanna trigger a fresh rescan:

wpa_cli scan

✨ iykyk ✨

🔥 RPC-based network services 🔥

several services literally depend on the RPC portmapper rpcbind(8) — formerly known as portmap — being up and running for proper operation. this includes YP (NIS) and NFS exports, among other services. so to get the RPC portmapper starting automatically on boot, you'll need this line chilling in /etc/rc.conf:

rpcbind=YES

🌸 YP (Network Information Service) Setup 🌸

first step: check the YP domain name with the domainname(1) command. if it's wrong (🙈), fix it by editing the /etc/defaultdomain file or by setting the “domainname” variable in /etc/rc.conf. the /etc/rc.d/network script reads this file on bootup to figure out and set the domain name. you can also set the running system's domain name with domainname(1) directly. and to start YP client services, simply run ypbind, then do the rest of the YP activation as described in passwd(5) and group(5).

specifically, to enable YP passwd support, you'll need to update /etc/nsswitch.conf so it includes “nis” for the “passwd” and “group” entries. there's also a traditional way to accomplish the same thing: add the following entry to the local passwd database via vipw(8):

+:*::::::::

⚠️ heads up bestie: this entry has to be the very last one. also this traditional way works with the default nsswitch.conf(5) setting of “passwd”, which is “compat”. keep that in mind 💀

there are so many more YP man pages available to help you out. you can find more info by starting with nis(8).

🎀 Check disk mounts 🎀

check that your disks are mounted correctly by comparing the /etc/fstab file against the output of the mount(8) and df(1) commands. example:

# cat /etc/fstab
/dev/sd0a / ffs     rw              1 1
/dev/sd0b none swap sw
/dev/sd0e /usr ffs  rw              1 2
/dev/sd0f /var ffs  rw              1 3
/dev/sd0g /tmp ffs  rw              1 4
/dev/sd0h /home ffs rw              1 5

# mount
/dev/sd0a on / type ffs (local)
/dev/sd0e on /usr type ffs (local)
/dev/sd0f on /var type ffs (local)
/dev/sd0g on /tmp type ffs (local)
/dev/sd0h on /home type ffs (local)

# df
Filesystem  1024-blocks     Used    Avail Capacity  Mounted on
/dev/sd0a         22311    14589     6606    69%    /
/dev/sd0e        203399   150221    43008    78%    /usr
/dev/sd0f         10447      682     9242     7%    /var
/dev/sd0g         18823        2    17879     0%    /tmp
/dev/sd0h          7519     5255     1888    74%    /home

# pstat -s
Device      512-blocks     Used    Avail Capacity  Priority
/dev/sd0b       131072    84656    46416    65%    0

edit /etc/fstab and use the mount(8) and umount(8) commands as appropriate. refer to the example above and fstab(5) for the format of this file.

you may wish to do NFS mounts now too, or you can do them later. your call, babe 💜

⭐ Clock synchronization ⭐

to make sure the system clock is synchronized to that of a publicly accessible NTP server, make sure /etc/rc.conf contains the following:

ntpdate=YES
ntpd=YES

see date(1), ntpdate(8), ntpd(8), rdate(8), and timed(8) for more info on setting the system's date. time is a construct but like, sync it anyway 🕐

👑 Installing packages 👑

the NetBSD packages collection, pkgsrc, includes a huge set of third-party software. a lot of it is available as binary packages that you can download from https://cdn.NetBSD.org/pub/pkgsrc/packages/NetBSD/ or a mirror. (mirrors are your besties too 🫶)

for most users, using pkgin to manage binary packages is recommended.

to install pkgin, if the installer didn't already do it for you:

PKG_PATH=https://cdn.NetBSD.org/pub/pkgsrc/packages/NetBSD/[...]
export PKG_PATH
pkg_add pkgin
pkgin update
pkgin install bash mpg123 fluxbox ...

see https://www.pkgsrc.org/ and pkgsrc/doc/pkgsrc.txt for more details. go get your software, queen 🌈

💅 CHANGING /etc FILES ✨

okay bestie so the system is literally usable now 🎉 but like… you're probably gonna wanna customize it more? add users, that whole vibe. and here's the thing — a LOT of the sections below you can straight up skip if you're not running that package. like, not using Kerberos? skip the Kerberos bit, no cap. we suggest you cd /etc and edit most of the files in that directory. main character energy.

⚠️ heads up: /etc/motd gets modified by /etc/rc.d/motd every single time the system boots. so if you want your custom message to survive, leave two blank lines at the top or your message WILL be overwritten. 💀

---

🫶 Add new users

to add new users and groups you got useradd(8) and groupadd(8) — and peep user(8) for even more user/group manipulation programs. you can also use vipw(8) to add users to /etc/passwd, and edit /etc/group by hand to add new groups.

the su(1) manual page lowkey tells you to make sure people go in the 'wheel' group if they need root access (non-Kerberos). like this:

wheel:*:0:root,myself

and if you're doing Kerberos for authentication, follow the instructions in kerberos(8).

🎀 System boot scripts and /etc/rc.local

/etc/rc and the /etc/rc.d/* scripts get invoked at boot time after single user mode has exited, and also at shutdown. the whole process is controlled by the master script /etc/rc — and admins should not change that one, periodt. 🙅

the directory /etc/rc.d contains a series of scripts used at startup/shutdown, called by /etc/rc. and /etc/rc is in turn influenced by the configuration variables sitting in /etc/rc.conf.

the script /etc/rc.local runs as the last thing during multiuser boot, and it exists so you can hook in any other local stuff your system needs. 🎀

⭐ rc.conf

to enable or disable various services on system startup, you make corresponding entries in /etc/rc.conf. go peek at /etc/defaults/rc.conf to see the list of default system variables — those are the ones you can override in /etc/rc.conf.

🚨 you are NOT supposed to change /etc/defaults/rc.conf directly. edit only /etc/rc.conf. fr fr.

see rc.conf(5) for more.

🦋 Automounter daemon (AMD)

wanna use the amd(8) automounter? create the /etc/amd directory, copy the example config files from /usr/share/examples/amd to /etc/amd, and customize them as needed. alternatively you can get your maps with YP. ✨

🌸 Concatenated disks (ccd)

using ccd(4) concatenated disks? edit /etc/ccd.conf. you might wanna check ccdconfig(8) for more info about that file. use the ccdconfig -U command to unload, and the ccdconfig -C command to create tables internal to the kernel for the concatenated disks. then you mount(8), umount(8), and edit /etc/fstab as needed. slay. 🫶

🔥 NetBSD Packet Filter

npf(7) is the default firewall used on NetBSD. you might wanna enable it if your machine is connected directly to the internet — honestly iconic security move. to do it: edit /etc/npf.conf and set "npf=YES" in /etc/rc.conf. config examples for NPF live in /usr/share/examples/npf. and before you install a configuration, you can validate it with npfctl(8). 💅

👑 X Display Manager

if you've installed X, you may wanna turn on xdm(1), the X Display Manager. just set "xdm=YES" in /etc/rc.conf. 👑

🍓 Printers

edit /etc/printcap and /etc/hosts.lpd to get any printers set up. consult lpd(8) and printcap(5) if needed. 🍓

🌈 Internet Services (inetd)

various internet services can be enabled in /etc/inetd.conf, including httpd(8) and finger(1).

🔒 note that by default all services are disabled for security reasons. only add things that are really needed. no "just in case" additions, bestie.

🧚 Kerberos

if you're gonna use Kerberos for authentication, see kerberos(8) and "info heimdal" for more info. if you already have a Kerberos master, change directory to /etc/kerberosV and configure. and remember to get a srvtab from the master so that the remote commands work. 🧚

💜 Mail Aliases

check /etc/mail/aliases and update it appropriately if you want e-mail routed to non-local addresses or to different users.

then run newaliases(1) after changes. don't forget the second step, that's the whole vibe. 💜

✨ Postfix

NetBSD uses Postfix as its Mail Transfer Agent. Postfix is started by default, but its initial configuration does not cause it to listen on the network for incoming connections. to configure Postfix, see /etc/postfix/main.cf and /etc/postfix/master.cf.

if you wish to use a different MTA (e.g., sendmail), install your MTA of choice and edit /etc/mailer.conf to point to the proper binaries. ✨

💖 DHCP server

if this is a DHCP server, edit /etc/dhcpd.conf and /etc/dhcpd.interfaces as needed. you'll have to make sure /etc/rc.conf has "dhcpd=YES" or run dhcpd(8) manually. 💖

🎀 Bootparam server

if this is a Bootparam server, edit /etc/bootparams as needed. you'll have to turn it on in /etc/rc.conf by adding "bootparamd=YES". 🎀

⭐ NFS server

if this is an NFS server, make sure /etc/rc.conf has:

nfs_server=YES
mountd=YES
rpcbind=YES

edit /etc/exports and get it correct. after this, you can start the server by issuing:

service rpcbind start
service mountd start
service nfsd start

which will also start dependencies. so convenient honestly. ⭐

🦋 HP remote boot server

edit /etc/rbootd.conf if needed for remote booting.

🛑 if you do not have HP computers doing remote booting, do not enable this.

🌸 Daily, weekly, monthly scripts

look at and possibly edit the /etc/daily.conf, /etc/weekly.conf, and /etc/monthly.conf configuration files. you can check which values you can set by looking at their matching files in /etc/defaults. your site specific things should go into /etc/daily.local, /etc/weekly.local, and /etc/monthly.local. 🌸

these scripts have been limited so as to keep the system running without filling up disk space from normal running processes and database updates. (you probably do not need to understand them. and honestly? that's fine, bestie.)

🔥 Other files in /etc

look at the other files in /etc and edit them as needed.

🙈 do not edit files ending in .db — like pwd.db, spwd.db, nor localtime, nor rmt, nor any directories. just… don't. 💀

👑 Crontab (background running processes)

check what's running by typing crontab -l as root and see if anything unexpected is present. do you need anything else? do you wish to change things? for example, if you don't like root getting standard output of the daily scripts, and want only the security scripts that are mailed internally, you can type crontab -e and change some of the lines to read:

30  1  *  *  *   /bin/sh /etc/daily 2>&1 > /var/log/daily.out
30  3  *  *  6   /bin/sh /etc/weekly 2>&1 > /var/log/weekly.out
30  5  1  *  *   /bin/sh /etc/monthly 2>&1 > /var/log/monthly.out

see crontab(5). 👑

💀 Next day cleanup

after the first night's security run, change ownerships and permissions on files, directories, and devices; root should have received mail with subject: "<hostname> daily insecurity output."

this mail contains a set of security recommendations, presented as a list looking like this:

var/mail:
        permissions (0755, 0775)
etc/daily:
        user (0, 3)

the best bet is to follow the advice in that list. the recommended setting is the first item in parentheses, while the current setting is the second one. this list is generated by mtree(8) using /etc/mtree/special. use chmod(1), chgrp(1), and chown(8) as needed. 🫶

---

🧪 SYSTEM TESTING

at this point, the system should be fully configured to your liking. it's now a good time to make sure the system behaves according to its specifications and that it's stable on your hardware. please refer to tests(7) for details on how to do so. 🌈

you can use ps(1), netstat(1), and fstat(1) to check on running processes, network connections, and opened files, respectively. other tools you may find useful are systat(1) and top(1). go off, monitoring queen. 👑

---

🔗 SEE ALSO

like, the whole extended friend group:

1. section 1: chgrp(1), chmod(1), config(1), crontab(1), date(1), df(1), domainname(1), fstat(1), hostname(1), make(1), man(1), netstat(1), newaliases(1), passwd(1), pkg_add(1), ps(1), ssh(1), su(1), systat(1), top(1), xdm(1)
2. section 4: ccd(4)
3. section 5: aliases(5), crontab(5), dhcpcd.conf(5), exports(5), fstab(5), group(5), hosts(5), ifconfig.if(5), mailer.conf(5), named.conf(5), nsswitch.conf(5), passwd(5), printcap(5), rc.conf(5), resolv.conf(5), sshd_config(5), wpa_supplicant.conf(5), wscons.conf(5)
4. section 7: hier(7), hostname(7), pkgsrc(7), tests(7)
5. section 8: amd(8), ccdconfig(8), chown(8), devpubd(8), dhcpcd(8), dhcpd(8), dmesg(8), groupadd(8), ifconfig(8), inetd(8), kerberos(8), lpd(8), mdnsd(8), mount(8), mrouted(8), mtree(8), named(8), nis(8), ntpd(8), ntpdate(8), rbootd(8), rc(8), rdate(8), rmt(8), route(8), rpc.bootparamd(8), rpcbind(8), sshd(8), timed(8), umount(8), useradd(8), vipw(8), wpa_cli(8), wpa_supplicant(8), yp(8), ypbind(8)

---

📜 HISTORY

this document first appeared in OpenBSD 2.2. it has been adapted to NetBSD and first appeared in NetBSD 2.0. a whole glow-up journey. 💖

---

and that's the whole page bestie, we made it 🎀✨ this lil gem is from the Debian crew, dated June 4, 2021, and it's AFTERBOOT(8) — go forth and boot fabulously. 💅🦋