View source for Things to do after the first complete boot of FreeBSD

<div style="float: right">__TOC__</div>

==Setting up the root account==
*<code>$ ssh-copy-id -i ~/.ssh/id_rsa.pub</code> (from a remote machine)
*Switch pkg(8) from Quarterly to Latest:
<pre>
# mkdir -p /usr/local/etc/pkg/repos
# echo 'FreeBSD-ports: { url: "pkg+http://pkg.FreeBSD.org/${ABI}/latest" }' > /usr/local/etc/pkg/repos/FreeBSD.conf

and

# echo 'FreeBSD-ports-kmods: { url: "pkg+https://pkg.FreeBSD.org/${ABI}/kmods_latest_${VERSION_MINOR}" }' >> /usr/local/etc/pkg/repos/FreeBSD.conf
or
# echo "FreeBSD-ports-kmods: { enabled: no }" >> /usr/local/etc/pkg/repos/FreeBSD.conf
</pre>
*<code># pkg install git vim</code>
*<code>$ mkdir -p ~/.config/vim/pack/vendor/start</code>
*<code>$ scp vimrc <host>:.config/vim</code> (from a remote machine)
*<code>$ cd ~/.config/vim/pack/vendor/start</code>
*<code>$ git clone --depth 1 https://github.com/ojroques/vim-oscyank</code>
*<code>/etc/ssh/sshd_config</code>
<pre>
Port 26
AddressFamily inet
ListenAddress x.x.x.x
PermitRootLogin no/prohibit-password
PasswordAuthentication no
KbdInteractiveAuthentication no
PrintMotd no
PrintLastLog no
UseDNS no
</pre>
*<code>/etc/ssh/ssh_config</code>
<pre>
Host *
AddressFamily inet
</pre>
*<code># pkg install bash bash-completion bash-completion-freebsd</code>
*<code># ln -s bash /usr/local/bin/sh</code>
*<code># passwd toor</code>
*<code># chsh -s /usr/local/bin/sh toor</code>
*<code>/usr/local/etc/profile</code>
<pre>
# vim:ft=sh

EDITOR=ee
if [ -x /usr/local/bin/vim ]; then
  EDITOR=vim
fi
export EDITOR
export VISUAL="${EDITOR}"
export PAGER=less
export LESS="I"
export HISTSIZE=1000
export HISTFILESIZE=2000
export HISTCONTROL=ignoreboth:erasedups

# set ENV to a file invoked each time sh is started for interactive use.
export ENV=/usr/local/etc/shrc
</pre>
*<code>/usr/local/etc/shrc</code>
<pre>
# vim:ft=sh

if [ "$EDITOR" = "vim" ]; then
  alias vi='vim'
fi
alias h='fc -l'
alias history='fc -l'
alias m="$PAGER"
alias ls='ls -FG'
alias ll='ls -Al'
alias mc='mc -u'
alias cal='LC_TIME=ru_RU.UTF-8 ncal'
alias man='LC_ALL=en_US.UTF-8 man'
alias nobackup='touch .nobackup; ls -l .nobackup'
alias myip='fetch -q4o - https://api.nic.ru/dyndns/checkip/ \
  | grep -o " [0-9\.]*<" | tr -d " <"'
alias myip2='fetch -q4o - http://whatismyip.akamai.com/; printf "\n"'
alias myip3='fetch -q4o - http://api.ipify.org; printf "\n"'
alias myip4='fetch -q4o - https://ping-admin.com/ip/ \
  | grep -o ">[0-9\.]*<" | tr -d "><"'
alias klzz-vnc='vncviewer -SecurityTypes=None -via b612 127.0.0.1:5900'
alias rss-vnc='vncviewer -SecurityTypes=None -via b612 127.0.0.1:5901'
if [ "$(id -u)" = 0 ]; then
  alias updatedb='/etc/periodic/weekly/310.locate'
fi

if [ -x /usr/local/bin/remind ]; then
  alias rem='rem -m'
fi

if test -t 0 > /dev/null 2>&1 ; then
  PS1="\u@\h:\w \\$ "
  if tty | fgrep -q pts && [ "$(ps -o comm= -p $$)" = "bash" ]; then
    PS1="\[\e]2;\u@\h:\w\a$(tput setaf 2)\]\u@\h:\w $\[$(tput sgr0)\] "
  fi
  stty -ixon   # disable XON/XOFF flow control (ctrl-s, ctrl-q)
fi

if [ "$(ps -o comm= -p $$)" = "bash" ]; then
  shopt -s checkwinsize histappend
  if [ -f /usr/local/share/bash-completion/bash_completion.sh ]; then
    . /usr/local/share/bash-completion/bash_completion.sh
  fi
  if [ -f /usr/local/bin/aws_completer ]; then
    complete -C '/usr/local/bin/aws_completer' aws
  fi
fi

mkcd() {
  if [ "$#" -eq 1 ]; then
    mkdir -p "$1"
    cd "$1"
  else
    echo "mkcd expects exactly one argument"
  fi
  find . -type d -prune ! -empty \
    -exec printf "%s\n" "Directory '$1' is not empty." \;
}

if [ -f "$HOME"/.shrc ]; then
  . "$HOME"/.shrc
fi
</pre>

* <code># rm /root/.profile</code>
*In <code>/etc/login.conf</code>
:*To <code>setenv</code>, add to the end
:::<code>LC_COLLATE=C.UTF-8,\</code>
:::<code>LC_MESSAGES=en_US.UTF-8,\</code>
:::<code>LC_MONETARY=en_US.UTF-8,\</code>
:::<code>LC_NUMERIC=en_US.UTF-8,\</code>
:::<code>LC_TIME=en_GB.UTF-8:\</code>
</pre>
:* substitute <code>:lang=C.UTF-8:</code> with <code>:lang=ru_RU.UTF-8:</code>
:* add <code>:hushlogin:</code>
:* change <code>path</code> if necessary
:* Add <code>~/sbin</code> to the beginning of the <code>path</code> and make other necessary changes
<pre>
:path=~/sbin /sbin /bin /usr/sbin /usr/bin /usr/local/sbin /usr/local/bin ~/bin:\
</pre>
:*<code># cap_mkdb /etc/login.conf</code>
*<code>/root/.config/bash_completion</code>
<pre>
# vim:ft=sh

### mkcd ###
_mkcd()
{
  local cur prev words cword split
  _init_completion -s || return
  $split && return 0
  _filedir -d
}
complete -F _mkcd mkcd
</pre>
<code># pkg install terminfo-db</code>

==System mail==

<code>/etc/dma/dma.conf</code>
<pre>
SMARTHOST smtp.yandex.ru
PORT 465
AUTHPATH /etc/dma/auth.conf
SECURETRANSFER
</pre>
*<code>/etc/dma/auth.conf</code>
<pre>
<ya-user>@yandex.ru|smtp.yandex.ru:<password>
</pre>
*<code>chgrp mail /etc/dma/auth.conf</code>
*<code>chmod 640 /etc/dma/auth.conf</code>
*<code>/etc/mail/aliases</code>
<pre>
*: alik@ejik.org
</pre>
*<code># sysrc dma_flushq_enable=yes</code>

==Network==
*<code>/etc/hosts.allow</code>
<pre>
sshd : ALL : allow
ALL : ALL : deny
</pre>
*<code># sysrc pf_enable=yes</code>
*<code>/etc/pf.conf</code>
<pre>
egress = "igc0"

set skip on lo0

match in all scrub (no-df random-id reassemble tcp)

antispoof quick for { lo0 $egress }

block all
pass out quick inet
pass in quick on $egress inet proto icmp from any to ($egress)
pass in quick on $egress inet proto tcp from any to ($egress) port ssh</pre>
*<code># service pf start</code>
*<code>tcp_bbr_load="YES"</code>
:*<code>/boot/loader.conf</code>
<pre>
# use the bbr tcp stack
net.inet.tcp.functions_default=bbr
</pre>

==Further configuration==

*<code># sysrc var_run_enable=yes</code>
*<code># pkg install smartmontools</code>
:*<code>/usr/local/etc/smartd.conf</code>
<pre>
/dev/ada...  -a -o on -S on -I 9 -I 190 -I 194 -m root -s (S/../.././04)
</pre>
For SSD, substitute <code>S</code> in parentheses with <code>L</code>. Attributes not tracked:
::<code>9&nbsp;&nbsp;&nbsp;power-on hours</code>
::<code>190&nbsp;temperature</code>
::<code>194&nbsp;also temperature</code>
:*<code># sysrc smartd_enable="YES"</code>
*<code># pkg install checkrestart</code>
*<code>/root/sbin/pkg</code>
<pre>
#!/bin/sh
/usr/local/sbin/pkg "$@"
[ -x /usr/local/bin/checkrestart ] && /usr/local/bin/checkrestart
</pre>
*<code># cp /etc/periodic/weekly/310.locate /usr/local/etc/periodic/daily/</code>
:*<code># sed -i -e 's/weekly_locate/daily_locate/' /usr/local/etc/periodic/daily/310.locate</code>
*<code>/etc/periodic.conf</code>
<pre>
# 310.locate
daily_locate_enable="YES"
weekly_locate_enable="NO"

daily_show_success="NO"
daily_show_info="NO"
weekly_show_success="NO"
weekly_show_info="NO"
monthly_show_success="NO"
monthly_show_info="NO"
daily_status_security_inline="YES"
security_show_success="NO"
security_show_info="NO"
security_status_baseaudit_enable="NO"
security_status_pkgaudit_enable="NO"
security_checkrestart_enable="YES"
security_checkrestart_period="DAILY"

daily_scrub_zfs_enable="YES"

>>> For ssd:
daily_trim_zfs_enable="YES"
</pre>
*<code># pkg install cpu-microcode-amd (or -intel)</code>
*<code>/boot/loader.conf</code>
<pre>
cpuctl_load="YES"
cpu_microcode_load="YES"
cpu_microcode_name="/boot/firmware/amd-ucode.bin" (or intel-)
</pre>
*<code># pkg install chrony</code>
*<code>/usr/local/etc/chrony.conf</code>
<pre>
server ntp1.vniiftri.ru iburst
server ntp2.vniiftri.ru iburst
server ntp3.vniiftri.ru iburst
server ntp4.vniiftri.ru iburst
server ntp5.vniiftri.ru iburst
server ntp.msk-ix.ru iburst

!pool 0.freebsd.pool.ntp.org iburst

>>>Uncomment:
makestep 1.0 3
dumpdir /var/db/chrony

>>>Add to the end:
# command port 323 disabled
cmdport 0
</pre>
:*<code># sysrc chronyd_enable=yes</code>
*<code># crontab -e</code>
<pre>
0 2 * * * /usr/sbin/freebsd-update cron
</pre>

==Setting up users accounts==

*<code>~/.config/bash_completion</code>
<pre>
# vim:ft=sh

### mkcd ###
_mkcd()
{
  local cur prev words cword split
  _init_completion -s || return
  $split && return 0
  _filedir -d
}
complete -F _mkcd mkcd

### toor ###
source /usr/local/share/bash-completion/completions/sudo
complete -F _comp_cmd_sudo toor
</pre>

[[Category: FreeBSD]]