Installing, Setting Up, and Maintaining OpenBSD

Written by Kevin Korb as a presentation for GOLUG Presented on 2006-11-02

What is OpenBSD?

OpenBSD is a UNIX like operating system based on BSD (as opposed to System V or POSIX). OpenBSD began as a fork from the NetBSD project. OpenBSD's primary goals are security, consistency, and freedom. The OpenBSD team is well known for finding and patching potential security holes BEFORE anyone figures out how to exploit them. The OpenBSD team is also well known for forking or even re-creating other projects when they become non-free (OpenSSH, ipf, OpenBGPd, OpenNTPd, and OpenCVS) so that even Linux users can have a free alternative.

Why would someone choose OpenBSD over some other OS?

• Security: OpenBSD is very well known for being secure. It is designed to be secure by default meaning when you first install OpenBSD it is already secure and no additional hardening should be required. In fact, if you get hacked while running OpenBSD it is almost certain that it is because you created the security hole. The OpenBSD team likes to brag that there has only been 1 remotely accessible security hole in the default install in more than 10 years! (That hole was in the somewhat new skey portion of OpenSSH.)
• Flexibility: OpenBSD's ports system is a very flexible form of package management. It not only tracks dependencies but often even allows you to change them. Note that the other *BSD systems also have ports and that Gentoo Linux has portage which is similar.
• pf: OpenBSD's Packet Filter is an excellent firewall system. It is much easier to learn than iptables under Linux and in some cases (tables) it is more powerful.
• Openness: The OpenBSD team (especially Theo) tend to be very fanatical about openness. They are known for simply throwing away and rewriting programs that they decide aren't open enough (ipf, daemontools, etc) or forking and maintaining others (Apache, ssh, etc).
• Consistency: The OpenBSD ports system was designed to make sure that every package is installed in a consistent way (in /usr/local). It is sort of a best of both worlds between binary package management and build it from source yourself. In fact you can use either of those methods without leaving the ports system.
• Documentation: The OpenBSD project has excellent documentation on their web site. In fact their documentation is so good that I have used it to figure out how to do some things in Linux.
• Spamd: This is a very nice grey listing and tar pitting anti-spam program included with OpenBSD.
• Support for non-x86 hardware: OpenBSD is by far the best OS choice for running on older Sun hardware (sun4c or sun4m). It is more stable than Linux and it performs better than Sun's own Solaris.

Why would someone choose some other OS over OpenBSD?

• Lack of apps: There are lots of things in ports however OpenBSD was mainly created to be a server OS. You can definitely use it as a desktop (I used it that way the entire time I worked at Harris) but it just doesn't have the sheer number of applications as Linux or FreeBSD.
• Slow filesystem: The ffs filesystem used by OpenBSD isn't the fastest around. In FreeBSD the same filesystem performs about as well as ext3 does in Linux however OpenBSD adds some additional security features (like secure deletes) that make it somewhat slower. This means it isn't the best OS to use for large scale file storage.
• Lack of hardware support: OpenBSD has a shorter list of supported hardware than Linux. However, this doesn't always mean that Linux has better hardware support (USB support existed in *BSD for at least a year before Linux). In general hardware that is well supported in Linux will also be supported in OpenBSD but hardware that is only slightly supported in Linux probably will not be supported by OpenBSD. OpenBSD also lacks support for most hardware devices that require binary BLOB drivers. The OpenBSD team is very much against such drivers and in most cases simply refuses to include them.

Differences from Linux

• OpenBSD's boot up scripts and configuration files are mostly very different.
• A Linux distro is the Linux kernel combined with a large collection of other programs (GNU and others). OpenBSD OTOH is a complete system. It is all maintained by the OpenBSD team. There is some GNU stuff installed by default (mainly gcc and related programs) but almost everything else is maintained by OpenBSD. This generally creates a tighter integration of programs as well as greater consistency and stability.
• OpenBSD releases are done every 6 months. The OpenBSD team sells CD sets (as well as other swag) to help fund the project. It can of course be downloaded for free however the CD sets begin shipping out to pre-order customers about a month before the official release. The OpenBSD CDs also come with an audio track that is different for every release.
• OpenBSD is released with strong cryptography included. It is released and packaged in Canada which helps them avoid some legal issues dealing with encryption.
• The OpenBSD kernel is /bsd instead of vmlinuz or bzImage and there is no /boot partition.
• IDE hard drives are /dev/wd?? and IDE CDROM drives are /dev/cd?? instead of /dev/hd??.
• OpenBSD uses a 2-layered disk partitioning system. This is because BSD has its own disklabel system that is very different from a PC partition table.
• OpenBSD does NOT use a journaling filesystem. This means that an fsck will be required after a hard crash.
• OpenBSD uses the pf (Packet Filter) firewall/NAT system instead of iptables.
• OpenBSD uses driver specific names for network interfaces instead of the generic eth??. For instance tulip based NICs will be de?? or dc?? depending on the chip version, Intel e100 NICs will be fxp??, 3Com 3c905 NICs will be xl??, and RealTek NICs will be rl??.
• OpenBSD uses ksh (pdksh) as the default shell for root (as opposed to bash in Linux). Bash is not included but can be installed through ports. It is recommended that you try ksh before installing bash because they are very comparable. Or you can always switch to tcsh (also in ports) like I do.
• The /etc/passwd file should NOT be edited directly in OpenBSD. Use the vipw or chpass commands instead.
• Compiling a custom kernel is NOT encouraged in OpenBSD as it is in Linux. The developers simply do not test the kernel with parts of it ripped out and will not support you if you do so without a really good reason. This of course doesn't apply to kernel update patches. If you need to remove a driver from the kernel it can usually be done through the boot -c interface instead of a custom kernel recompile.
• OpenBSD uses wsmoused for mouse support on the console instead of gpm. Configure it in /etc/rc.conf.
• OpenBSD uses CTRL+ALT+Fn to change between text consoles instead of just ALT+Fn as in Linux.
• OpenBSD uses the BSD license instead of the GPL license that Linux uses. The BSD license is actually more free than GPL. GPL requires that any derivative works must also be released under the GPL license while the BSD license has no such requirement.

Command line differences from Linux

Linux Command	OpenBSD Command	Notes
route	netstat -r	It is often wise to add -n. That turns off reverse DNS lookups which often don't work when you are playing with routes. (route show also works).
ifconfig	ifconfig -a
ps fxa	pstree	must install it from /usr/ports/sysutils/pstree
killall	pkill
adduser ...	adduser	Run it without parameters for interactive mode instead of specifying everything on the command line.

Disk partitioning/slicing

OpenBSD uses a 2-layered partitioning system...

The first layer is the standard PC partition table. This is of course required for compatibility with the PC BIOS. This partition table is created using the fdisk command which is similar to the one provided by Linux. Normally only one partition (type A6) is made per disk. During the install one of the first questions asked is if you whish to use the whole disk for OpenBSD. If you answer yes the installer will wipe out the existing partition table and replace it with a single OpenBSD partition allowing you to skip this step completely. This step is also skipped on hardware platforms that already use the BSD disklabel such as SPARC systems.

The second layer is the BSD disklabel. The disklabel allows you to make up to 15 logical partitions (often called slices) within the PC partition. These are what you will format and mount. They use letters (a-p) instead of numbers (the disks themselves are numbered). It is customary that slice a is the root filesystem and slice b is the swap partition. Slice c is a special slice that spans the entire disk and should not be changed (this is the one you use if you want to access the entire disk). Other common filesystems to make slices for are /usr, /var, /home, and sometimes /usr/local. The standard filesystem in OpenBSD is "4.2BSD", also known as ffs, which will be the default choice when making any slice other than b. Note that even if you want to use the entire disk for a single filesystem you should NOT simply format and mount the c slice. You should create another slice that covers the entire disk.

Important configuration files

• /etc/[daily|weekly|monthly]: Jobs that are run regularly by cron. Similar to /etc/cron.[daily|weekly|monthly]/ in Linux except these are scripts instead of directories full of scripts.
• /etc/rc.conf: This is OpenBSD's equivalent of /etc/init.d/* in System V. Instead of creating and deleting symlinks in different runlevels you just edit this text file to enable/disable services on startup.
• /etc/hostname.*: These are the files that assign an IP address to a network interface. The extension of the filename is the name of the interface that the file describes. The format of the file is: inet [IP] [NETMASK] [media params (usually NONE)].
• /etc/login.conf: Controls various login authentication settings. Also sets the shell limitations for different classes of users. If you are setting up a desktop system you will probably have to loosen these restrictions.
• /etc/mygate: IP address of the default gateway.
• /etc/myname: Host name of the system.
• /etc/pf.conf: Config file for the pf firewall.
• /etc/rc.local: Shell script for you to add additional services to.
• /etc/ttys: Configuration for login gettys. Kind of like /etc/inittab in Linux though only used for gettys here. Also defines which gettys allow root to login directly.

Suggested initial setup tips

• Mount options: You should edit /etc/fstab and add softdep and noatime to the mount options on all ffs filesystems. This will significantly increase performance.
• /tmp: It is also possible to mount /tmp as a RAM disk (like tmpfs in Linux). Here is my suggested /etc/fstab line that will provide a 256MB /tmp (the device is the swap partition):
  /dev/wd0b /tmp mfs rw,nosuid,nodev,noexec,-s=524288 0 0
• Root's email: There is an email that is left in root's mailbox by default. It has some useful information in it. Note that you can simply read /var/mail/root if you don't want to install an email client.
• afterboot: You should also run 'man afterboot'. This has additional useful information in it.
• Source and ports: You will probably want to go ahead and install the /usr/src and /usr/ports trees while you have the CDs handy. Here are the steps...
1. mkdir /cdrom
2. mount -v -t cd9660 /dev/cd0c /cdrom
3. cd /usr/src
4. tar -xvzf /cdrom/src.tar.gz
5. cd /usr
6. tar -xvzf /cdrom/ports.tar.gz
7. (optional) cd /usr/src
8. (optional) tar -xvzf /cdrom/XF4.tar.gz

Using ports and packages

Before you can start using the ports system you must unpack the ports.tar.gz tarball from the last CD into /usr/ports.

Some ports have "flavors" which are simply alternate ways of installing a program. The most common flavor is no_x11 which means to not compile the program with support for X or any GUIs.

Here are the steps to compile and install a program from the ports tree:

1. cd /usr/ports/[category]/[program name]
2. grep FLAVOR Makefile (to see if there are different "flavors" of that program to choose from)
3. make install clean
   OR if you want to install a different flavor do:
   FLAVOR=[flavor name] make install clean

When you run these commands ports will go download the source, recurse into any dependencies required by the program you are installing, patch the source if needed, configure the source, compile the source, assemble a binary package, and install the binary package (under /usr/local).

It is also possible to take those binary packages (in /usr/ports/packages) and install them on other OpenBSD systems without the need to compile the same code on every box. To install a binary package directly just use the pkg_add command.

It is also possible to download those binary packages from the OpenBSD site if you do not feel the need to compile them yourself. In fact the pkg_add command can even be given a URL to the package file instead of a local file.

The ports tree is maintained through CVS. You should occasionally use CVS to update your ports tree and the /usr/ports/infrastructure/build/out-of-date command to determine which of your installed ports needs to be upgraded to a newer version. I have written a shell script to automate this process. It is available at http://www.sanitarium.net/unix_stuff/wn.txt

If you don't know exactly what you are looking for in ports it is possible to search the entire tree with the make search command (run it in /usr/ports).

It is also possible to create your own ports of programs that aren't already in the ports system. There is documentation on the OpenBSD web site on how to do this.

Suggested ports/packages to install

• bzip2: The bzip2 compression program
• calc: A nice (but not RPN) command line calculator
• fileutils: GNU versions of common file management utilities including ls with color
• findutils: finds and then operates on files
• ggrep: GNU versions of grep pattern matching utilities (with color support)
• gmake: GNU make. Not all Makefiles are compatible with OpenBSD's make.
• gtar: GNU version of the traditional tar archiver. OpenBSD's tar doesn't support bzip2.
• id-utils: gid/lid tools for looking up variables in code
• ifstat: tool to monitor interface bandwidth usage
• lsof: list information about open files
• mtr: Matt's traceroute - network diagnostic tool. Can be installed with or without GTK GUI.
• pfstat: packet filter statistics visualization
• pftop: curses-based real time state and rule display for pf
• pstree: list processes as a tree (kind of like ps fxa in Linux)
• rsync: mirroring/synchronization over low bandwidth links
• screen: multi-screen window manager
• sh-utils: GNU command line utilities
• smartmontools: control and monitor storage systems using SMART
• textutils: GNU text utilities
• unzip: Extract files from ZIP archives
• vim: vi clone, many additional features (OpenBSD's vi is very pure which means it isn't as powerful)

Note: If you want the GNU tools to take precedence over the OpenBSD versions you will want to put /usr/local/bin at the beginning of your path and make symlinks to the standard filename. I have written a shell script to automate this process and made it available at http://www.sanitarium.net/unix_stuff/make_gnu_symlinks.csh.txt

Installing official OpenBSD patches

OpenBSD patches are published at http://www.openbsd.org/errata.html. They are simple text patches. You must install the source code tarball from the last CD (src.tar.gz) into /usr/src before you can use them.

When you download one of these patches the installation procedure will be:

cd /usr/src
patch -p0 < /path/to/patchfile

The patch comments will then tell you how to compile and install the patch. Note that if you are installing an older version of OpenBSD there may be more than one patch available that requires a kernel recompile. If this is the case you can install all of the patches and only recompile once.

Compiling a kernel

1. cd /usr/src/sys/conf
2. cp GENERIC [name of your kernel]
3. edit [name of your kernel] if needed
4. cd /usr/src/sys/arch/i386/conf
5. cp GENERIC [name of your kernel]
6. edit [name of your kernel]
Note: Be sure to change the include line to include the other file you modified instead of GENERIC.
7. config [name of your kernel]
8. cd ../compile/[name of your kernel]
9. make clean
10. make depend
11. make
12. cp bsd /bsd.[name of your kernel]
13. cd /
14. mv bsd bsd.GENERIC
15. ln bsd.[name of your kernel] bsd
16. reboot

I have also written a shell script that automates steps 9-12 (it also makes Linux kernels). It is published here: http://www.sanitarium.net/unix_stuff/buildkernel.txt.

Making a disk bootable

If you need to make a disk bootable manually (usually only needed during disaster recovery) here is the procedure:
• cd /usr/mdec
• cp boot /
• ./installboot /boot biosboot /dev/r?d?c
  
  example for a SCSI disk:
  ./installboot /boot biosboot /dev/rsd0c
  example for an IDE disk:
  ./installboot /boot biosboot /dev/rwd0c

Helpful web sites about OpenBSD

• http://www.openbsd.org/ The OpenBSD web site.
• http://experimental.bug.it/ A collection of ports that are not in the main OpenBSD ports tree (many for license reasons). Unpack in /usr/ports/experimental.
• http://www.cheapbytes.com/ A cheaper source for CDs containing OpenBSD. They aren't as nice and they take longer to get but they are cheaper.

Installing OpenBSD

The OpenBSD install program is very basic and completely text based. This may look ugly but it is very efficient. Once you know how to do it you can do a full install of OpenBSD in only a few minutes. In fact here is a video of someone both installing and configuring an OpenBSD system in less than 5 minutes: http://www.youtube.com/watch?v=N0cPFRdT7mQ

OpenBSD can be installed via CD, NFS, FTP, or HTTP. In fact you can download and write a single floppy disk from the OpenBSD site then download the rest during the actual install.

Here is a capture of me installing OpenBSD 3.6 on an old SPARCStation 5 system:

SPARCstation 5, No Keyboard
ROM Rev. 2.15, 32 MB memory installed, Serial #7474505.
Ethernet address 8:0:20:72:d:49, Host ID: 80720d49.

Type  help  for more information
ok boot cdrom 3.6/sparc/bsd.rd
Boot device: iommu/sbus/espdma@5,8400000/esp@5,8800000/sd@6,0:d  File and args 
>> OpenBSD BOOT 2.2
Booting 3.6sparc/bsd.rd @ 0x4000
3406660...
console is ttya
Copyright (c) 1982, 1986, 1989, 1991, 1993
The Regents of the University of California.  All rights reserved.
Copyright (c) 1995-2004 OpenBSD. All rights reserved.  http:/www.OpenBSD.org

OpenBSD 3.6 (RAMDISK) #104: Fri Sep 17 16:07:51 MDT 2004
    deraadt@sparc.openbsd.org:usr/src/sys/arch/sparc/compile/RAMDISK
...[lots of dmesg type stuff]...
(I)nstall, (U)pgrade or (S)hell? i

Welcome to the OpenBSDsparc 3.6 install program.

...

Terminal type? [sun] vt102

IS YOUR DATA BACKED UP? As with anything that modifies disk contents, this
program can cause SIGNIFICANT data loss.

Proceed with install? [no] yes
Cool!  Let's get to it...

You will now initialize the disk(s) that OpenBSD will use. To enable all
available security features you should configure the disk(s) to allow the
creation of separate filesystems for , /tmp, /var, /usr, and /home.

Available disks are: sd0.
Which one is the root disk? (or 'done') [sd0] sd0
This platform requires that partition offsetssizes be on cylinder boundaries.
Partition offsetssizes will be rounded to the nearest cylinder automatically.

Initial label editor (enter '?' for help at any prompt)
> p
device: dev/rsd0c
...
16 partitions:
#        size   offset    fstype   [fsize bsize   cpg]
  c: 35867280        0    unused        0     0       
> a a
offset: [0] 
size: [35867280] 64m
Rounding to nearest cylinder: 132312
FS type: [4.2BSD] 
mount point: [none] /
> p
...
16 partitions:
#        size   offset    fstype   [fsize bsize   cpg]
  a:   132312        0    4.2BSD     1024  8192    16  # 
  c: 35867280        0    unused        0     0       
> a b
offset: [132312] 
size: [35734968] 2048m
Rounding to nearest cylinder: 4194648
FS type: [swap] 
> a d
offset: [4326960] 
size: [31540320] 2048m
Rounding to nearest cylinder: 4194648
FS type: [4.2BSD] 
mount point: [none] /var
> a e
offset: [8521608] 
size: [27345672] 
FS type: [4.2BSD] 
mount point: [none] /usr
> p
...

16 partitions:
#        size   offset    fstype   [fsize bsize   cpg]
  a:   132312        0    4.2BSD     1024  8192    16  # 
  b:  4194648   132312      swap                      
  c: 35867280        0    unused        0     0       
  d:  4194648  4326960    4.2BSD     2048 16384    16  # var
  e: 27345672  8521608    4.2BSD     2048 16384    16  # usr
> w
> q
No label changes.
Mount point for sd0d (size=2097324k)? (or 'none' or 'done') [var] 
Mount point for sd0e (size=13672836k)? (or 'none' or 'done') [usr] 
Mount point for sd0d (size=2097324k)? (or 'none' or 'done') [var] done
No more disks to initialize.

OpenBSD filesystems:
sd0a 
sd0d var
sd0e usr

The next step *DESTROYS* all existing data on these partitions!
Are you really sure that you're ready to proceed? [no] yes
dev/rsd0a:     132312 sectors in 37 cylinders of 12 tracks, 298 sectors
        64.6MB in 1 cyl groups (40 cg, 69.84MB/g, 8832 i/g)
dev/rsd0d:     4194648 sectors in 4692 cylinders of 3 tracks, 298 sectors
        2048.2MB in 14 cyl groups (352 cg, 153.66MB/g, 19712 i/g)
dev/rsd0e:     27345672 sectors in 30588 cylinders of 3 tracks, 298 sectors
        13352.4MB in 87 cyl groups (352 cg, 153.66MB/g, 19712 i/g)
dev/sd0a on /mnt type ffs (rw, asynchronous, local, ctime=Tue Nov  2 20:26:17 
dev/sd0e on /mnt/usr type ffs (rw, asynchronous, local, nodev, ctime=Tue Nov  
dev/sd0d on /mnt/var type ffs (rw, asynchronous, local, nodev, nosuid, ctime=T

System hostname? (short form, e.g. 'foo') rvsn2
Configure the network? [yes] 
Available interfaces are: le0.
Which one do you wish to initialize? (or 'done') [le0] 
Symbolic (host) name for le0? [rvsn2] 
The media options for le0 are currently
        media: Ethernet autoselect (10baseT)
Do you want to change the media options? [no] 
IPv4 address for le0? (or 'none' or 'dhcp') 192.168.100.3
Netmask? [255.255.255.0] 
No more interfaces to initialize.
DNS domain name? (e.g. 'bar.com') [my.domain] sanitarium.net
DNS nameserver? (IP address or 'none') [none] 192.168.100.202
Use the nameserver now? [yes] 
Default IPv4 route? (IPv4 address, 'dhcp' or 'none') 192.168.100.1
add net default: gateway 192.168.100.1
Edit hosts with ed? [no] 
Do you want to do any manual network configuration? [no] 
Password for root account? (will not echo) 
Password for root account? (again) 

You will now specify the location and names of the install sets you want to
load. You will be able to repeat this step until all of your sets have been
successfully loaded. If you are not sure what sets to install, refer to the
installation notes for details on the contents of each.

Sets can be located on a (m)ounted filesystem; a (c)drom, (d)isk or (t)ape
device; or a (f)tp, (n)fs or (h)ttp server.
Where are the install sets? (or 'done') c
Available CD-ROMs are: cd0.
Which one contains the install media? (or 'done') [cd0] 

Pathname to the sets? (or 'done') [3.6/sparc] 

The following sets are available. Enter a filename, 'all' to select
all the sets, or 'done'. You may de-select a set by prepending a '-'
to its name.

        [X] bsd
        [X] bsd.rd
        [X] base36.tgz
        [X] etc36.tgz
        [X] misc36.tgz
        [X] comp36.tgz
        [X] man36.tgz
        [X] game36.tgz
        [ ] xbase36.tgz
        [ ] xetc36.tgz
        [ ] xshare36.tgz
        [ ] xfont36.tgz
        [ ] xserv36.tgz

File name? (or 'done') [xbase36.tgz] *
...
File name? (or 'done') [done] -bsd.*

The following sets are available. Enter a filename, 'all' to select
all the sets, or 'done'. You may de-select a set by prepending a '-'
to its name.

        [X] bsd
        [ ] bsd.rd
        [X] base36.tgz
        [X] etc36.tgz
        [X] misc36.tgz
        [X] comp36.tgz
        [X] man36.tgz
        [X] game36.tgz
        [X] xbase36.tgz
        [X] xetc36.tgz
        [X] xshare36.tgz
        [X] xfont36.tgz
        [X] xserv36.tgz

File name? (or 'done') [bsd.rd] done
Ready to install sets? [yes] 
Installing...

Sets can be located on a (m)ounted filesystem; a (c)drom, (d)isk or (t)ape
device; or a (f)tp, (n)fs or (h)ttp server.
Where are the install sets? (or 'done') done
Start sshd(8) by default? [yes] yes
Saving configuration files...done.
Generating initial host.random file...done.
What timezone are you in? ('?' for list) [CanadaMountain] EST5EDT
Setting local timezone to 'EST5EDT'...done.
Making all device nodes...done.
Installing boot block...
boot: mnt/boot
proto: mnt/usr/mdec/bootxx
device: dev/rsd0c
architecture: sun4c
mnt/usr/mdec/bootxx: entry point 0x340000
mnt/usr/mdec/bootxx: a.out header left on
proto bootblock size 7680
room for 256 filesystem blocks at 0x3417b8
mnt/boot: block numbers: 53472 53504 53536 9308 

CONGRATULATIONS! Your OpenBSD install has been successfully completed!
To boot the new system, enter halt at the command prompt. Once the
system has halted, reset the machine and boot from the disk.
# reboot
syncing disks... done
rebooting

Resetting ... 

SPARCstation 5, No Keyboard
ROM Rev. 2.15, 32 MB memory installed, Serial #7474505.
Ethernet address 8:0:20:72:d:49, Host ID: 80720d49.

Boot device: iommu/sbus/espdma@5,8400000/esp@5,8800000/sd@3,0  File and args: 
>> OpenBSD BOOT 2.2
Booting bsd @ 0x4000
...
Copyright (c) 1982, 1986, 1989, 1991, 1993
The Regents of the University of California.  All rights reserved.
Copyright (c) 1995-2004 OpenBSD. All rights reserved.  http:/www.OpenBSD.org

OpenBSD 3.6 (GENERIC) #203: Fri Sep 17 15:18:56 MDT 2004
    deraadt@sparc.openbsd.org:usr/src/sys/arch/sparc/compile/GENERIC
...[lots of dmesg type stuff]...
OpenBSDsparc (rvsn2.sanitarium.net) (console)

login: root
Password:
Nov  2 15:51:57 rvsn2 login: ROOT LOGIN (root) ON console
OpenBSD 3.6 (GENERIC) #203: Fri Sep 17 15:18:56 MDT 2004

Welcome to OpenBSD: The proactively secure Unix-like operating system.

Terminal type? [sun] vt102
Don't login as root, use su
Read the afterboot(8) man page for administration advice.

rvsn2#