NetBSD: After First Boot

Fri, 04 Sep 2026 00:00:00 +0000

After the first boot of my NetBSD installation</a>, these are some extra steps I like to make right away to get a system off to a good start!

Package management</a></li>
Run commands as root</a></li>
Use a different console font</a></li>
Alias for root mail</a></li>
Check for vulnerable packages</a></li>
Create SSH keys</a></li>
Custom login</a></li>
Custom prompt</a></li>
Accelerate keyboard repeat speed</a></li>
Adjust console brightness</a></li>
Microcode updates</a></li>
Clear console at logout</a></li> </ul>

Package management</h2>
Package management is one area where the differences between the Linux philosophy and the BSD philosophy about how to build a system becomes apparent.
Linux is an operating system kernel. Developers take this kernel and combine it with various independent software projects in a collection of packages that is released as a Linux distribution (Ubuntu, Debian</a>, Fedora, etc.).
In contrast, each of the BSDs develop their own kernel and combine it with system components that are developed together “in-house” and released as a whole. The idea being that this approach leads to a more robust and tightly integrated core operating system. Third-party “userland” packages not included in the core may still be installed at the discretion of the user.
Source code and binary packages are provided by pkgsrc(7)</a>, the NetBSD packages collection, which can be viewed online</a> sorted alphabetically. Install binary packages directly from remote package repositories using pkgin</code>, a user-friendly frontend to the pkg_*</code> tools.
Switch to root if not already logged in as such:
su -</code></pre> Set PKG_PATH</code>:
PKG_PATH="http://cdn.NetBSD.org/pub/pkgsrc/packages/NetBSD/$(uname -p)/$(uname -r|cut -f '1 2' -d.)/All/" export PKG_PATH</code></pre> Install:
pkg_add pkgin pkg_add -v mozilla-rootcerts-openssl</code></pre> To keep packages up-to-date, compare installed packages to the versions available in repositories and generate a list of packages due for an upgrade by running the command:
pkgin update</code></pre> To add a package:pkgin install [package]</code></pre> One of the first packages I like to install on any BSD or Linux system is sl(1)</code>: pkgin install sl</code></pre> More: NetBSD Guide: Installing additional software</a> Run commands as root</h2> I created a user account (example: foo</code>) during installation and added myself to the wheel</code> group. Install doas</code> to run root-level access commands, and allow members of wheel</code> to do so by default, by creating doas.conf</code>: pkgin install doas echo "permit :wheel" > /usr/pkg/etc/doas.conf</code></pre> To allow user foo</code> to run commands as root without asking for a password: echo "permit nopass keepenv foo" >> /usr/pkg/etc/doas.conf</code></pre> Log out as root</code>, log back in as your user, and use doas</code> to run any commands that require root privileges. Use a different console font</h2> The base system includes a selection of console fonts in /usr/share/wscons/fonts</code>. I like the Terminus</code> font. Open the wscons.conf</code> file for editing: doas vi /etc/wscons.conf</code></pre> Uncomment the desired TerminusXX</code> font size, and set the font for use in the console: font Terminus32-ISO8859-1 - - - /usr/share/wscons/fonts/ter-132n.wsf . . . setvar ttyE0 font Terminus32-ISO8859-1 setvar ttyE1 font Terminus32-ISO8859-1 setvar ttyE2 font Terminus32-ISO8859-1 setvar ttyE3 font Terminus32-ISO8859-1</code></pre> Save changes and exit. Restart: doas service wscons restart</code></pre> More: NetBSD Guide: Console drivers</a> Alias for root mail</h2> Rather than login to root to collect system mail, I forward the root user’s mail to my non-root user’s inbox. Open the aliases</code> file for editing: doas vi /etc/mail/aliases</code></pre> Modify: # root: # operator:</code></pre> … uncomment the lines and add my username (example: foo</code>): root: foo operator: foo</code></pre> Save changes and exit. Let the MTA know about the modification by running the newaliases(1)</code> command with no arguments: doas newaliases</code></pre> Test whether mail is indeed being forwarded by using the mail(1)</code> command as my user to send root a message: $ mail root Subject: Test new aliases Is it working?</code></pre> Press CTRL-d</code> to exit and send message. $ mail Mail version 9.1alpha 2009-02-25. Type ? for help. "/var/mail/foo": 1 message 1 new >N 1 foo@bsdbox.home.arp Wed Sep 2 11:51 3/456 "Test new aliases"</code></pre>Check for vulnerable packages</h2> Set the system to automatically run a daily update of its local database of known vulnerable packages, check if any of these packages are installed, and inform the user if so: echo "fetch_pkg_vulnerabilities=YES" | doas tee -a /etc/daily.conf</code></pre> By default this job will run in the early morning hours. For a machine that is typically powered off at night, I modify the time that /etc/daily</code> is executed to the middle of the day. Run: doas crontab -e</code></pre> Modify: # do daily/weekly/monthly maintenance 15 12 * * * /bin/sh /etc/daily 2>&1 | tee /var/log/daily.out | sendmail -t 30 12 * * 6 /bin/sh /etc/weekly 2>&1 | tee /var/log/weekly.out | sendmail -t</code></pre> Save changes and exit. More: afterboot(8)</a> Create SSH Keys</h2> Create an SSH public/private key pair to facilitate passwordless logins to remote servers and (optional) configure remote access to the localhost. Read More</a> Custom login</h2> After entering a username and password, the NetBSD default login generates multiple lines of output, some of it more useful (Last login</code>) than others (copyright dates). Read More</a> Custom prompt</h2> I set my user prompt to display the hostname</code> and current working directory. For the sh</code> shell, open .shrc</code>: vi ~/.shrc</code></pre> Add: # Enable command execution in prompt strings set -o promptcmds get_pwd() { case "$PWD" in "$HOME") echo "~" ;; "$HOME"/*) echo "~${PWD#$HOME}" ;; *) echo "$PWD" ;; esac } PS1='$(hostname -s):$(get_pwd)\$ '</code></pre> Save changes and exit. Reload the config: . ~/.shrc</code></pre>Accelerate keyboard repeat speed</h2> The speed at which a key press is repeated can be accelerated by modifying wscons.conf</code>: doas vi /etc/wscons.conf</code></pre> Adjust these two variable: repeat.del1</code>, which specifies the delay (in milliseconds) before character repetition starts, and repeat.deln</code>, which sets the delay between each character repetition once started. Example: # Change keyboard repeat speed to faster settings. setvar wskbd repeat.del1 300 setvar wskbd repeat.deln 20</code></pre> Save changes and exit. Restart to activate: doas service wscons restart</code></pre>Adjust console brightness</h2> All my laptops have integrated Intel graphics, and to adjust the console brightness I use intel-backlight</code>. Install: doas pkgin install intel-backlight</code></pre> Display current brightness: $ intel_backlight Current backlight value: 33% (505/1515)</code></pre> Set brightness to 100%: $ intel_backlight 100 Current backlight value: 100% (1515/1515)</code></pre> This only lasts for the current session. To auto-enable at boot, modify rc.local</code>: doas vi /etc/rc.local</code></pre> Add: # set screen brightness to 100% on boot if [ -x /usr/pkg/sbin/intel_backlight ]; then /usr/pkg/sbin/intel_backlight 100 fi</code></pre> Save changes and exit. Microcode updates</h2> For devices with Intel CPUs, install: doas pkgin install intel-microcode-netbsd</code></pre> To use intel-microcode-netbsd-<DATE></code> to update your system’s microcode, verify that hw.firmware.path</code> includes your pkgsrc prefix: $ /sbin/sysctl hw.firmware.path hw.firmware.path = /libdata/firmware:/usr/libdata/firmware:/usr/pkg/libdata/firmware:/usr/pkg/libdata</code></pre> Copy the sample rc.d</code> file to apply updates during the boot process to /etc/rc.d</code>: doas cp /usr/pkg/share/examples/rc.d/intel-microcode /etc/rc.d/</code></pre> To ensure the configurations are correct without rebooting, manually trigger the initialization script: doas /etc/rc.d/intel-microcode start</code></pre> If it silently exist, the config is OK. Add microcode=YES</code> to my /etc/rc.conf</code> and reboot. Verify: $ cpuctl identify 0 | grep -i microcode cpu0: microcode version 0xf6, platform ID 7</code></pre>Clear console at logout</h2> For the default sh</code> shell, I create the .exitrc</code> file: echo "type clear >/dev/null 2>&1 && clear" > ~/.exitrc</code></pre> Modify .shrc</code>: vi ~/.shrc</code></pre> Add: case "$-" in *i*) # interactive mode settings go here . . . # Clear terminal at logout test -f $HOME/.exitrc && trap ". $HOME/.exitrc" EXIT esac</code></pre> Save changes and exit. More: How to clear terminal after logging out?</a> You can like, share, or comment on this post on the Fediverse</a> 💬

NetBSD 11.0 Installation with Disk Encryption

Sat, 22 Aug 2026 00:00:00 +0000

The first time I installed NetBSD</a> I used sysinst(8)</a>, a menu-based program launched at boot that runs in the console. It has a clear and concise layout and I was quickly up-and-running on my new BSD</a> system.

For my next install I wanted to include disk encryption to protect personal data in case the device is lost or stolen. Its not really enough to simply encrypt home directories. Passphrases and sensitive data can linger and be extracted from locations such as system logs and swap memory. There is a trade-off to be made between how much to encrypt, the convenience of operating the system, and the ability for the system to boot.

Start Here</a>

Acquire an installation image</a></li>
Prepare the USB installation medium</a></li> </ul> </li>
Configure the Live Environment</a>

Connect to the internet</a></li>
Remote login to the installer</a></li> </ul> </li>
Prepare the DISK</a>

Identify disks and partitions</a></li>
Define DISK variable</a></li>
Wipe DISK</a></li>
Partition DISK</a></li>
Define wedge variables</a></li>
Format and mount the ESP wedge</a></li>
Add EFI boot entries to ESP</a></li>
Format and mount the root wedge</a></li> </ul> </li>
Disk Encryption</a>

Create encrypted device</a></li>
Create disklabels</a></li>
Verify encrypted device</a></li>
Format and mount disklabels</a></li> </ul> </li>
Installation</a></li>
Configure the System</a>

Chroot</a></li>
Directories</a></li>
Devices</a></li>
Root password</a></li>
Superuser</a></li>
Fstab</a></li>
Startup</a></li>
Keyboard</a></li>
Timezone</a></li>
Network interface</a></li>
Terminals</a></li> </ul> </li>
Finish Up</a></li>
Resources</a></li> </ul>

Start Here</h2>
Throughout this HOWTO, if you see square brackets []</code> in code blocks, that means the word of code (square brackets included) should be replaced with something else. This is detailed in the instructions before or after the code block.
NetBSD will be installed as the sole operating system on a single disk using a four-partition layout:
Partition ESP</code> is the EFI system partition.</li> Partition root</code> hosts a minimal root filesystem that boots to an encryption passphrase prompt, which upon entry unlocks…</li> … the encrypted device on partition syscgd</code> containing the contents of var</code>, usr</code>, and home</code>.</li>
Partition swap</code> is swap memory auto-encrypted at boot using a random key.</li> </ul> A few assumptions:Target device is amd64</code> architecture using UEFI to boot.</li> Secure boot is disabled on target device.</li> Network access during install uses a wired interface.</li> </ul> Sysinst does not provide the option for encrypting the system in this manner, so early in the install process I switch to the console and proceed to manually install NetBSD. Acquire an installation image</h3> The latest official installation images (as of August 2026) are available here: Images and torrents</a> Download the NetBSD-11.0-amd64-install.img.gz</code> image and the SHA512</code> file for verification: wget https://cdn.netbsd.org/pub/NetBSD/images/11.0/NetBSD-11.0-amd64-install.img.gz wget https://cdn.netbsd.org/pub/NetBSD/images/11.0/SHA512</code></pre> Verify the image using sha512sum</code>: sha512sum -c --ignore-missing SHA512 </code></pre> Decompress the image: gunzip NetBSD-11.0-amd64-install.img.gz</code></pre>Prepare the USB installation medium</h3> Write the installer to an unmounted USB storage device running the dd(1)</a> command as root</code>. WARNING Be very careful to note the proper device (which can be identified with lsblk</code>). All contents on the device will be lost! Example: On a Linux system, if a USB stick appears as sdx1</code>, then write the installer to sdx</code> (omit partition number): dd bs=4M conv=fsync oflag=direct status=progress if=NetBSD-11.0-amd64-install.img of=/dev/sdx</code></pre>Configure the Live Environment</h2> Boot the target device from the NetBSD installation medium. Select Option 1</code> (default) to Install NetBSD</code>. After the installer has successfully booted into the NetBSD kernel, a prompt appears to select which language will be used for installation messages, followed by a prompt to select a different keyboard type if desired or leave unchanged. Next up the menu-based sysinst program is launched: NetBSD-11.0 Install System >a: Install NetBSD to hard disk b: Upgrade NetBSD on a hard disk c: Re-install sets or install additional sets d: Reboot the computer e: Utility menu f: Config menu x: Exit Install System</code></pre>Connect to the internet</h3> At the Install System</code> main menu, select >e: Utility menu</code> then >c: Configure network</code>. Available interfaces</code> lists the network interfaces detected by the NetBSD installer. Example: With my target device Available interfaces</code> lists two: wm0</code> (wired) and iwn0</code> (wireless). I choose to configure the wired ethernet interface: Network media (empty to autoconfigure) [autoselect]: <enter> Perform autoconfiguration? >a: Yes Your host name: foobox Your DNS domain: home.arpa The following are the values you entered. [...] Are they OK? >a: Yes</code></pre>Remote login to the installer</h3> Make this manual installation process easier (i.e. cut-n-paste commands) by remotely logging into the installer via ssh</code> from another computer. Open a shell by selecting >a: Run /bin/sh</code> from the Utilities</code> menu. Set a password for root</code>: passwd</code></pre> Open the sshd_config</code> file for editing using the vi</code> editor: vi /etc/ssh/sshd_config</code></pre> Set permission to allow root</code> to login: PermitRootLogin yes</code></pre> Save changes and exit. Start the sshd</code> daemon: /etc/rc.d/sshd onestart</code></pre> Retrieve the IP address for the active interface configured earlier (example: wm0</code>): ifconfig wm0</code></pre> Switch to the other computer and ssh</code> into the target device: ssh root@[ip_address]</code></pre> …where [ip_address]</code> is the target device’s address obtained with the ifconfig</code> command above. Prepare the DISK</h2> NOTE For the purposes of this HOWTO, the example target device has a single NVMe disk with an existing install of Linux</a> that will be erased and replaced by NetBSD. Device IDs and storage sizes will vary between devices. Identify disks and partitions</h3> Discover what disk devices and partitions have been recognized by the kernel: # sysctl hw.disknames hw.disknames = ld0 dk0 dk1 dk2 dk3 sd0 dk4 dk5</code></pre> NVMe devices show up as ld</code> and hard disks are identified by wd</code>. USB devices usually show up as sd</code>. The dk</code> devices are partitions (know as wedges in NetBSD parlance) on the storage devices, and this early after boot are usually displayed in order, that is: dk0</code> through dk3</code> are wedges on the NVMe target device ld0</code>, and dk4</code> and dk5</code> on the USB installer sd0</code>. Verify by asking for a list of wedges on sd0</code>: # dkctl sd0 listwedges /dev/rsd0: 2 wedges: dk4: EFI system, 262144 blocks at 2048, type: msdos dk5: 30c4cc4e-5369-449c-8994-a4b1ea665b4b, 4853760 blocks at 264192, type: ffs</code></pre> Verify which device the installer booted from: # dmesg | fgrep "root on" [ 4.158650] root on dk5</code></pre>Define DISK variable</h3> The NVMe storage device detected above as ld0</code> is where NetBSD will be installed. Adjust accordingly for your own storage device: DISK="ld0"</code></pre>Wipe DISK</h3> Wipe existing file systems and partition table on DISK: gpt destroy $DISK && gpt show $DISK</code></pre>Partition DISK</h3> NOTE I typically set the swap partition size equal to the amount of physical RAM to a maximum 8g</code>. Create a GPT partition table on DISK with the following layout: Number</th> Size</th> Type</th> Use as</th></tr></thead> 1</td> 550m</td> efi</td> ESP partition</td></tr> 2</td> 6g</td> ffs</td> Root partition</td></tr> 3</td> 8g</td> swap</td> Encrypted swap partition</td></tr> 4</td> ->END</td> cgd</td> Encrypted system partition</td></tr> </tbody></table> Create a new GPT partition table: gpt create -f $DISK</code></pre> Create the wedges: gpt add -l "ESP" -t efi -s 550m $DISK gpt add -l "root" -t ffs -s 6g $DISK gpt add -l "swap" -t swap -s 8g $DISK gpt add -l "syscgd" -t cgd $DISK gpt show $DISK</code></pre>Define wedge variables</h3> List wedges: # dkctl $DISK listwedges /dev/rld0: 4 wedges: dk0: ESP, 1126400 blocks at 34, type: msdos dk1: root, 12582912 blocks at 1126434, type: ffs dk2: swap, 16777216 blocks at 13709346, type: swap dk3: syscgd, 1923038573 blocks at 30486562, type: cgd</code></pre> NOTE Your dk[number]</code> numbering may differ from above. Adjust accordingly: Define variables: DK_ESP="dk0" DK_ROOT="dk1"</code></pre>Format and mount the ESP wedge</h3> newfs_msdos /dev/r${DK_ESP} && mount /dev/${DK_ESP} /mnt</code></pre>Add EFI boot entries to ESP</h3> mkdir -p /mnt/EFI/boot && cp -v /usr/mdec/*.efi /mnt/EFI/boot</code></pre> Unmount wedge: umount /mnt</code></pre>Format and mount the root wedge</h3> Format and mount the root wedge with the FFSv2</code> file system with support for extended attributes and access control lists: newfs -O 2ea /dev/r${DK_ROOT} && mount /dev/${DK_ROOT} /targetroot</code></pre>Disk Encryption</h2> NetBSD uses the cryptographic device driver</a> (CGD) to create and manage encrypted devices. Create encrypted device</h3> Using cgdconfig</code>, a parameters file is generated that stores the encryption type, key length, and a random password salt for the new encrypted device. There are a few different encryption ciphers supported</a>. I choose aes-xts</code> with a 512-bit key: mkdir -p /targetroot/etc/cgd && chmod 700 /targetroot/etc/cgd cgdconfig -g -V disklabel -o /targetroot/etc/cgd/syscgd aes-xts 512</code></pre> NOTE NAME=syscgd</code> is the label for the CGD wedge created earlier. Create the encrypted device and assign it a passphrase. This passphrase will be used to open the CGD device at boot: cgdconfig -V re-enter cgd0 NAME=syscgd /targetroot/etc/cgd/syscgd</code></pre>Create disklabels</h3> NOTE Disklabels c</code> and d</code> have special meaning in NetBSD</a> and should not be used. Within the encrypted device, three disklabels are created: Disklabel</th> Mountpoint</th> Size</th></tr></thead> cgd0a</td> /var</td> 8G</td></tr> cgd0b</td> /usr</td> 48G</td></tr> cgd0e</td> /home</td> ->END</td></tr> </tbody></table> Create the labels using disklabel</code> in interactive mode: # disklabel -Ii cgd0 Enter '?' for help ...</code></pre> Create cgd0a</code>: partition>a Filesystem type [4.2BSD]: <enter> Start offset ('x' to start after partition 'x') [0c, 0s, 0M]: <enter> Partition size ('$' for all remaining) [947594c, 1940672512s, 947594M]: 8G a: ...</code></pre> Create cgd0b</code>: partition>b Filesystem type [unused]: 4.2BSD Start offset ('x' to start after partition 'x') [0c, 0s, 0M]: a Partition size ('$' for all remaining) [0c, 0s, 0M]: 48G b: ...</code></pre> Create cgd0e</code>: partition>e Filesystem type [unused]: 4.2BSD Start offset ('x' to start after partition 'x') [0c, 0s, 0M]: b Partition size ('$' for all remaining) [0c, 0s, 0M]: $ e: ...</code></pre> Write the label and quit: partition>W Label disk [n]?y Label written partition>Q</code></pre>Verify encrypted device</h3> Set configuration in target device: echo 'cgd0 NAME=syscgd /etc/cgd/syscgd' > /targetroot/etc/cgd/cgd.conf</code></pre> Close the CGD device: cgdconfig -u cgd0</code></pre> Unlock the CGD device again with the passphrase set earlier: cgdconfig cgd0 NAME=syscgd /targetroot/etc/cgd/syscgd</code></pre> The cgd0</code> drive should now be open and the disklabel visible: disklabel cgd0</code></pre>Format and mount disklabels</h3> Format: newfs -O 2ea cgd0a newfs -O 2ea cgd0b newfs -O 2ea cgd0e</code></pre> Mount: mkdir /targetroot/var /targetroot/usr /targetroot/home mount /dev/cgd0a /targetroot/var mount /dev/cgd0b /targetroot/usr mount /dev/cgd0e /targetroot/home</code></pre>Installation</h2> The new system is composed of sets (collections of packages) installed to the target device. These sets are located in /amd64/binary/sets</code>. Move into that directory: cd /amd64/binary/sets && ls</code></pre> NOTE Adding flag p</code> to the tar</code> command is important. It ensures that all files preserve their owners</code> and mode</code>. At a minimum, you must select a kernel and the base</code> and etc</code> sets. Below are the sets I choose to install for a desktop setup: # for set in base comp etc games gpufw kern-GENERIC man misc modules rescue tests text xbase xcomp xetc xfont xserver; do > tar -xvzpf $set.tar.xz -C /targetroot > done</code></pre>Configure the System</h2> Chroot into the freshly installed NetBSD and configure the new OS. Chroot</h3> chroot /targetroot</code></pre>Directories</h3> Create the kern</code> and proc</code> directories: mkdir kern proc</code></pre>Devices</h3> cd dev sh MAKEDEV all</code></pre> On a previous install, after rebooting the boot process halted with the error message: /etc/defaults/rc.conf: cannot create /dev/null: read-only file system /etc/rc: cannot create /dev/null: read-only file system</code></pre> Device null</code> shows: # ls -l /dev/null -rw-r--r-- 1 root wheel 0 Aug 6 14:10 /dev/null</code></pre> To avoid this error, remove the existing null</code>: rm /dev/null</code></pre> Re-create null</code> with mknod</code>: # mknod -m 0666 -u root -g wheel /dev/null c 2 2 && ls -l /dev/null crw-rw-rw- 1 root wheel 2, 2 Aug 6 14:12 /dev/null</code></pre>Root password</h3> passwd</code></pre>Superuser</h3> Create a user account assigned to the wheel</code> and operator</code> groups: useradd -G [groups] -m [username]</code></pre> Example: Create an account for user foo</code> and assign a password: useradd -G wheel,operator -m foo passwd foo userinfo foo</code></pre>Fstab</h3> # cat > /etc/fstab << EOF NAME=root / ffs rw,log,noatime 1 1 NAME=swap none swap sw,dp 0 0 tmpfs /tmp tmpfs rw,-m1777,-sram%25 kernfs /kern kernfs rw ptyfs /dev/pts ptyfs rw procfs /proc procfs rw tmpfs /var/shm tmpfs rw,-m1777,-sram%25 /dev/cgd0a /var ffs rw,log,noatime 1 2 /dev/cgd0b /usr ffs rw,log,noatime 1 2 /dev/cgd0e /home ffs rw,log,noatime 1 2 EOF</code></pre>Startup</h3> Open rc.conf</code> for editing: vi /etc/rc.conf</code></pre> NOTE In this HOWTO, my hostname was earlier set to foobox.home.arpa</code> during network setup, and my wired interface is wm0</code>. Adjust accordingly: # If this is not set to YES, the system will drop into single-user mode. # rc_configured=YES # Add local overrides below. # # Wait for CGD to be unlocked before mounting. critical_filesystems_local="OPTIONAL:/var OPTIONAL:/usr" dhcpcd=YES dhcpcd_flags="-qM wm0" hostname=foobox.home.arpa sshd=YES ntpd=YES ntpdate=YES wscons=YES cgd=YES</code></pre> Save changes and exit. NOTE Any Error: /dev/ttypX: No such file or directory</code> messages can be safely ignored. Keyboard</h3> A full list of keyboard mappings and variants can be found in wskbd(4)</a>. Set encoding [type_of_keyboard]</code> in wscons.conf</code>. Open file for editing: vi /etc/wscons.conf</code></pre> Example: I use the non-default colemak</code> keymap: encoding us.colemak</code></pre> Save changes and exit. Timezone</h3> Create a symlink to the appropriate timezone for your localtime</code>: ln -sf /usr/share/zoneinfo/[region/<city_or_sub-region] /etc/localtime</code></pre> Example: Set localtime</code> to Canada/Eastern</code>: ln -sf /usr/share/zoneinfo/Canada/Eastern /etc/localtime && date</code></pre>Network interface</h3> ifconfig.if(5)</a> contains the configuration details for each network interface. Example: Create an interface file for the wm0</code> interface that is assigned an IP address via DHCP: # cat > /etc/ifconfig.wm0 << EOF up media autoselect EOF</code></pre>Terminals</h3> Set the status of terminals ttyE1-ttyE3</code> in ttys</code> from off</code> to on</code>. Open file for editing: vi /etc/ttys</code></pre> This is how it should look: # name getty type status comments # console "/usr/libexec/getty Pc" wsvt25 off secure constty "/usr/libexec/getty Pc" wsvt25 on secure ttyE0 "/usr/libexec/getty Pc" wsvt25 off secure ttyE1 "/usr/libexec/getty Pc" wsvt25 on secure ttyE2 "/usr/libexec/getty Pc" wsvt25 on secure ttyE3 "/usr/libexec/getty Pc" wsvt25 on secure</code></pre> Save changes and exit. Finish Up</h2> Exit chroot: exit cd /</code></pre> Unmount: umount /targetroot/home umount /targetroot/usr umount /targetroot/var umount /targetroot</code></pre> Close encrypted device: cgdconfig -u cgd0</code></pre> Reboot system: shutdown -r now</code></pre> NOTE When prompted for the passphrase to unlock the encrypted device, keymap is us qwerty</code> regardless of keymap that might have been set in wscons.conf</code>. User is prompted for the passphrase to unlock the encrypted syscgd</code> device. Upon success, boot resumes: NetBSD/amd64 (foobox.home.arpa) (constty) login: root Password:</code></pre> Welcome to NetBSD! To shutdown/poweroff the system: shutdown -p now</code></pre> Next: After the First Boot</a> Resources</h2> This HOWTO posted by vsis</a> was crucial in getting my own system configured with encryption: NetBSD - UEFI installation with Full Disk Encryption</a></li> Alternative approach for disk encryption using a ramdisk on BIOS boot systems: NetBSD Full-Disk Encryption with CGD (BIOS/GPT)</a></li> NetBSD INSTALL: Installation procedure for NetBSD/amd64</a></li> NetBSD Wiki: Installing NetBSD on a x86 system with UEFI</a></li> NetBSD Guide: Chapter 14. The cryptographic device driver (CGD)</a></li> Suggested tools for inspecting disks: Disk management from Installation ISO</a></li> Skipping sysinst install for a more “hands-on” approach: Manual NetBSD install on GPT/UEFI</a></li> Swap encryption is now automatic using the vm.swap_encrypt=1</code> sysctl(8)</a> variable: Announcing NetBSD 10.0</a></li> </ul> You can like, share, or comment on this post on the Fediverse</a> 💬 Set Up a Basic Firewall on FreeBSD Sat, 15 Aug 2026 00:00:00 +0000 I use Packet Filter (PF) to set up a basic firewall on FreeBSD. To start, the only service I’m running that requires inbound access is SSH. SSHGuard</a> is added for an additional layer of security. Start Here</a></li> Enable PF</a></li> SSHGuard</a></li> ICMP</a></li> Final Config</a></li> Resources</a></li> </ul> Start Here</h2> PF requires a ruleset configuration file to operate. Example rulesets are found in /usr/share/examples/pf/</code>. I implement a basic ruleset by creating the /etc/pf.conf</code> file with: tcp_services = "{ ssh }" scrub in all block in all pass out all keep state pass in proto tcp to port $tcp_services</code></pre> This blocks all inbound traffic by default, with the exception of ssh</code>, and allows all outbound traffic to pass. Enable PF</h2> Set the pf</code> kernel module to be loaded by adding to /etc/rc.conf</code>: doas sysrc pf_enable=YES</code></pre> Add a line which specifies the path to the ruleset file: doas sysrc pf_rules=/etc/pf.conf</code></pre> Enable logging support, provided by pflog(4)</code>, by adding: doas sysrc pflog_enable=YES</code></pre> Reboot. SSH connections are allowed in. Everything else is blocked. Try running ping</code> directed at the firewalled FreeBSD machine and observe that all packets are dropped. Use the pfctl(8)</code> command to manage pf</code>. Example: Check /etc/pf.conf</code> for errors, but do not load ruleset: -> doas pfctl -nvf /etc/pf.conf tcp_services = "{ ssh }" scrub in all fragment reassemble block drop in all pass out all flags S/SA keep state pass in proto tcp from any to any port = ssh flags S/SA keep state</code></pre> To view a dynamic snapshot of traffic that passes through the firewall, install the pftop(8)</code> package: doas pkg install pftop</code></pre>SSHGuard</h2> Install sshguard</code> to block bad ssh</code> login attempts: doas pkg install sshguard</code></pre> Add to rc.conf</code>: doas sysrc sshguard_enable=YES</code></pre> Set the appropriate firewall BACKEND</code> for sshguard</code> by modifying /usr/local/etc/sshguard.conf</code>: # Full path to backend executable (required, no default) BACKEND="/usr/local/libexec/sshg-fw-pf"</code></pre> SSHGuard works alongside pf</code> by adding attackers to the table <sshguard></code>. Create this table and block attackers by adding the following lines to the evolving /etc/pf.conf</code>: table <sshguard> persist . . . block in proto tcp from <sshguard></code></pre> NOTE Ensure the line table <sshguard> persist</code> comes before filtering rules to prevent syntax errors. See sshguard-setup(7)</code> for more details. Reload the rules: doas pfctl -f /etc/pf.conf</code></pre> Start the service: doas service sshguard start</code></pre> To inspect the contents of the block table, run: doas pfctl -t sshguard -T show</code></pre>ICMP</h2> Blocking ping</code> can make troubleshooting network issues more difficult. Let’s give it a pass</code>, and allow destination unreachable messages. Add to /etc/pf.conf</code>: icmp_types = "{ echoreq, unreach }" . . . pass in inet proto icmp icmp-type $icmp_types</code></pre>Final Config</h2> The complete /etc/pf.conf</code>: tcp_services = "{ ssh }" # 'echoreq' allows inbound ping requests, and 'unreach' # allows destination unreachable messages icmp_types = "{ echoreq, unreach }" # table added before filtering rules to prevent syntax errors table <sshguard> persist scrub in all block in all block in proto tcp from <sshguard> pass out all keep state pass in inet proto icmp icmp-type $icmp_types pass in proto tcp to port $tcp_services</code></pre> Reload the rules: doas pfctl -f /etc/pf.conf</code></pre>Resources</h2> FreeBSD Handbook: PF</a></li> YouTube: Setting up a basic firewall with pf on FreeBSD</a></li> SSHGuard Manual: sshguard-setup</a></li> SSH key-based authentication</a></li> </ul> You can like, share, or comment on this post on the Fediverse</a> 💬

Create SSH Keys</h2>
Create an SSH public/private key pair to facilitate passwordless logins to remote servers and (optional) configure remote access to the localhost. Read More</a></p>

Create Public and Private Keys</h2>

Disable Password Logins</h2>

Create An Alias</h2>

Keychain</h2>

Disk Encryption</h2>
NetBSD uses the cryptographic device driver</a> (CGD) to create and manage encrypted devices.</p>

Configure the System</h2>
Chroot into the freshly installed NetBSD and configure the new OS.</p>

Set Up a Basic Firewall on FreeBSD

Resources</h2>

FreeBSD Handbook: PF</a></li>
YouTube: Setting up a basic firewall with pf on FreeBSD</a></li>
SSHGuard Manual: sshguard-setup</a></li>
SSH key-based authentication</a></li> </ul>
You can like, share, or comment on this post on the Fediverse</a> 💬 </p>

Daniel Wayne Armstrong

NetBSD: After First Boot

Customize the Login on NetBSD

Configure SSH for Passwordless Logins to NetBSD Servers

Start Here</h2>

NetBSD 11.0 Installation with Disk Encryption

Daniel Wayne Armstrong

NetBSD: After First Boot

Package management</h2> Package management is one area where the differences between the Linux philosophy and the BSD philosophy about how to build a system becomes apparent.</p>

Check for vulnerable packages</h2> Set the system to automatically run a daily update of its local database of known vulnerable packages, check if any of these packages are installed, and inform the user if so:</p>

Accelerate keyboard repeat speed</h2> The speed at which a key press is repeated can be accelerated by modifying wscons.conf</code>:</p>

Customize the Login on NetBSD

Configure SSH for Passwordless Logins to NetBSD Servers

Start Here</h2>

On BOTH the CLIENT and the SERVER</h3> Create the .ssh</code> directory and authorized_keys</code> file in $HOME</code>:</p>

Create Public and Private Keys</h2>

On the CLIENT</h3> Create the SSH public/private key pair protected with a passphrase using ssh-keygen(1)</code>:</p>

Share Public Key</h2>

On the CLIENT</h3> Upload the public key using ssh-copy-id(1)</code> to the SERVER and append to its authorized_keys</code> file:</p>

Disable Password Logins</h2>

Create An Alias</h2>

Keychain</h2>

NetBSD 11.0 Installation with Disk Encryption

Disk Encryption</h2> NetBSD uses the cryptographic device driver</a> (CGD) to create and manage encrypted devices.</p>

Configure the System</h2> Chroot into the freshly installed NetBSD and configure the new OS.</p>

Set Up a Basic Firewall on FreeBSD

Resources</h2> FreeBSD Handbook: PF</a></li> YouTube: Setting up a basic firewall with pf on FreeBSD</a></li> SSHGuard Manual: sshguard-setup</a></li> SSH key-based authentication</a></li> </ul> You can like, share, or comment on this post on the Fediverse</a> 💬 </p>

Disk Encryption</h2>
NetBSD uses the cryptographic device driver</a> (CGD) to create and manage encrypted devices.</p>

Configure the System</h2>
Chroot into the freshly installed NetBSD and configure the new OS.</p>

Resources</h2>

FreeBSD Handbook: PF</a></li>
YouTube: Setting up a basic firewall with pf on FreeBSD</a></li>
SSHGuard Manual: sshguard-setup</a></li>
SSH key-based authentication</a></li> </ul>
You can like, share, or comment on this post on the Fediverse</a> 💬 </p>