NetBSD: After First Boot

Last edited on 2026-09-04 • Tagged under #netbsd #bsd

After the first boot of my NetBSD installation, these are some extra steps I like to make right away to get a system off to a good start!

Package management

Package management is one area where the differences between the Linux philosophy and the BSD philosophy about how to build a system becomes apparent.

Linux is an operating system kernel. Developers take this kernel and combine it with various independent software projects in a collection of packages that is released as a Linux distribution (Ubuntu, Debian, Fedora, etc.).

In contrast, each of the BSDs develop their own kernel and combine it with system components that are developed together “in-house” and released as a whole. The idea being that this approach leads to a more robust and tightly integrated core operating system. Third-party “userland” packages not included in the core may still be installed at the discretion of the user.

Source code and binary packages are provided by pkgsrc(7), the NetBSD packages collection, which can be viewed online sorted alphabetically. Install binary packages directly from remote package repositories using pkgin, a user-friendly frontend to the pkg_* tools.

Switch to root if not already logged in as such:

su -

Set PKG_PATH:

PKG_PATH="http://cdn.NetBSD.org/pub/pkgsrc/packages/NetBSD/$(uname -p)/$(uname -r|cut -f '1 2' -d.)/All/"
export PKG_PATH

Install:

pkg_add pkgin
pkg_add -v mozilla-rootcerts-openssl

To keep packages up-to-date, compare installed packages to the versions available in repositories and generate a list of packages due for an upgrade by running the command:

pkgin update

To add a package:

pkgin install [package]

One of the first packages I like to install on any BSD or Linux system is sl(1):

pkgin install sl

More: NetBSD Guide: Installing additional software

Run commands as root

I created a user account (example: foo) during installation and added myself to the wheel group.

Install doas to run root-level access commands, and allow members of wheel to do so by default, by creating doas.conf:

pkgin install doas
echo "permit :wheel" > /usr/pkg/etc/doas.conf

To allow user foo to run commands as root without asking for a password:

echo "permit nopass keepenv foo" >> /usr/pkg/etc/doas.conf

Log out as root, log back in as your user, and use doas to run any commands that require root privileges.

Use a different console font

The base system includes a selection of console fonts in /usr/share/wscons/fonts. I like the Terminus font.

Open the wscons.conf file for editing:

doas vi /etc/wscons.conf

Uncomment the desired TerminusXX font size, and set the font for use in the console:

font    Terminus32-ISO8859-1    - - -   /usr/share/wscons/fonts/ter-132n.wsf

.
.
.

setvar  ttyE0   font            Terminus32-ISO8859-1
setvar  ttyE1   font            Terminus32-ISO8859-1
setvar  ttyE2   font            Terminus32-ISO8859-1
setvar  ttyE3   font            Terminus32-ISO8859-1

Save changes and exit.

Restart:

doas service wscons restart

More: NetBSD Guide: Console drivers

Alias for root mail

Rather than login to root to collect system mail, I forward the root user’s mail to my non-root user’s inbox.

Open the aliases file for editing:

doas vi /etc/mail/aliases

Modify:

# root:
# operator:

… uncomment the lines and add my username (example: foo):

root:           foo
operator:       foo

Save changes and exit.

Let the MTA know about the modification by running the newaliases(1) command with no arguments:

doas newaliases

Test whether mail is indeed being forwarded by using the mail(1) command as my user to send root a message:

$ mail root
Subject: Test new aliases
Is it working?

Press CTRL-d to exit and send message.

$ mail
Mail version 9.1alpha 2009-02-25.  Type ? for help.
"/var/mail/foo": 1 message 1 new
>N  1 foo@bsdbox.home.arp  Wed Sep  2 11:51   3/456   "Test new aliases"

Check for vulnerable packages

Set the system to automatically run a daily update of its local database of known vulnerable packages, check if any of these packages are installed, and inform the user if so:

echo "fetch_pkg_vulnerabilities=YES" | doas tee -a /etc/daily.conf

By default this job will run in the early morning hours. For a machine that is typically powered off at night, I modify the time that /etc/daily is executed to the middle of the day.

Run:

doas crontab -e

Modify:

# do daily/weekly/monthly maintenance
15	12	*	*	*	/bin/sh /etc/daily 2>&1 | tee /var/log/daily.out | sendmail -t
30	12	*	*	6	/bin/sh /etc/weekly 2>&1 | tee /var/log/weekly.out | sendmail -t

Save changes and exit.

More: afterboot(8)

Create SSH Keys

Create an SSH public/private key pair to facilitate passwordless logins to remote servers and (optional) configure remote access to the localhost. Read More

After entering a username and password, the NetBSD default login generates multiple lines of output, some of it more useful (Last login) than others (copyright dates). Read More

Custom prompt

I set my user prompt to display the hostname and current working directory.

For the sh shell, open .shrc:

vi ~/.shrc

Add:

# Enable command execution in prompt strings
set -o promptcmds

get_pwd() {
	case "$PWD" in
		"$HOME") echo "~" ;;
		"$HOME"/*) echo "~${PWD#$HOME}" ;;
		*) echo "$PWD" ;;
	esac
}

PS1='$(hostname -s):$(get_pwd)\$ '

Save changes and exit.

Reload the config:

. ~/.shrc

Accelerate keyboard repeat speed

The speed at which a key press is repeated can be accelerated by modifying wscons.conf:

doas vi /etc/wscons.conf

Adjust these two variable: repeat.del1, which specifies the delay (in milliseconds) before character repetition starts, and repeat.deln, which sets the delay between each character repetition once started.

Example:

# Change keyboard repeat speed to faster settings.
setvar	wskbd	repeat.del1	300
setvar	wskbd	repeat.deln	20

Save changes and exit.

Restart to activate:

doas service wscons restart

Adjust console brightness

All my laptops have integrated Intel graphics, and to adjust the console brightness I use intel-backlight.

Install:

doas pkgin install intel-backlight

Display current brightness:

$ intel_backlight
Current backlight value: 33% (505/1515)

Set brightness to 100%:

$ intel_backlight 100
Current backlight value: 100% (1515/1515)

This only lasts for the current session. To auto-enable at boot, modify rc.local:

doas vi /etc/rc.local

Add:

# set screen brightness to 100% on boot
if [ -x /usr/pkg/sbin/intel_backlight ]; then
	/usr/pkg/sbin/intel_backlight 100
fi

Save changes and exit.

Microcode updates

For devices with Intel CPUs, install:

doas pkgin install intel-microcode-netbsd

To use intel-microcode-netbsd-<DATE> to update your system’s microcode, verify that hw.firmware.path includes your pkgsrc prefix:

$ /sbin/sysctl hw.firmware.path
hw.firmware.path = /libdata/firmware:/usr/libdata/firmware:/usr/pkg/libdata/firmware:/usr/pkg/libdata

Copy the sample rc.d file to apply updates during the boot process to /etc/rc.d:

doas cp /usr/pkg/share/examples/rc.d/intel-microcode /etc/rc.d/

To ensure the configurations are correct without rebooting, manually trigger the initialization script:

doas /etc/rc.d/intel-microcode start

If it silently exist, the config is OK.

Add microcode=YES to my /etc/rc.conf and reboot.

Verify:

$ cpuctl identify 0 | grep -i microcode
cpu0: microcode version 0xf6, platform ID 7

Clear console at logout

For the default sh shell, I create the .exitrc file:

echo "type clear >/dev/null 2>&1 && clear" > ~/.exitrc

Modify .shrc:

vi ~/.shrc

Add:

case "$-" in *i*)
    # interactive mode settings go here
    
    .
    .
    .
    
    # Clear terminal at logout
    test -f $HOME/.exitrc && trap ". $HOME/.exitrc" EXIT
esac

NetBSD: After First Boot

Package management

Run commands as root

Use a different console font

Alias for root mail

Check for vulnerable packages

Create SSH Keys

Custom login

Custom prompt

Accelerate keyboard repeat speed

Adjust console brightness

Microcode updates

Clear console at logout