First steps after install: users, sudo/doas, SSH keys, updates

A fresh install works, but a few steps make it safer and more pleasant to use day to day. Do these from the console or an initial SSH session.

1Apply updates first

Bring the system and the package tools up to date. The first pkg command offers to bootstrap pkg itself; answer yes. On a traditional (distribution set) install, patch the base system with freebsd-update.

freebsd-update fetch
freebsd-update install
pkg update
pkg upgrade

If you installed the base system as packages (pkgbase), freebsd-update doesn't apply; see the tutorial on keeping patched.

2Create an everyday user

If you didn't create one in the installer, use adduser, which asks interactively. When asked to invite the user into other groups, type wheel.

adduser
# or add an existing user to wheel:
pw groupmod wheel -m alice

3Install doas or sudo

Neither tool is in the base system; both are in packages. doas is small and simple; sudo is more featureful. Pick one.

# doas
pkg install doas
echo 'permit persist :wheel' > /usr/local/etc/doas.conf

# or sudo
pkg install sudo
visudo   # then uncomment the line:  %wheel ALL=(ALL:ALL) ALL

doas id     # or: sudo id

4Set up SSH keys

On your own computer (not the server), create a key if you don't already have one, then copy the public key to the server.

ssh-keygen -t ed25519 -C "alice@laptop"
ssh-copy-id alice@host.example.org

If ssh-copy-id isn't available on your computer, append the key manually:

cat ~/.ssh/id_ed25519.pub | ssh alice@host.example.org \
  'mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys'

Once key login works, see the SSH hardening tutorial to turn off password logins.

5Small quality-of-life settings

sysrc ntpd_enable=YES ntpd_sync_on_start=YES
service ntpd start
pkg install vim tmux     # optional editors and tools

← All FreeBSD tutorials