Detections
Analytics

1.169 ALMA-09-021690

Information

If the Trivial File Transfer Protocol (TFTP) server is required, the TFTP daemon must be configured to operate in secure mode.

GROUP ID: V-269272
RULE ID: SV-269272r1050154

Restricting TFTP to a specific directory prevents remote users from copying, transferring, or overwriting system files. Using the "-s" option causes the TFTP service to only serve files from the given directory.

Solution

Configure the TFTP daemon to operate in secure mode with the following command:

$ systemctl edit tftp.service

Insert the following between the two sets of comments, making sure to add the "-s" option with a nonroot ("/") directory.

[Service]
ExecStart=
ExecStart=/usr/sbin/in.tftpd -s /tftp

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CCI|CCI-000366, Rule-ID|SV-269272r1050154_rule, STIG-ID|ALMA-09-021690, Vuln-ID|V-269272

Plugin: Unix

Control ID: 94d402a363b9bf5784a8ebe8377b000238fb184b2caf573ee300ef6ce3014e81