Detections
Analytics

1.326 OL09-00-002426

Information

OL 9 Trivial File Transfer Protocol (TFTP) daemon must be configured to operate in secure mode if the TFTP server is required.

GROUP ID: V-271764
RULE ID: SV-271764r1092004

Restricting TFTP to a specific directory prevents remote users from copying, transferring, or overwriting system files. Using the "-s" option causes the TFTP service to only serve files from the given directory.

Solution

Configure the TFTP daemon to operate in secure mode.

Find the path for the systemd service.

$ sudo systemctl show tftp | grep FragmentPath=

FragmentPath=/etc/systemd/system/tftp.service

Edit the ExecStart line on that file to add the -s option with a subdirectory.

ExecStart=/usr/sbin/in.tftpd -s /var/lib/tftpboot

See Also

https://workbench.cisecurity.org/benchmarks/27024

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CCI|CCI-000366, Rule-ID|SV-271764r1092004_rule, STIG-ID|OL09-00-002426, Vuln-ID|V-271764

Plugin: Unix

Control ID: 9e93fb20acc9077fc6cacb4a4a059f836b970cb8a036092cf3cd6fab77d8ab71