Detections
Analytics

ALMA-09-021690 - If the Trivial File Transfer Protocol (TFTP) server is required, the TFTP daemon must be configured to operate in secure mode.

Information

Restricting TFTP to a specific directory prevents remote users from copying, transferring, or overwriting system files. Using the "-s" option causes the TFTP service to only serve files from the given directory.

Solution

Configure the TFTP daemon to operate in secure mode with the following command:

$ systemctl edit tftp.service

Insert the following between the two sets of comments, making sure to add the "-s" option with a nonroot ("/") directory.

[Service]
ExecStart=
ExecStart=/usr/sbin/in.tftpd -s /tftp

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_CL_AlmaLinux_OS_9_V1R6_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-269272r1050154_rule, STIG-ID|ALMA-09-021690, Vuln-ID|V-269272

Plugin: Unix

Control ID: e5553fe65c105e69b4cad8e32a314b5bb5dac67d5c8593fcad30ae659880e689