Detections
Analytics

GEN005120 - The TFTP daemon must be configured to vendor specifications, including a dedicated TFTP user account, a non-login shell.

Information

If TFTP has a valid shell, it increases the likelihood someone could log on to the TFTP account and compromise the system.

Solution

Configure TFTP to use a dedicated 'tftp' user.

Procedure:
Create a dedicated 'tftp' user account if none exists.
Assign a non-login shell to the 'tftp' user account, such as /bin/false.
Assign a home directory to the 'tftp' user account.
Edit /etc/xinetd.d/tftp to have 'tftp' as the value of the 'user' parameter.

See Also

http://iasecontent.disa.mil/stigs/zip/U_RedHat_5_V1R18_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6, CAT|II, CCI|CCI-000225, Group-ID|V-849, Rule-ID|SV-37674r1_rule, STIG-ID|GEN005120, Vuln-ID|V-849

Plugin: Unix

Control ID: b4b946f98c86004763efc3223ae12c139dbd4678ce09464bd15b00af096035ef