If the Trivial File Transfer Protocol (TFTP) server is required, the TFTP daemon must be configured to operate in secure mode.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-215159	UBTU-16-030730	SV-215159r508033_rule		Medium

Description
Restricting TFTP to a specific directory prevents remote users from copying, transferring, or overwriting system files.

STIG	Date
Canonical Ubuntu 16.04 LTS Security Technical Implementation Guide	2020-09-03

Details

Check Text ( C-16358r285345_chk )
Verify the Trivial File Transfer Protocol (TFTP) daemon is configured to operate in secure mode. Check to see if a TFTP server has been installed with the following commands: # dpkg -l \| grep tftpd-hpa ii tftpd-hpa 5.2+20150808-1Ubuntu1.16.04.1 If a TFTP server is not installed, this is Not Applicable. If a TFTP server is installed, check for the server arguments with the following command: # grep TFTP_OPTIONS /etc/default/tftpd-hpa TFTP_OPTIONS="--secure" If "--secure" is not listed in the TFTP_OPTIONS, this is a finding.

Check Text ( C-16358r285345_chk )

Verify the Trivial File Transfer Protocol (TFTP) daemon is configured to operate in secure mode.

Check to see if a TFTP server has been installed with the following commands:

# dpkg -l | grep tftpd-hpa
ii tftpd-hpa 5.2+20150808-1Ubuntu1.16.04.1
If a TFTP server is not installed, this is Not Applicable.

If a TFTP server is installed, check for the server arguments with the following command:

# grep TFTP_OPTIONS /etc/default/tftpd-hpa
TFTP_OPTIONS="--secure"

If "--secure" is not listed in the TFTP_OPTIONS, this is a finding.

Fix Text (F-16356r285346_fix)
Configure the Trivial File Transfer Protocol (TFTP) daemon to operate in the secure mode by adding the "--secure" option to TFTP_OPTIONS in /etc/default/tftpd-hpa and restart the tftpd daemon.