The TFTP daemon must be configured to vendor specifications, including a dedicated TFTP user account, a non-login shell, such as /bin/false, and a home directory owned by the TFTP user.

The TFTP daemon must be configured to vendor specifications, including a dedicated TFTP user account, a non-login shell, such as /bin/false, and a home directory owned by the TFTP user.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
GEN005120-ESXI5-PNF	GEN005120-ESXI5-PNF	GEN005120-ESXI5-PNF_rule		Medium

Description
If TFTP has a valid shell, it increases the likelihood of someone logging to the TFTP account and compromising the system. Applicable, but permanent not-a-finding - no ftp.

STIG	Date
VMware ESXi v5 Security Technical Implementation Guide	2013-01-15

Details

Check Text ( C-GEN005120-ESXI5-PNF_chk )
ESXi supports this requirement and cannot be configured to be out of compliance. This is a permanent not a finding.

Fix Text (F-GEN005120-ESXI5-PNF_fix)
This requirement is permanent not a finding. No fix is required.