>From 146e6fefc6e49880289b4afa007308b02aab85a9 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Wed, 19 Sep 2012 12:06:01 -0400 Subject: [PATCH 07/14] Created OCIL for tftpd_uses_secure_mode - Updated description for minor things / copy editing - Created OCIL for tftpd_uses_secure_mode --- RHEL6/input/services/obsolete.xml | 14 +++++++++++--- 1 files changed, 11 insertions(+), 3 deletions(-) diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml index 383b19d..c60fd2c 100644 --- a/RHEL6/input/services/obsolete.xml +++ b/RHEL6/input/services/obsolete.xml @@ -276,10 +276,10 @@ accidental (or intentional) activation of tftp services. -Ensure TFTP Daemon Uses Secure Mode -If running the TFTP service is necessary, it should be configured +Ensure <tt>tftp</tt> Daemon Uses Secure Mode +If running the tftp service is necessary, it should be configured to change its root directory at startup. To do so, ensure that -/etc/xinted.d/tftp includes -s as a command line argument, as shown in +/etc/xinetd.d/tftp includes -s as a command line argument, as shown in the following example (which is also the default):
server_args = -s /var/lib/tftpboot
@@ -287,6 +287,14 @@ the following example (which is also the default): given directory. Serving files from an intentionally-specified directory reduces the risk of sharing files which should remain private. +Verify that tftp is configured by with the -s option by running the +following command: +
grep "server_args" /etc/xinetd.d/tftpboot
+The output should indicate the server_args variable is configured with the -s +flag, matching the example below: +
 # grep "server_args" /etc/xinetd.d/tftpboot
+server_args = -s /var/lib/tftpboot
+
-- 1.7.1