[PATCH 07/14] Created OCIL for tftpd_uses_secure_mode - Updated description for minor things / copy editing - Created OCIL for tftpd_uses_secure_mode

Shawn Wells shawn at redhat.com
Wed Sep 19 16:06:01 UTC 2012


---
 RHEL6/input/services/obsolete.xml |   14 +++++++++++---
 1 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/RHEL6/input/services/obsolete.xml b/RHEL6/input/services/obsolete.xml
index 383b19d..c60fd2c 100644
--- a/RHEL6/input/services/obsolete.xml
+++ b/RHEL6/input/services/obsolete.xml
@@ -276,10 +276,10 @@ accidental (or intentional) activation of tftp services.
 </Rule>
 
 <Rule id="tftpd_uses_secure_mode" severity="high">
-<title>Ensure TFTP Daemon Uses Secure Mode</title>
-<description>If running the TFTP service is necessary, it should be configured
+<title>Ensure <tt>tftp</tt> Daemon Uses Secure Mode</title>
+<description>If running the <tt>tftp</tt> service is necessary, it should be configured
 to change its root directory at startup. To do so, ensure that
-<tt>/etc/xinted.d/tftp</tt> includes <tt>-s</tt> as a command line argument, as shown in
+<tt>/etc/xinetd.d/tftp</tt> includes <tt>-s</tt> as a command line argument, as shown in
 the following example (which is also the default):
 <pre>server_args = -s /var/lib/tftpboot</pre>
 </description>
@@ -287,6 +287,14 @@ the following example (which is also the default):
 given directory. Serving files from an intentionally-specified directory
 reduces the risk of sharing files which should remain private.
 </rationale>
+<ocil>Verify that <tt>tftp</tt> is configured by with the <tt>-s</tt> option by running the
+following command:
+<pre>grep "server_args" /etc/xinetd.d/tftpboot</pre>
+The output should indicate the <tt>server_args</tt> variable is configured with the <tt>-s</tt>
+flag, matching the example below:
+<pre> # grep "server_args" /etc/xinetd.d/tftpboot
+server_args = -s /var/lib/tftpboot</pre>
+</ocil>
 <ident cce="TODO" />
 <oval id="tftpd_uses_secure_mode" />
 </Rule>
-- 
1.7.1


--h31gzZEtNLTqOjlF--


More information about the scap-security-guide mailing list