documentation_complete: true

title: 'Ensure <tt>tftp</tt> Daemon Uses Secure Mode'

description: |-
    If running the <tt>tftp</tt> service is necessary, it should be configured
    to change its root directory at startup. To do so, ensure
    <tt>/etc/xinetd.d/tftp</tt> includes <tt>-s</tt> as a command line argument, as shown in
    the following example (which is also the default):
    <pre>server_args = -s /var/lib/tftpboot</pre>

rationale: |-
    Using the <tt>-s</tt> option causes the TFTP service to only serve files from the
    given directory. Serving files from an intentionally-specified directory
    reduces the risk of sharing files which should remain private.

severity: high

identifiers:
    cce: 27272-4

references:
    disa: 366
    nist: CM-7
    srg: SRG-OS-999999
    stigid: RHEL-06-000338

ocil_clause: 'this flag is missing'

ocil: "If TFTP is not installed, this is not applicable.  To determine if TFTP is installed, \nrun the following command:\n<pre>$ rpm -qa | grep tftp</pre>\n<br /><br />\nVerify <tt>tftp</tt> is configured by with the <tt>-s</tt> option by running the\nfollowing command:\n<pre>grep \"server_args\" /etc/xinetd.d/tftp</pre>\nThe output should indicate the <tt>server_args</tt> variable is configured with the <tt>-s</tt>\nflag, matching the example below:\n<pre> $ grep \"server_args\" /etc/xinetd.d/tftp\nserver_args = -s /var/lib/tftpboot</pre>"
