# /etc/default/tftpd-hpaĪnd lastly restart tftpd-hpa. Simply add –create to TFTP_OPTIONS in /etc/default/tftpd-hpa. $ sudo chown tftp:tftp $(sudo mktemp -d XXXXXXXXXX -suffix=-incoming)Ĭonfigure tftpd-hpa to allow creation of new files. This allows tftpd-hpa to create files in this directory if configured to do so. Next create incoming directory owned by tftp mode 700. $ sudo chmod 755 $(sudo mktemp -d XXXXXXXXXX -suffix=-outgoing) You wouldn’t want your expensive Cisco IOS firmware image accidentally or maliciously overwritten. Files in this directory should be owned by root to prevent unauthorized or accidental overwriting. This prevents guessing common filenames.įirst create an outgoing directory owned by root mode 755. Instead of keeping any files directly in the /var/lib/tftpboot base directory I’ll use mktemp to create incoming and outgoing directories with hard-to-guess names. This can lead to dissemination of copyrighted firmware images or config files that may contain passwords and other sensitive information. The default configuration below allows switches and other devices to download files but, if you have predictable filenames, then anyone can download those files if you configure TFTP Server on your notebook. Step 1: Install TFTP and TFTP server $ sudo apt update sudo apt install tftp-hpa tftpd-hpa This allows me to do switch firmware upgrades and backup configuration files regardless of environment since my notebook is always with me.
The following example is similar to the configuration I run on my personal Ubuntu notebook and home Ubuntu servers. And since TFTP is lightweight without any user authentication care should be taken to prevent access to or overwriting of critical files. Note: Community TFTP documentation is on the Ubuntu Wiki but this short guide adds extra steps to help secure and safeguard your TFTP server.Įvery Data Centre Engineer should have a TFTP server somewhere on their network whether it be running on a production host or running on their own notebook for disaster recovery.
0 kommentar(er)
