TFTP security and Ignite/Make Recovery configuration

[Tor-Arne Nostdal]

Normally TFTP is considered a security threath.

When using make_recovery / Ignite - I need to have an entry in /etc/inetd.conf
tftp dgram udp wait root /usr/lbin/tftpd tftpd /opt/ignite /var/opt/ignite

Couldn't this be a real security hole?
Should I disable the tftp and only enable it manually while recovering interactively from an Ignite tape...?

[Craig Rants]

You could lock down access to tftp through your /var/adm/inetd.sec file. This will allow you to advertise tftp for ignite purposes but maintain some security controls.

Good Luck.
C

[harry d brown jr]

It depends. Is your machine on the INTERNET? Is your local LAN suspect *do you have employees that want to destroy your machines?)?? If the anwser is no, then don't worry about it. If the answer is yes, then disconnect the server from the internet or your local untrusted lan.


live free or die
harry

[harry d brown jr]

From this site:

http://people.hp.se/stevesk/

http://people.hp.se/stevesk/bastion11.html
http://people.hp.se/stevesk/bastion10.html

choose either 11 or 10 docs on how to secure a server. ANYTIME you have a server connected to the Internet or to an UNTRUSTED network, then you should disconnect it while you are building or upgrading a server.

live free or die
harry

[Patrick Wallek · Accepted solution]

As far as I know tftp is just used when you are doing a make_net_recovery and / or recovering a system over the network from a make_net_recovery image.

If you are just using make_recovery / make_tape_recovery locally on a machine you should be able to turn off tftp and have no problems with your make_tape_recovery's running.

[Tor-Arne Nostdal]

The system is behind a firewall - so in general I would only protect it from Internal people...
Craig: Thanks for the inetd.sec tip - It seems as a good place to begin (though I have read about it).
Harry: Thanks for the links - I will use it for investigating further. Sometimes it seems that the internal policy requires a "Bastion" setup even though it's behind a firewall.

[Tor-Arne Nostdal]

I'll use Patrick's solution.
This removes the potential danger completely - though I by this removes a neat feature...
It isn't that often I need the Ignite tape ;-)

[Ralf Hildebrandt]

YOu can wrap the tfpd using tcp_wrappers and have that perform checks that exceed the crap inetd.sec can do by far.

www.porcupine.org
is the place to go.