Skip to content

2.1.16 Ensure tftp server services are not in use

Audit#

Run the following command to verify tftpd-hpa is not installed: 

# dpkg-query -s tftpd-hpa &>/dev/null && echo "tftpd-hpa is installed"
Nothing should be returned.

- OR - - IF - the package is required for dependencies: Run the following command to verify tftpd-hpa.service is not enabled: 

# systemctl is-enabled tftpd-hpa.service 2>/dev/null | grep 'enabled'
Nothing should be returned.

Run the following command to verify tftpd-hpa.service is not active: 

# systemctl is-active tftpd-hpa.service 2>/dev/null | grep '^active'
Nothing should be returned.

Note: If the package is required for a dependency - Ensure the dependent package is approved by local site policy - Ensure stopping and masking the service and/or socket meets local site policy

Remediation#

Run the following commands to stop tftpd-hpa.service and remove the tftpd-hpa package: 

# systemctl stop tftpd-hpa.service
# apt purge tftpd-hpa

- OR - - IF - the tftpd-hpa package is required as a dependency: Run the following commands to stop and mask tftpd-hpa.service: 

# systemctl stop tftpd-hpa.service
# systemctl mask tftpd-hpa.service