Check: GEN005140
SUSE Linux Enterprise Server v11 for System z STIG:
GEN005140
(in versions v1 r12 through v1 r9)
Title
Any active TFTP daemon must be authorized and approved in the system accreditation package. (Cat I impact)
Discussion
TFTP is a file transfer protocol often used by embedded systems to obtain configuration data or software. The service is unencrypted and does not require authentication of requests. Data available using this service may be subject to unauthorized access or interception.
Check Content
Determine if the TFTP daemon is active. # chkconfig --list | grep tftp Or # chkconfig tftp If TFTP is found enabled and not documented using site-defined procedures, it is a finding.
Fix Text
Document or Disable the TFTP daemon. If the TFTP daemon is necessary on the system, document and justify its usage for approval from the IAO. If the TFTP daemon is not necessary on the system, turn it off. # chkconfig tftp off # service xinetd restart
Additional Identifiers
Rule ID: SV-45909r1_rule
Vulnerability ID: V-4695
Group Title: GEN005140
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000225 |
The organization employs the concept of least privilege, allowing only authorized accesses for users (and processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions. |
Controls
| Number | Title |
|---|---|
| AC-6 |
Least Privilege |