SV-35157r1: The TFTP daemon must be configured to vendor specifications, including a dedicated TFTP user account, a non-login shell such as /bin/false, and a home directory owned by the TFTP user. | HP-UX 11.23 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

The TFTP daemon must be configured to vendor specifications, including a dedicated TFTP user account, a non-login shell such as /bin/false, and a home directory owned by the TFTP user.

Description

Discussion Text

If TFTP has a valid shell, it increases the likelihood that someone could logon to the TFTP account and compromise the system.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000225

Additional Details

Responsibility

System Administrator

IA Controls

ECSC-1

References

DPMS Target HP-UX 11.23 DISA DPMS Target HP-UX 11.23 2170

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.fso.hpux11:def:287
# The TFTP daemon must be configured to vendor specifications, including a dedicated TFTP user account, a non-login shell such as /bin/false, and a home directory owned by the TFTP user.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# tftp-server not installed
# inetd_object (inetd_test)
test_1() {
  ! ( cat /etc/inetd.conf &>/dev/null )
}
# tftp user exists
# password_object (password_test)
test_2() {
  getent passwd tftp &>/dev/null
}
# tftp shell /bin/false or equiv
# password_object (password_test)
test_3() {
  (getent passwd 'tftp' | cut -d: -f7) | grep -Pq '^(/bin/false|/dev/null|/usr/bin/false)$'
}
# tftp has a home dir
# password_object (password_test)
test_4() {
  (getent passwd 'tftp' | cut -d: -f6) | grep -Pq '^.+$'
}

if ( test_1 || ( test_2 && test_3 && test_4 ) ); then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# oval:mil.disa.fso.hpux11:def:287

if ! getent passwd tftp >/dev/null 2>&1; then
	echo "PASS"
	exit 0
fi

if ! grep '^tftp:x:[0-9]*:[0-9]*::/usr/bin/false:' /etc/passwd >/dev/null 2>&1; then
	echo "FAIL"
	exit 1
fi

if [ ! -d /home/tftp ]; then
	mkdir /home/tftp
	chown tftp:tftp /home/tftp
fi

if [ ! -d /home/tftp ]; then
	echo "FAIL"
	exit 1
fi

echo "PASS"
exit 0

Remediation

Create a tftp user account if none exists.
Assign a non-login shell to the tftp user account, such as /usr/bin/false.
Assign/create the tftp user account home directory where/as necessary. 
Ensure the home directory is owned by the tftp user.