|
 |
c5edeb |
diff -up tftp-hpa-0.48/tftp-xinetd.tftpboot tftp-hpa-0.48/tftp-xinetd
|
|
|
c5edeb |
--- tftp-hpa-0.48/tftp-xinetd.tftpboot 2007-01-31 00:51:05.000000000 +0100
|
|
|
c5edeb |
+++ tftp-hpa-0.48/tftp-xinetd 2008-05-20 12:05:53.000000000 +0200
|
|
|
c5edeb |
@@ -10,7 +10,7 @@ service tftp
|
|
|
c5edeb |
wait = yes
|
|
|
c5edeb |
user = root
|
|
|
c5edeb |
server = /usr/sbin/in.tftpd
|
|
|
c5edeb |
- server_args = -s /tftpboot
|
|
|
c5edeb |
+ server_args = -s /var/lib/tftpboot
|
|
|
c5edeb |
disable = yes
|
|
|
c5edeb |
per_source = 11
|
|
|
c5edeb |
cps = 100 2
|
|
|
c5edeb |
diff -up tftp-hpa-0.48/README.security.tftpboot tftp-hpa-0.48/README.security
|
|
|
c5edeb |
--- tftp-hpa-0.48/README.security.tftpboot 2008-05-29 17:36:32.000000000 +0200
|
|
|
c5edeb |
+++ tftp-hpa-0.48/README.security 2008-05-29 17:37:21.000000000 +0200
|
|
|
c5edeb |
@@ -17,10 +17,10 @@ probably the following:
|
|
|
c5edeb |
|
|
|
c5edeb |
1. Create a separate "tftpd" user and group only used for tftpd;
|
|
|
c5edeb |
2. Have all your boot files in a single directory tree (usually called
|
|
|
c5edeb |
- /tftpboot).
|
|
|
c5edeb |
-3. Specify "-p -u tftpd -s /tftpboot" on the tftpd command line; if
|
|
|
c5edeb |
+ /var/lib/tftpboot).
|
|
|
c5edeb |
+3. Specify "-p -u tftpd -s /var/lib/tftpboot" on the tftpd command line; if
|
|
|
c5edeb |
you want clients to be able to create files use
|
|
|
c5edeb |
- "-p -c -U 002 -u tftpd -s /tftpboot" (replace 002 with whatever
|
|
|
c5edeb |
+ "-p -c -U 002 -u tftpd -s /var/lib/tftpboot" (replace 002 with whatever
|
|
|
c5edeb |
umask is appropriate for your setup.)
|
|
|
c5edeb |
|
|
|
c5edeb |
=======================================
|
|
|
c5edeb |
@@ -40,12 +40,12 @@ directly. Thus, if your /etc/inetd.conf
|
|
|
c5edeb |
line):
|
|
|
c5edeb |
|
|
|
c5edeb |
tftp dgram udp wait root /usr/sbin/tcpd
|
|
|
c5edeb |
-/usr/sbin/in.tftpd -s /tftpboot -r blksize
|
|
|
c5edeb |
+/usr/sbin/in.tftpd -s /var/lib/tftpboot -r blksize
|
|
|
c5edeb |
|
|
|
c5edeb |
... it's better to change to ...
|
|
|
c5edeb |
|
|
|
c5edeb |
tftp dgram udp wait root /usr/sbin/in.tftpd
|
|
|
c5edeb |
-in.tftpd -s /tftpboot -r blksize
|
|
|
c5edeb |
+in.tftpd -s /var/lib/tftpboot -r blksize
|
|
|
c5edeb |
|
|
|
c5edeb |
You should make sure that you are using "wait" option in tftpd; you
|
|
|
c5edeb |
also need to have tftpd spawned as root in order for chroot (-s) to
|
|
|
c5edeb |
diff -up tftp-hpa-0.48/tftpd/sample.rules.tftpboot tftp-hpa-0.48/tftpd/sample.rules
|
|
|
c5edeb |
--- tftp-hpa-0.48/tftpd/sample.rules.tftpboot 2008-05-29 17:38:46.000000000 +0200
|
|
|
c5edeb |
+++ tftp-hpa-0.48/tftpd/sample.rules 2008-05-29 17:38:05.000000000 +0200
|
|
|
c5edeb |
@@ -30,5 +30,5 @@ rg \\ / # Convert backslashes to slash
|
|
|
c5edeb |
rg \# @ # Convert hash marks to @ signs
|
|
|
c5edeb |
rg /../ /..no../ # Convert /../ to /..no../
|
|
|
c5edeb |
e ^ok/ # These are always ok
|
|
|
c5edeb |
-r ^[^/] /tftpboot/\0 # Convert non-absolute files
|
|
|
c5edeb |
+r ^[^/] /var/lib/tftpboot/\0 # Convert non-absolute files
|
|
|
c5edeb |
a \.pvt$ # Reject requests for private files
|