Remove tftp Daemon
Ensures the tftp client package is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The tftp client speaks Trivial FTP, a UDP file-transfer protocol with no authentication and no encryption. Keeping it lets users fetch or push files over an insecure channel. Unless a specific need exists (e.g. a boot/PXE server), removing it reduces the attack surface.
What Pavois checks
Pavois verifies that the tftp package is absent from the package database. The presence of the client binary is the relevant exposure, so querying the package manager directly is the authoritative signal.
describe package('tftp') do
it { should_not be_installed }
endHow to verify it is applied
On Debian/Ubuntu run dpkg -s tftp and expect package 'tftp' is not installed; on RHEL-family run rpm -q tftp and expect package tftp is not installed.
Inspect & investigate
Removal is recorded by the package manager: grep tftp /var/log/dpkg.log (Debian/Ubuntu) or dnf history / rpm -q --last tftp (RHEL family).
Remediation
Pavois's harden plan declares the tftp package resource with action remove, so pavois harden apply uninstalls the client via the system package manager (apt/dnf).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | tftp |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing the tftp client is low-risk on most servers. Precaution: PXE provisioning, network-boot tooling, and some appliance/firmware update workflows fetch files over TFTP; if any operational task uses the tftp client, replace it with an authenticated/encrypted transfer (SCP/SFTP/HTTPS) before removing the package.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R62 | direct | 2.0 | high |
| CIS | 2.2.4, 2.2.5 | direct | per OS, see the benchmark table | high |
| PCI DSS | 2.2.4 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.