Uninstall tftp-server Package
Ensures the tftp-server package is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
tftp-server exposes a Trivial FTP listener with no authentication and no encryption, letting remote clients read or write files over an insecure channel, a classic vector for exfiltration and unauthorized file delivery. Removing it prevents accidental or intentional activation. If TFTP is genuinely required (e.g. router config delivery), its use must be documented, restricted to authorized personnel, and access-controlled.
What Pavois checks
Pavois verifies that the tftp-server package is absent from the package database. A present server binary can be (re)started to expose an unauthenticated file-transfer port, so the package query is the authoritative signal regardless of current unit/inetd state.
describe package('tftpd-hpa') do
it { should_not be_installed }
endHow to verify it is applied
On RHEL-family run rpm -q tftp-server and expect package tftp-server is not installed. Optionally confirm nothing listens on UDP/69 with ss -lnup | grep ':69' (no output).
Inspect & investigate
Removal is recorded by the package manager: dnf history / rpm -q --last tftp-server (RHEL) or grep tftp /var/log/dpkg.log (Debian/Ubuntu). Past TFTP transfers, if the service ran, appear in journalctl -u tftp or /var/log/messages.
Remediation
Pavois's harden plan declares the tftp-server package resource with action remove, so pavois harden apply uninstalls it via the system package manager (dnf/apt).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | tftpd-hpa |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
An installed tftp-server is an unauthenticated file service that can be abused for exfiltration or malware drop. Precaution before applying: if this host is a legitimate PXE/network-boot or appliance-config server, removal will break those workflows, keep the package only with documented, access-controlled justification; otherwise removal is the safe default.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R62 | direct | 2.0 | high |
| CIS | 2.1.16, 2.2.4, 2.1.17 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.4 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.