Disable tftp Service
Ensures the unauthenticated tftp.service is disabled and not running so the host does not act as a TFTP server.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
TFTP (Trivial File Transfer Protocol) provides no authentication and no encryption. A running TFTP server lets anyone on the network read or write the served files in cleartext, making it a frequent vector for retrieving configuration, exfiltrating data, or planting malicious payloads. Following the principle of least functionality, the service should be disabled unless a documented, network-restricted need (e.g. PXE boot) exists.
What Pavois checks
Pavois reads the effective unit state via service('tftp.service') (systemctl is-enabled / is-active). TFTP is commonly socket-activated (tftp.socket), so checking the running/enabled unit, including drop-ins, catches an on-demand server that a static file scan of /etc/default/tftpd-hpa would not reveal.
describe service('tftpd-hpa.service') do
it { should_not be_enabled }
it { should_not be_running }
endHow to verify it is applied
Run systemctl is-enabled tftp.service (expect disabled/masked/not found) and systemctl is-active tftp.service (expect inactive). Also check the socket: systemctl is-active tftp.socket and confirm nothing listens on UDP/69 with ss -lunp | grep ':69' (expected: no output).
Inspect & investigate
Service transitions and transfer activity are in journalctl -u tftp.service (and journalctl -u tftp.socket). Listening sockets are confirmed with ss -lunp | grep ':69'. After disabling, no further TFTP request entries should appear.
Remediation
Pavois's harden plan acts on the service resource named tftp: it runs disable and stop so the server does not start at boot and is stopped now. It is applied with pavois harden apply. To fully prevent socket reactivation, also disable/mask tftp.socket and consider removing the tftpd-hpa package.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | disable, stop |
|---|---|
| name | tftpd-hpa.service |
| resource | service |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
The main breakage risk is environments that legitimately rely on TFTP, typically PXE/network boot or network-device firmware provisioning. Precautions: confirm no boot infrastructure, switch/router backups, or imaging workflow depends on this host's TFTP before disabling; if PXE is required, keep TFTP only on the dedicated provisioning server, bind it to the management network, and firewall UDP/69 to authorized clients.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.16 | direct | per OS, see the benchmark table | high |
| NIST | CM-7(a), CM-7(b), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.