STIGQter STIGQter: STIG Summary: Red Hat Enterprise Linux 9 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

The Trivial File Transfer Protocol (TFTP) server must not be installed unless it is required, and if required, the RHEL 9 TFTP daemon must be configured to operate in secure mode.

DISA Rule

SV-257835r1155679_rule

Vulnerability Number

V-257835

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

RHEL-09-215060

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Configure RHEL 9 so that TFTP operates in secure mode if installed.

If TFTP server is not required, remove it with the following command:
$ sudo dnf -y remove tftp-server

Configure the TFTP daemon to operate in secure mode with the following command:
$ sudo systemctl edit tftp.service

In the editor, enter:
[Service]
ExecStart=/usr/sbin/in.tftpd -s /var/lib/tftpboot

After making changes, reload the systemd daemon and restart the TFTP service as follows:

$ sudo systemctl daemon-reload
$ sudo systemctl restart tftp.service

If the "-s" option is not present in the "ExecStart" line or if the line is missing, this is a finding.

Check Contents

Verify if TFTP is installed, it is configured to operate in secure mode.

Note: If TFTP is not required, it must not be installed. If TFTP is not installed, this rule is not applicable.

Check to see if TFTP server is installed with the following command:

$ sudo dnf list --installed tftp-server

Updating Subscription Management repositories.
Installed Packages
tftp-server.x86_64 5.2-38.el9 @rhel-9-for-x86_64-appstream-rpms

Verify the TFTP daemon, if tftp.server is installed, is configured to operate in secure mode with the following command:

$ grep -i execstart /usr/lib/systemd/system/tftp.service
ExecStart=/usr/sbin/in.tftpd -s /var/lib/tftpboot

Note: The "-s" option ensures the TFTP server only serves files from the specified directory, which is a security measure to prevent unauthorized access to other parts of the file system.

Vulnerability Number

V-257835

Documentable

False

Rule Version

RHEL-09-215060

Severity Override Guidance

Verify if TFTP is installed, it is configured to operate in secure mode.

Note: If TFTP is not required, it must not be installed. If TFTP is not installed, this rule is not applicable.

Check to see if TFTP server is installed with the following command:

$ sudo dnf list --installed tftp-server

Updating Subscription Management repositories.
Installed Packages
tftp-server.x86_64 5.2-38.el9 @rhel-9-for-x86_64-appstream-rpms

Verify the TFTP daemon, if tftp.server is installed, is configured to operate in secure mode with the following command:

$ grep -i execstart /usr/lib/systemd/system/tftp.service
ExecStart=/usr/sbin/in.tftpd -s /var/lib/tftpboot

Note: The "-s" option ensures the TFTP server only serves files from the specified directory, which is a security measure to prevent unauthorized access to other parts of the file system.

Check Content Reference

M

Target Key

5551