🚀 go-pugleaf

todd@Quotron.COM (Todd Booth) writes:


>A common mistake is not to enable tftp in /etc/inet.conf
>which should read something like the following

>tftp    dgram   udp     wait    bin     /etc/tftpd      tftpd

>Be sure and wake up inetd to this fact - kill -1 ...

If you are on a machine which is reachable from the Internet, and
don't have shadow password files, this donates /etc/passwd to anyone
who wants it.

On SunOS, a better idea is:
tftp   dgram   udp     wait    root    /usr/etc/in.tftpd       in.tftpd -s /tft
pboot

which does a chroot to /tftpboot on startup. Remember that this changes
the client's view of the filesystem.

If your tftp daemon doesn't have this, then you can use the wrapper
program:

#include <stdio.h>

main(argc, argv)
char **argv;
{
	if(argc != 2) {
		fprintf(stderr, "Usage: %s directory\n", argv[0]);
		exit(1);
	}
	if(chdir(argv[1]) < 0) {
		perror(argv[1]);
		exit(1);
	}
	if(chroot(".") < 0) {
		perror(argv[1]);
		exit(1);
	}
	execl("/etc/tftpd", "tftpd", 0);
	perror("/etc/tftpd");
	exit(1);
}

Install this as /etc/tftpd.chroot, or similar, copy /etc/tftpd to
/tftpboot/etc/tftpd (remember that the chroot() changes the program's view
of the filesystem), do chmod 700 /tftpboot/etc/tftpd, and use

tftp    dgram   udp     wait    bin     /etc/tftpd.chroot      tftpd /tftpboot

in inetd.conf.

Naturally, you can also use directories other than /tftpboot. Remember
that the directory named will appear to be "/" to any clients.


--
Peter Lamb
uucp:  uunet!mcsun!ethz!prl	eunet: prl@iis.ethz.ch	Tel:   +411 256 5241
Integrated Systems Laboratory
ETH-Zentrum, 8092 Zurich