- Posted In
- Red Hat Enterprise Linux
Hope I'm in the correct place to ask a question like this. Having trouble re-configuring the tftp server on my RHEL 5.8 system. We need to enable tftp on this system in order for an external box to download its firmware, no other option from that vendor to set up their box.
Initial setup with this /etc/xinetd.d/tftp config was fine:
disable = no
socket_type = dgram
protocol = udp
wait = yes
user = root
server = /usr/sbin/in.tftpd
server_args = -s /tftpboot
per_source = 11
cps = 100 2
flags = IPv4
vendor box is able to tftp its files just fine, can do a manual tftp client call from a RHEL 4 box on this network to get files. The /tftpboot directory itself is 0777, files within it are 0555.
Our RHEL 5.8 server needs to adhere to the "Red Hat Enterprise Linux 5 Security Technical Implementation Guide" put out by DISA, and GEN005120 stipulates that the "user" parameter in the config file must not be 'root', it must be a dedicated user. They recommend creating a new 'tftp' user, that has a /bin/false shell. I created such a user and it has these entries in the /etc/passwd and /etc/group files:
Updated the tftp config file in /etc/xinetd.d and changed "user" field from 'root' to 'tftp'. Restarted the daemon. Now when trying to tftp a file to my RHEL 4 box, I see the messages file declare
Jan 21 13:08:45 RIWFSysAftServe in.tftpd: cannot set groups for user nobody
Jan 21 13:08:45 RIWFSysAftServe xinetd: START: tftp pid=19061 from=192.168.10.17
Jan 21 13:08:50 RIWFSysAftServe in.tftpd: cannot set groups for user nobody
and the session exits. From reading other articles have seen that may need to start the daemon as the tftp user. Changed tftp config file line for server_args to
server_args = -s /tftpboot -vvv -u tftp
A tftp attempt from the RHEL 4 machine now results in
Jan 21 13:35:26 RIWFSysAftServe xinetd: START: tftp pid=20225 from=192.168.10.17
Jan 21 13:35:26 RIWFSysAftServe in.tftpd: cannot set groups for user tftp
(line "cannot set groups" always displays 5 times before attempt is aborted).
Next tried making sure files in /tftpboot were owned and group-owned by 'tftp' and tried again. Same results.
I'm probably missing something small here. I've searched on the web quite a bit for this "cannot set groups" error and haven't found anything that helps. Some people say run server as 'root' (which again does work, but won't be accepted by our end customer), others say run it as user 'nobody' and chown the files in /tftpboot to match. We're never trying to 'put' files onto the RHEL 5 server running the tftp daemon, only retrieve them.
thanks for any help/advice.