Technical data

Configuring TFTP
10.3 TFTP Security
10.3 TFTP Security
For security purposes, the server runs as an unprivileged image that can access
only the directories and files for which it has read access.
Compaq recommends that you safeguard your system’s normal file protection
mechanisms from unauthorized TFTP access. In particular, ensure the security of
system files.
A client’s download request can use one of several formats for its file name
specification:
• If the unprivileged TFTP server has read access to the requested file, the
client uses a fully qualified file name, including the device, directory, name,
and extension, to directly access the file.
• If the client specifies only the file name and extension, the TFTP server
attempts to locate the file in the default TFTP directory tree.
You can designate this directory tree with the system logical name
TCPIP$TFTP_ROOT:. This is a concealed device name, usually pointing
to the directory SYS$SYSDEVICE:[TCPIP$TFTP_ROOT]. When looking for a
directory, the TFTP server looks first in the TCPIP$TFTP_ROOT: area with
the same name as the requesting client’s host name.
For example, if a client named GULL.SHORE.COM sends a read request
for the file SERVICE.DAT, the server’s first attempt to find the file is in
TCPIP$TFTP_ROOT:[GULL]. If that directory does not exist, the server
next looks in the TCPIP$TFTP_ROOT: root directory, for example, in
TCPIP$TFTP_ROOT:[000000]SERVICE.DAT.
If the TFTP client requests a file by specifying a name in UNIX format (for
example,
/etc/gull/myfile ), TFTP translates this file specification into
OpenVMS format.
The TFTP server runs as the nonprivileged OpenVMS user accounts
TCPIP$TFTP. When you set up TFTP, follow these security procedures:
• Ensure that neither server has automatic access to any files.
To make files accessible to the TFTP server, grant appropriate access to its
account. Use the normal OpenVMS file protection procedures. For example,
enter the DCL command DIRECTORY/SECURITY.
• Prevent unauthorized access to sensitive system or user data. Before you
enable TFTP, ensure that you have set up all the necessary file protections.
• Give the TCPIP$TFTP user account read access to the files in the
TCPIP$TFTP_ROOT: directory tree that might be used for downloading.
10.4 Solving TFTP Problems
The TFTP server is restricted to accessing only files or directories that OpenVMS
file system security measures allow. Verify that these files have the appropriate
protection and ownership so that the TFTP server has access to them. See
Section 10.3 for more information.
• Ensure that the TFTP server has access to directories and files. Set
protections accordingly.
• Create the target files to enable TFTP to reply to write requests.
10–4 Configuring TFTP