1TFTPD(8) System Manager's Manual TFTPD(8)
2
6 tftpd - IPv4 Trivial File Transfer Protocol server
7
9 in.tftpd [options...] directory...
10
12 tftpd is a server for the IPv4 Trivial File Transfer Protocol. The
13 TFTP protocol is extensively used to support remote booting of diskless
14 devices. The server is normally started by inetd, but can also run
15 standalone.
16
18 -l Run the server in standalone (listen) mode, rather than run from
19 inetd. In listen mode, the -t option is ignored, and the -a
20 option can be used to specify a specific local address or port
21 to listen to.
22 -a [address][:port]
24 Specify a specific address and port to listen to when called
25 with the -l option. The default is to listen to the tftp port
26 specified in /etc/services on all local addresses.
27 -c Allow new files to be created. By default, tftpd will only
29 allow upload of files that already exist. Files are created
30 with default permissions allowing anyone to read or write them,
31 unless the -p or -U options are specified.
32 -s Change root directory on startup. This means the remote host
34 does not need to pass along the directory as part of the trans‐
35 fer, and may add security. When -s is specified, exactly one
36 directory should be specified on the command line. The use of
37 this option is recommended for security as well as compatibility
38 with some boot ROMs which cannot be easily made to include a
39 directory name in its request.
40 -u username
42 Specify the username which tftpd will run as; the default is
43 "nobody". The user ID, group ID, and (if possible on the plat‐
44 form) the supplementary group IDs will be set to the ones speci‐
45 fied in the system permission database for this username.
46 -U umask
48 Sets the umask for newly created files to the specified value.
49 The default is zero (anyone can read or write) if the -p option
50 is not specified, or inherited from the invoking process if -p
51 is specified.
52 -p Perform no additional permissions checks above the normal sys‐
54 tem-provided access controls for the user specified via the -u
55 option.
56 -t timeout
58 When run from inetd this specifies how long, in seconds, to wait
59 for a second connection before terminating the server. inetd
60 will then respawn the server when another request comes in. The
61 default is 900 (15 minutes.)
62 -T timeout
64 Determine the default timeout, in microseconds, before the first
65 packet is retransmitted. This can be modified by the client if
66 the timeout or utimeout option is negotiated. The default is
67 1000000 (1 second.)
68 -m remap-file
70 Specify the use of filename remapping. The remap-file is a file
71 containing the remapping rules. See the section on filename
72 remapping below. This option may not be compiled in, see the
73 output of in.tftpd -V to verify whether or not it is available.
74 -v Increase the logging verbosity of tftpd. This flag can be spec‐
76 ified multiple times for even higher verbosity.
77 -r tftp-option
79 Indicate that a specific RFC 2347 TFTP option should never be
80 accepted.
81 -B max-block-size
83 Specifies the maximum permitted block size. The permitted range
84 for this parameter is from 512 to 65464. Some embedded clients
85 request large block sizes and yet do not handle fragmented pack‐
86 ets correctly; for these clients, it is recommended to set this
87 value to the smallest MTU on your network minus 32 bytes (20
88 bytes for IP, 8 for UDP, and 4 for TFTP; less if you use IP
89 options on your network.) For example, on a standard Ethernet
90 (MTU 1500) a value of 1468 is reasonable.
91 -R port:port
93 Force the server port number (the Transaction ID) to be in the
94 specified range of port numbers.
95 -V Print the version number and configuration to standard output,
97 then exit gracefully.
98
100 This version of tftpd supports RFC 2347 option negotation. Currently
101 implemented options are:
102 blksize (RFC 2348)
104 Set the transfer block size to anything less than or equal to
105 the specified option. This version of tftpd can support any
106 block size up to the theoretical maximum of 65464 bytes.
107 blksize2 (nonstandard)
109 Set the transfer block size to anything less than or equal to
110 the specified option, but restrict the possible responses to
111 powers of 2. The maximum is 32768 bytes (the largest power of 2
112 less than or equal to 65464.)
113 tsize (RFC 2349)
115 Report the size of the file that is about to be transferred.
116 This version of tftpd only supports the tsize option for binary
117 (octet) mode transfers.
118 timeout (RFC 2349)
120 Set the time before the server retransmits a packet, in seconds.
121 utimeout (nonstandard)
123 Set the time before the server retransmits a packet, in
124 microseconds.
125 The -r option can be used to disable specific options; this may be nec‐
127 essary to work around bugs in specific TFTP client implementations.
128 For example, some TFTP clients have been found to request the blksize
129 option, but crash with an error if they actually get the option
130 accepted by the server.
131
133 The -m option specifies a file which contains filename remapping rules.
134 Each non-comment line (comments begin with hash marks, #) contains an
135 operation, specified below; a regex, a regular expression in the style
136 of egrep; and optionally a replacement pattern. The operation indi‐
137 cated by operation is performed if the regex matches all or part of the
138 filename. Rules are processed from the top down, and by default, all
139 rules are processed even if there is a match.
140 The operation can be any combination of the following letters:
142 r Replace the substring matched by regex by the replacement pat‐
144 tern. The replacement pattern may contain escape sequences; see
145 below.
146 g Repeat this rule until it no longer matches. This is always
148 used with r.
149 i Match the regex case-insensitively. By default it is case sen‐
151 sitive.
152 e If this rule matches, end rule processing after executing the
154 rule.
155 s If this rule matches, start rule processing over from the very
157 first rule after executing this rule.
158 a If this rule matches, refuse the request and send an access
160 denied error to the client.
161 G This rule applies to GET (RRQ) requests only.
163 P This rule applies to PUT (WRQ) requests only.
165 ~ Inverse the sense of this rule, i.e. execute the operation only
167 if the regex doesn't match. Cannot used together with r.
168 The following escape sequences are recognized as part of the replace‐
170 ment pattern:
171 \0 The entire string matched by the regex.
173 \1 to \9
175 The strings matched by each of the first nine parenthesized sub‐
176 expressions, \( ... \), of the regex pattern.
177 \i The IP address of the requesting host, in dotted-quad notation
179 (e.g. 192.0.2.169).
180 \x The IP address of the requesting host, in hexadecimal notation
182 (e.g. C00002A9).
183 \\ Literal backslash.
185 \whitespace
187 Literal whitespace.
188 \# Literal hash mark.
190 \U Turns all subsequent letters to upper case.
192 \L Turns all subsequent letters to lower case.
194 \E Cancels the effect of \U or \L.
196 If the mapping file is changed, you need to send SIGHUP to any out‐
198 standing tftpd process.
199
201 The use of TFTP services does not require an account or password on the
202 server system. Due to the lack of authentication information, tftpd
203 will allow only publicly readable files (o+r) to be accessed, unless
204 the -p option is specified. Files may be written only if they already
205 exist and are publicly writable, unless the -c option is specified.
206 Note that this extends the concept of ``public'' to include all users
207 on all hosts that can be reached through the network; this may not be
208 appropriate on all systems, and its implications should be considered
209 before enabling TFTP service. Typically, some kind of firewall or
210 packet-filter solution should be employed. If appropriately compiled
211 (see the output of in.tftpd -V) tftpd will query the hosts_access(5)
212 database for access control information. This may be slow; sites
213 requiring maximum performance may want to compile without this option
214 and rely on firewalling or kernel-based packet filters instead.
215 The server should be set to run as the user with the lowest possible
217 privilege; please see the -u flag. It is probably a good idea to set
218 up a specific user account for tftpd, rather than letting it run as
219 "nobody", to guard against privilege leaks between applications.
220 Access to files can, and should, be restricted by invoking tftpd with a
222 list of directories by including pathnames as server program arguments
223 on the command line. In this case access is restricted to files whole
224 names are prefixed by one of the given directories. If possible, it is
225 recommended that the -s flag is used to set up a chroot() environment
226 for the server to run in once a connection has been set up.
227 Finally, the filename remapping (-m flag) support can be used to pro‐
229 vide a limited amount of additional access control.
230
232 RFC 1123, Requirements for Internet Hosts - Application and Support.
233 RFC 1350, The TFTP Protocol (revision 2).
234 RFC 2347, TFTP Option Extension.
235 RFC 2348, TFTP Blocksize Option.
236 RFC 2349, TFTP Timeout Interval and Transfer Size Options.
237
239 This version of tftpd is maintained by H. Peter Anvin <hpa@zytor.com>.
240 It was derived from, but has substantially diverged from, an OpenBSD
241 source base, with added patches by Markus Gutschke and Gero Kulhman.
242
244 tftp(1), egrep(1), umask(2), hosts_access(5), regex(7), inetd(8).
245tftp-hpa 0.42 16 February 2006 TFTPD(8)