2

I need to find out which tftp server/daemon is running, in order to edit it's configurations and view the error log.

I found out that there's a service of tftpd running:

# netstat -tupln | grep ftp
udp        0      0 0.0.0.0:69              0.0.0.0:*                           7915/in.tftpd
# ps aux | grep ftp
root      7915  0.0  0.0   2704   296 ?        Ss   22:10   0:00 /usr/sbin/in.tftpd --listen --user tftp --address 0.0.0.0:69 --secure /tftpboot

I've tried to edit it's configurations (notice the username nobody):

# nano /etc/xinetd.d/tftp
# cat /etc/xinetd.d/tftp
service tftp
{
protocol        = udp
port            = 69
socket_type     = dgram
wait            = yes
user            = nobody
server          = /usr/sbin/in.tftpd
server_args     = -v -s /tftpboot
disable         = no
}

But when restarting the tftpd, nothing changes:

# kill 7915
# ps aux | grep ftp
root     16815  0.0  0.0   2704   124 ?        Ss   22:31   0:00 /usr/sbin/in.tftpd --listen --user tftp --address 0.0.0.0:69 --secure /tftpboot

So I've tried to edit the other configuration file:

# nano /etc/inetd.conf
# cat /etc/inetd.conf
# /etc/inetd.conf:  see inetd(8) for further informations.
#
# Internet superserver configuration database
#
#
# Lines starting with "#:LABEL:" or "#<off>#" should not
# be changed unless you know what you are doing!
#
# If you want to disable an entry so it isn't touched during
# package updates just comment it out with a single '#' character.
#
# Packages should modify this file by using update-inetd(8)
#
# <service_name> <sock_type> <proto> <flags> <user> <server_path> <args>
#
#:INTERNAL: Internal services
#discard                stream  tcp     nowait  root    internal
#discard                dgram   udp     wait    root    internal
#daytime                stream  tcp     nowait  root    internal
#time           stream  tcp     nowait  root    internal

#:STANDARD: These are standard services.

#:BSD: Shell, login, exec and talk are BSD protocols.

#:MAIL: Mail, news and uucp services.

#:INFO: Info services

#:BOOT: TFTP service is provided primarily for booting.  Most sites
#       run this only on machines acting as "boot servers."
tftp            dgram   udp4    wait    nobody /usr/sbin/tcpd /usr/sbin/in.tftpd --tftpd-timeout 300 --retry-timeout 5 --mcast-port 1758 --mcast-addr 239.239.239.0-255 --mcast-ttl 1 --maxthread 100 --verbose=5 /tftpboot

#:RPC: RPC based services

#:HAM-RADIO: amateur-radio services

#:OTHER: Other services

And then tried to restart:

# kill 16815
# ps aux | grep ftp
root     18287  0.0  0.0   2704   120 ?        Ss   22:34   0:00 /usr/sbin/in.tftpd --listen --user tftp --address 0.0.0.0:69 --secure /tftpboot

But as you can see, nothing has changed.

I've trimmed the above output for better readability.

So how can I tell which tftp daemon is being executed and what are the config file & error log?


Edit #1 (21 January 2014, 07:33 UTC):
Response to the commentor @"Mark Plotnick"

# ps -efl|grep tftp
1 S root     18287     1  0  80   0 -   676 poll_s Jan20 ?        00:00:00 /usr/sbin/in.tftpd --listen --user tftp --address 0.0.0.0:69 --secure /tftpboot
0 S root     19271 10638  0  80   0 -  1097 pipe_w 11:36 pts/1    00:00:00 grep --color=auto tftp
# ps -p 1
  PID TTY          TIME CMD
    1 ?        00:00:03 init

Response to the responder @"slm"

I've executed the commands you wrote after importing them to Ubuntu 12.04:

# dpkg --list | grep tftp
ii  atftp                                        0.7.dfsg-11                                      advanced TFTP client
ii  tftp                                         0.17-18ubuntu2                                   Trivial file transfer protocol client
rc  tftpd                                        0.17-18ubuntu2                                   Trivial file transfer protocol server
ii  tftpd-hpa                                    5.2-1ubuntu1                                     HPA's tftp server
# dpkg --listfiles tftpd-hpa
/.
/usr
/usr/sbin
/usr/sbin/in.tftpd
/usr/share
/usr/share/man
/usr/share/man/man8
/usr/share/man/man8/in.tftpd.8.gz
/usr/share/doc
/usr/share/doc/tftpd-hpa
/usr/share/doc/tftpd-hpa/README
/usr/share/doc/tftpd-hpa/README.security
/usr/share/doc/tftpd-hpa/README.Debian
/usr/share/doc/tftpd-hpa/copyright
/usr/share/doc/tftpd-hpa/examples
/usr/share/doc/tftpd-hpa/examples/sample.rules
/usr/share/doc/tftpd-hpa/examples/tftpd-hpa.preseed
/usr/share/doc/tftpd-hpa/changelog.Debian.gz
/usr/share/lintian
/usr/share/lintian/overrides
/usr/share/lintian/overrides/tftpd-hpa
/etc
/etc/init
/etc/init/tftpd-hpa.conf
/etc/init.d
/usr/share/man/man8/tftpd.8.gz
/etc/init.d/tftpd-hpa
# dpkg --status tftpd-hpa
Package: tftpd-hpa
Status: install ok installed
Priority: extra
Section: net
Installed-Size: 137
Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
Architecture: i386
Source: tftp-hpa
Version: 5.2-1ubuntu1
Depends: debconf (>= 0.5) | debconf-2.0, upstart-job, libc6 (>= 2.11), libwrap0 (>= 7.6-4~), adduser
Suggests: syslinux-common
Conflicts: atftpd, tftpd
Conffiles:
 /etc/init/tftpd-hpa.conf 3647737c313ad1968b8463388ded2d26
Description: HPA's tftp server
 Trivial File Transfer Protocol (TFTP) is a file transfer protocol, mainly to
 serve boot images over the network to other machines (PXE).
 .
 tftp-hpa is an enhanced version of the BSD TFTP client and server. It
 possesses a number of bugfixes and enhancements over the original.
 .
 This package contains the server.
Homepage: http://www.kernel.org/pub/software/network/tftp/
Original-Maintainer: Daniel Baumann <daniel.baumann@progress-technologies.net>
# /usr/sbin/in.tftpd --version
tftp-hpa 5.2, with remap, with tcpwrappers
# sudo lsof -p $(pgrep -n "in.tftpd")
lsof: WARNING: can't stat() fuse.gvfs-fuse-daemon file system /home/tlvlab/.gvfs
      Output information may be incomplete.
COMMAND    PID USER   FD   TYPE     DEVICE SIZE/OFF     NODE NAME
in.tftpd 18287 root  cwd    DIR       0,20        0  9575553 /
in.tftpd 18287 root  rtd    DIR        8,1     4096        2 /
in.tftpd 18287 root  txt    REG        8,1    35008   270805 /usr/sbin/in.tftpd
in.tftpd 18287 root  mem    REG        8,1    47040 28836074 /lib/i386-linux-gnu/libnss_files-2.15.so
in.tftpd 18287 root  mem    REG        8,1    42652 28836073 /lib/i386-linux-gnu/libnss_nis-2.15.so
in.tftpd 18287 root  mem    REG        8,1    30520 28836075 /lib/i386-linux-gnu/libnss_compat-2.15.so
in.tftpd 18287 root  mem    REG        8,1    92016 28836060 /lib/i386-linux-gnu/libnsl-2.15.so
in.tftpd 18287 root  mem    REG        8,1  1734120 28836077 /lib/i386-linux-gnu/libc-2.15.so
in.tftpd 18287 root  mem    REG        8,1    35032 28836781 /lib/i386-linux-gnu/libwrap.so.0.7.6
in.tftpd 18287 root  mem    REG        8,1   134344 28836067 /lib/i386-linux-gnu/ld-2.15.so
in.tftpd 18287 root    0u   CHR        1,3      0t0     1029 /dev/null
in.tftpd 18287 root    1u   CHR        1,3      0t0     1029 /dev/null
in.tftpd 18287 root    2u   CHR        1,3      0t0     1029 /dev/null
in.tftpd 18287 root    3u  unix 0xf0030d80      0t0  2154638 socket
in.tftpd 18287 root    4u  IPv4    2154641      0t0      UDP *:tftp

Probably the path to log file is /var/log/syslog (file /etc/syslog.conf doesn't exist).

  • 1
    run ps -efl|grep tftp, look at the pid in the fifth column, run ps -p n, where n is that pid. Tell us that cmd line. That is the parent process of tftp. – Mark Plotnick Jan 20 '14 at 18:46
  • What's the distro? – slm Jan 20 '14 at 19:09
  • @MarkPlotnick: It seems that the parent process is init, see my edit – Dor Jan 21 '14 at 7:48
3

This setup of tftpd is being managed by the super server xinetd. So the configuration files you're listing are the ones for the setting up of tftpd as a service provided by xinetd.

I'm using Fedora 19 but a similar approach with other distro's package managers can be carried out with similar results.

What's the name of tftpd's package?

Using RPM this is pretty simple to find out.

$ rpm -qa | grep tftp
tftp-server-0.49-2.el5.centos

So on CentOS 5.x, the package is called `tftp-server. It also shows the version but we'll get to that in a second.

What files are included in installation?

Another easy one with a package manager's assistance.

$ rpm -ql tftp-server
/etc/xinetd.d/tftp
/tftpboot
/usr/sbin/in.tftpd
/usr/share/man/man8/in.tftpd.8.gz
/usr/share/man/man8/tftpd.8.gz

NOTE: That there is no other configuration file, so all the configuration for this version of tftpd is done via the command line. This is important to notice, since that's telling us that we'll have to change tftpd in the xinetd service file, /etc/xinetd.d/tftp. Also notice that tftpd has a man page, which will prove helpful if we're not sure what switches to set/unset too.

What's the version?

You can get this info a couple of ways. The easiest is to grok it from the package manager.

$ rpm -qi tftp-server
Name        : tftp-server                  Relocations: (not relocatable)
Version     : 0.49                              Vendor: CentOS
Release     : 2.el5.centos                  Build Date: Sat 26 Sep 2009 12:28:27 PM EDT
...

We can often times also get it from the tool itself.

$ /usr/sbin/in.tftpd --version
tftp-hpa 0.49, with remap, with tcpwrappers

The man page

One switch that's worth noting is the verbosity switch.

   --verbose, -v
          Increase  the  logging  verbosity  of tftpd.  This flag can be 
          specified multiple times for even higher verbosity.

So you could add more -v switches to get more verbose output in the logs, specifically these lines:

server          = /usr/sbin/in.tftpd
server_args     = -s /tftpboot -vv

Logging?

Looking through the man page there doesn't appear to be any additional switches beyond the verbosity switches. So given this, and the fact that this is a xinetd service, the logging is likely in the default syslog logs, /var/log/messages on CentOS. On other distros (Debian/Ubuntu) this file is typically called /var/log/syslog.

You can see where syslog logs to my taking a peak at its configuration file, more /etc/syslog.conf.

What else?

You can also in a pinch use lsof to find out what files a particular process is making use of. So you might be able to find out what configuration files a given process is using through this method. Though often a daemon will open the config, read it, and then close it, but you might also get luck too.

Also with services that are started on demand, as is the case with xinetd based services, these typically are not running, until someone attempts to access them, so there's likely no process to even interrogate.

Here's an example of httpd (that's Apache) just for effect.

$ sudo lsof -p $(pgrep -n http) | head -7
COMMAND  PID   USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
httpd   3832 apache  cwd    DIR  252,0     4096       2 /
httpd   3832 apache  rtd    DIR  252,0     4096       2 /
httpd   3832 apache  txt    REG  252,0   332264 1355575 /usr/sbin/httpd
httpd   3832 apache  mem    REG  252,0   144776 2031805 /lib64/ld-2.5.so
httpd   3832 apache  mem    REG  252,0   614992 3473627 /lib64/libm-2.5.so
httpd   3832 apache  mem    REG  252,0   129984 2031683 /lib64/libpcre.so.0.0.1
  • I've used the RPM commands by importing them to Ubuntu (see my edit) and managed to find out the server's config file, thank you! :) – Dor Jan 21 '14 at 7:43
  • @Dor - great. I took a bit of a gamble but I figured showing you this way would at least give you a rough idea of what's going on. Glad you were able to resolve your issue and thanks for the Q. – slm Jan 21 '14 at 7:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.