Synopsis #
OpenBSD includes tftpd(8) and tftp(1) in base. TFTP transfers files over UDP without authentication or encryption. Use a restricted provisioning network.
TFTP Use Cases #
Typical uses include PXE boot and device firmware provisioning. For OpenBSD installation, see Automated Installation and PXE Boot .
Run tftpd #
OpenBSD runs tftpd as a standalone daemon. It chroots to its positional directory argument and drops privileges to _tftpd.
doas install -d -o root -g wheel -m 755 /tftpboot
doas rcctl enable tftpd
doas rcctl set tftpd flags /tftpboot
doas rcctl start tftpd
Use rcctl restart tftpd after changing its flags. The -l address option restricts the listening address; it does not enable logging.
Testing with tftp(1) #
Place a readable file in the serving directory:
doas cp /bsd.rd /tftpboot/bsd.rd
doas chmod 644 /tftpboot/bsd.rd
Then test from another directory or client:
$ tftp localhost
tftp> binary
tftp> get bsd.rd
tftp> quit
Verify the downloaded file against the source. The server must be able to traverse directories and read the file after changing to _tftpd.
PXE Boot Example #
For a legacy BIOS OpenBSD amd64 client, place the matching release’s pxeboot and bsd.rd in /tftpboot. Merge the following into an appropriate DHCP subnet configuration:
next-server 192.0.2.1;
filename "pxeboot";
UEFI clients need the matching EFI bootloader and architecture-specific DHCP selection; see the complete PXE guide.
Firewall Configuration #
Permit requests only from the provisioning network. Merge these rules into the site’s policy, replacing em1 and the subnet:
pass in on em1 inet proto udp from 192.0.2.0/24 to (em1) port 69
pass out on em1 inet proto udp from (em1) to 192.0.2.0/24
UDP port 69 handles the initial request. Transfers use a server-selected UDP port, so a port-69-only policy is insufficient. The outbound rule allows those responses and their stateful replies; constrain the network to trusted provisioning clients.
Logging #
Enable verbose logging with -v:
doas rcctl set tftpd flags -v /tftpboot
doas rcctl restart tftpd
doas tail -f /var/log/daemon
Security Considerations #
Keep the serving directory root-owned and files read-only unless uploads are needed. The chroot is automatic. The -w option permits writes to existing publicly writable files; -c additionally permits creating files, subject to directory permissions:
doas rcctl set tftpd flags -v -w /tftpboot
Do not enable it for a download-only boot server. Existing writable files can be overwritten; check ownership and modes as well as daemon flags.
TFTP Client (tftp(1)) #
Use binary mode for bootloaders and firmware:
$ tftp server.example
tftp> binary
tftp> get firmware.img
tftp> quit
For scripted transfers, feed commands to tftp on standard input and verify the resulting file; a successful connection does not mean the file was transferred.
Alternatives and Enhancements #
Use HTTPS where supported by the boot or provisioning client. For authenticated file transfers, use SFTP or rsync over SSH.