How to debug a launchd daemon ? (tftp)

Question

Level 1

29 points

How to debug a launchd daemon ? (tftp)

I've tried to enable tftpd on xserve (10.6).

Something is listening on port 69, and doing an interactive tftp from another node shows that something acting as tftp is running. But ps -Ac | grep tftp yields nothing on the xserve.

The tftp transfers all yield an access violation.

However, I cannot seem to find where any of the information is logged. I had -d and -l as arguments in the .plist to ensure there was logging, but I couldn't find anything. And without a log file, it is hard to determine what files the tftp server is trying to access with failure.

Do I need to change the syslog.conf file so that it knows about tftp ? Is this why I am not seeing anything ?

Also, from what I read, it is normal that tftpd doesn't appear in a "ps -Ac" output. Is that correct ? (I tried with and without "RunAtLoad" )

I tried the -u argument with a non privileged username. What command need I use to verify that tftpd is im fact running under that username and trying to access files as that username ?

With the following:

/usr/libexec/tftpd -u tftp -l -d -s /private/tftpboot

Is it correct to state that I would need to do a chown tftp /private/tftpboot (and all files below that) because the tftp daemon would try to access those files as that "tftp" username ?

Many since Mac+

Posted on Jan 4, 2010 5:37 AM

Reply

Answer 1

Camelot

Level 9

58,329 points

Jan 4, 2010 10:17 AM in response to JFMezei

If launchd is configured to run a service on a specific port then it's entirely normal for that service (e.g. tftpd) to not appear in the process list. That's because launchd is listening to the port and invokes the service daemon when a connection comes in.
Therefore, unless there's an active tftp (or whatever) connection the daemon won't be running.

However, I cannot seem to find where any of the information is logged

According to the man, tftpd should log to syslog, which means its messages should appear in /var/log/system.log

Do I need to change the syslog.conf file so that it knows about tftp ? Is this why I am not seeing anything ?

Not unless you want the messages to go somewhere other than system.log

Is it correct to state that I would need to do a chown tftp /private/tftpboot (and all files below that) because the tftp daemon would try to access those files as that "tftp" username ?

No. tftp defines that all files must be world-readable in order to be served by tftpd, and that files must exist and be world-writable in order to be written to.

Reply

Answer 2

JFMezei Author

Level 1

29 points

Jan 5, 2010 2:14 AM in response to Camelot

Thanks.

I ended up experimenting a lot with the tftpd.plist file. (found out the documenation for launchd is man launchd.plist

The -u user doesn't work. Isn't allowed to chroot. (-s <directory>)
Same with UserName as a key.

Specifying RootDirectory as a key failed differently (it was unable to find some other file it needs to run).

So, in the end, I ended up back at what is essentially the original plist that runs tftp as root.

Is there a way to run something such as tftp under a specific username, and have it access only files that it owns (as opposed to requiring they be read"writable by the whole world ?

Also, within launchd (or other mechanism) is there a way to limit a service to only connection attempts coming from a local subnet or specific IPs ?

Reply

Answer 3

Camelot

Level 9

58,329 points

Jan 5, 2010 10:36 AM in response to JFMezei

Is there a way to run something such as tftp under a specific username, and have it access only files that it owns (as opposed to requiring they be read"writable by the whole world ?

No - at least not tftpd. That's how tftpd works. There is no authentication element to the tftp protocol - you connect, get a file and go.

From man tftpd:

Due to the lack of authentication information, tftpd will allow only publicly readable files to be accessed.

Also, within launchd (or other mechanism) is there a way to limit a service to only connection attempts coming from a local subnet or specific IPs ?

You could add a SockNodeName parameter to the tftpd.plist file. This tells launchd to bind to a specific IP address (or addresses) which will work for cases where you're multi-homed (i.e. have links to two or more networks and only want to offer tftp on the internal network). If you only have a single interface or need further restrictions you'll need to use the firewall to block traffic from undesired addresses.

Reply