Permissions on /srv/tftp may be bad

[cmm-cisco]

https://training.becomingahacker.com/modules/4

Task 2 doesn't work to where nobody:nogroup can write to /srv/tftp. Add chmod 0777 /srv/tftp to runcmd: or make part of the image build if it'll be used with other classes.

Thank you @nweigand for reporting this.

[cmm-cisco]

iosv-r1#copy run tftp://10.1.1.2/iosv-r1.cfg
Address or name of remote host [10.1.1.2]? 
Destination filename [iosv-r1.cfg]? 
  
  !
%Error writing tftp://10.1.1.2/iosv-r1.cfg (Permission denied).....

Even touching the file and setting permissions doesn't help:

root@kali-0:/srv/tftp# touch iosv-r1.cfg
root@kali-0:/srv/tftp# chown nobody:nogroup iosv-r1.cfg
root@kali-0:/srv/tftp# ls -l 
total 0
-rw-r--r-- 1 nobody nogroup 0 Feb 23 16:41 iosv-r1.cfg

root@kali-0:/srv/tftp# ps awwwwwwfux | grep tftp
root      537231  0.0  0.0   6432  2048 ttyS0    S+   16:43   0:00      \_ grep --color=auto tftp
61951     535698  0.0  0.0  77068  2304 ?        Ss   16:40   0:00 /usr/sbin/in.tftpd --port 69 --tftpd-timeout 300 --retry-timeout 5 --mcast-port 1758 --mcast-addr 239.239.239.0-255 --mcast-ttl 1 --maxthread 100 --verbose=5 /srv/tftp

I'm not sure what this user ID 61951 is. Doing some research.

[cmm-cisco]

With /etc/systemd/system/atftpd.service.d/user.conf:

[Service]
User=nobody
Group=nogroup

root@kali-0:~# ps auwx | grep tftp
nobody      4631  0.0  0.0  77068  2176 ?        Ss   19:22   0:00 /usr/sbin/in.tftpd --port 69 --tftpd-timeout 300 --retry-timeout 5 --mcast-port 1758 --mcast-addr 239.239.239.0-255 --mcast-ttl 1 --maxthread 100 --verbose=5 /srv/tftp
...
root@kali-0:~# ls -ld /srv/tftp
drwxrwxrwx 2 nobody nogroup 4096 Jun 26  2024 /srv/tftp

...
[pid  4642] pselect6(1024, [4], NULL, NULL, {tv_sec=5, tv_nsec=0}, NULL) = 1 (in [4], left {tv_sec=4, tv_nsec=994198282})
[pid  4642] recvmsg(4, {msg_name={sa_family=AF_INET6, sin6_port=htons(53620), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::ffff:10.1.1.1", &sin6_addr), sin6_scope_id=0}, msg_namelen=128 => 28, msg_iov=[{iov_base="\0\3\0\1\n!\nversion 15.9\nservice time"..., iov_len=516}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 516
[pid  4642] openat(AT_FDCWD, "/srv/tftp/ios.cfg", O_WRONLY|O_CREAT|O_TRUNC, 0666) = -1 EROFS (Read-only file system)

I'm not sure why its getting EROFS. I don't think I have an apparmor profile for this service. Is that needed? Is this something systemd is doing? Very strange.

[cmm-cisco]

All: We have also identified an issue that is preventing transfer of the router config via tftp in Task 1.2. In order to make this work please run the following commands as root prior to attempting Task 1.2. Then proceed with the lab normally.
• systemctl stop atftpd
• systemctl stop atftpd.socket
• /usr/sbin/in.tftpd --port 69 --tftpd-timeout 300 --retry-timeout 5 --mcast-port 1758 --mcast-addr 239.239.239.0-255 --mcast-ttl 1 --maxthread 100 --verbose=5 --daemon /srv/tftp