Is it safe to use TFTP on a local network to backup configurations? For example we had an experiment where there was an attacker using MITM technique to read all traffic destined for a server. On a Cisco switch, a backup was made and copied and sent to the TFTP server but the attacker was able to see the configs. And to make it worse there was no service password encryption command issued.
My question is is there a safe way to transfer for example the config file without it being intercepted?

  • If you're concerned about MITM on your LAN, you should be using IPSEC – Neil McGuigan Apr 2 '16 at 17:08

TFTP is easily observable, here are some options to prevent it to be observed by untrusted party, varying in security effectiveness depending on potential physical access and remote access, and independent or alternative each other:

  • use the console port in cisco (usually RS232 over an RJ45 socket) where you might not have reason to mind of the fact that such traffic is not being encrypted
  • use protocol SFTP instead of TFTP when available
  • isolate the LAN which has TFTP traffic
  • use TFTP toward a server address as close as possible using ssh port forwarding
  • focus on crucial information as the enable password since you define it, and from that point on, always consider what is the flow and in which forms it carries such secret information.
| improve this answer | |

I think you've answered the question yourself mostly: unless there are protections against sniffing inside the network an attacker could be able to see the configuration.

But if this is a problem in your specific environment cannot be decided, because it is unknown if you have protections against sniffing or if the configurations are free from sensitive data.

| improve this answer | |
  • no protection against sniffing. Can u recommend a some or a page with some especially on the local network – Manny265 Apr 2 '16 at 12:36
  • a patchcord will be the best and the simpliest =) – Alexey Vesnin Apr 2 '16 at 15:13
  • @Manny264: protecting your network against sniffing attack would be another big question but unless you encrypt everything it involves restricting which systems have access to the network/ports and restricting what users can do on these systems etc. – Steffen Ullrich Apr 2 '16 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.