Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have many Cisco IP phones that operate in the following manner (oversimplified):

  • Negotiate with DHCP for IP, DNS, TFTP, etc.
  • Look for SEPXXXXXXXXXXXX.cnf.xml configuration file on TFTP server where X is the MAC address of the phone
  • Parse the configuration file to load its configuration and update firmware (also stored on TFTP server) if necessary

The issue here is that I have some phones that need to be put in small offices or peoples' homes. I need to be able to update the configuration files at all times so I can't just preconfigure the phone and send it out. How can I make the TFTP access secure over the internet and prevent someone unauthorized from getting to the configuration files? I know I could do an IP based ACL but this doesn't stop the possibility of someone spoofing the IP.

share|improve this question
If you could tell us the OS and identifying version information, that would be helpful to us in helping you. – mdpc Apr 30 '14 at 18:23
My current TFTP server runs Ubuntu 12.04. I'm not married to a distribution or OS. We're not actually using Call Manager with these phones either. I was hoping there would be some type of attribute attached with the phones GET request that makes it unique and unable to be spoofed and that there would be some type of tftp server option or tftp proxy that could allow or deny requests based on this. I don't think this is the case though. – getsauce Apr 30 '14 at 18:40
An IP based ACL won't protect you against a skilled hacker who can spoof an IP, but it would eliminate a large number of the scripted attacks and is an improvement over the defaults. Reducing the noise will allow you to see the attacks, at least. – Stefan Lasiewski Apr 30 '14 at 18:52
Why simply protect the TFTP...what about the phone calls themselves? Thus protecting the company's intellectual property (IP). – mdpc Apr 30 '14 at 19:44
From wikipedia: "Due to the lack of security, it is dangerous to use it over the Internet. Thus, TFTP is generally only used on private, local networks." – thomasrutter May 1 '14 at 2:47

You would make TFTP access over the internet secure the same way you'd make access to anything over the internet secure. By going through a VPN.

Cisco's IP phones can be set up to use a VPN, and someone even put together a handy doc around common issues with this setup that you might want to take a look at.

share|improve this answer
@getsauce Well, doing it right costs money. If they're not willing to pay for it, they may just have to do without. – HopelessN00b Apr 30 '14 at 18:02
Hmmmm...if you feel that you need a secure TFTP it seems that the phone calls themselves should be protected as well. Thus the VPN solution seems the correct call. I thought there were a few good public domain solutions available here. – mdpc Apr 30 '14 at 19:43
Tough shit for them. Also, you're not putting a router in their office/home. You're putting a Phone Connectivity Device. The only thing behind it should be the phone. – MikeyB May 1 '14 at 18:59
@getsauce Like MikeyB, I am perplexed by this. You'll put a $250 IP phone in someone's home, but you won't put a in a < $50 router to make it secure (and functional)? The hell? – HopelessN00b May 1 '14 at 19:13
@getsauce I'm sorry, but you're being just a little unreasonable here: You've been given several options, from the Right Thing (buy phones that support VPN) to Suboptimal but practical (Ship a VPN router with each). I'm sorry if the answers are not what you wanted to hear, but sometimes the answer is "You can't do what you want", and I think this is one of those times. – voretaq7 May 1 '14 at 22:15

Then you can't do it. You've rejected another protocol that permits authenticating the requestor (hcsteve's answer) and you've rejected a VPN which would have allowed TFTP to be tunneled through an authenticated service (Hopeless N00b.*'s answer), so you're stuck with stock TFTP.

RFC 1350 makes it fairly clear, in section 1, that authentication is not an option:

The only thing [TFTP] can do is read and write files (or mail) from/to a remote server. It cannot list directories, and currently has no provisions for user authentication.

If you insist that the configuration files not be indiscriminately available, you will need to rethink your architecture.

share|improve this answer
hcsteve is talking about authenticating with the SIP proxy. The phone can do that, its getting the configuration file that's the issue with the model phones we're using. The built in VPN doesn't work for me for two basic reasons: you need to preload the configuration file to get the VPN profile (what happens if I need to change the VPN profile?) and you have to use ASA and AnyConnect specifically. I understand auth is not supported by TFTP but I was interested to see if anyone had a creative solution for detecting what devices are requesting files. – getsauce Apr 30 '14 at 20:01
You could put some kind of adaptive firewall in the way, using someting like nmap's OS fingerprinting logic to identify the phones, but that's still eminently spoofable. – MadHatter Apr 30 '14 at 20:02
This is an interesting idea. I know the pfSense project has a feature that can identify OS. I'm not sure if it will work for UDP traffic though. I will investigate further. – getsauce Apr 30 '14 at 20:10

Cisco Small Business (SPA3xx, SPA5xx) phones support provisioning over HTTPS with mutual SSL authentication - the client can authenticate the provisioning server and the server can also authenticate the client based on the client's built-in certificate. That's the way to do it securely over the internet - forget about TFTP. See the full provisioning guide from Cisco - it's way too much info to post here.

share|improve this answer
I'm familiar with the SPA phones. Unfortunately the ones we want to use are the Cisco 8941 model and Cisco 9971 model with video capability. These are configuration file only. – getsauce Apr 30 '14 at 18:45

TFTP over internet is never a good approach. you will run into several problems with firewalls,NAT, and timeout related aborted transfers. Considering your constraints probably you should think of securely distributing (i.e. a password protected download) the phone configuration file with a small footprint portable TFTP server; then when the update is required the being updated phone will find a locally hosted TFTP server with the reqd conf file.

share|improve this answer
I considered this as well. For any small offices, having a Raspberry Pi or something small just serving TFTP would work well. I would need to be able to access all these boxes to update files which I think I could achieve using reverse SSH tunnels. – getsauce May 1 '14 at 14:15
once you decided to run a local TFTP you have several options; probably a scheduled check on new configuration file is a simpler approach than prepping your remote locations for external SSH access. – Pat May 1 '14 at 19:19

Ask this question: how does Vonage do it? If you do something for money, you better have some security in place. I'm sure they upgrade infrastructure all the time.

If your not to concerned about security within the employees home, a router set up to connect to the company's VPN might be useful. Connect your IP phone to that.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.