How to Set Up a TFTP Server on Ubuntu Server with tftpd-hpa

Install Ubuntu’s tftpd-hpa server and tftp-hpa client. This setup serves files from /srv/tftp and keeps uploads in a separate directory. Check the Ubuntu server package and client package listings.

Security: TFTP has no login or encryption. Restrict access to a trusted LAN; reachable clients can read available files and may upload where permissions allow. Do not transfer secrets. The TFTP specification describes its security limits.

Set up the TFTP server

1. Install the server and client

Refresh APT metadata, then install both packages:

sudo apt update
sudo apt install tftpd-hpa tftp-hpa

2. Configure the TFTP root

Edit the package configuration file:

sudo nano /etc/default/tftpd-hpa

Set these values:

TFTP_USERNAME="tftp"
TFTP_DIRECTORY="/srv/tftp"
TFTP_ADDRESS=":69"
TFTP_OPTIONS="--secure --create --umask 027"

--secure confines the daemon to its configured root, --create allows uploads, and --umask 027 limits new upload files to mode 0640. The Ubuntu tftpd manual documents these options. Save with Ctrl+O, press Enter, then Ctrl+X.

Because --secure makes /srv/tftp the client-visible root, filenames are relative to it: use hello.txt, not /srv/tftp/hello.txt. TFTP clients do not browse directories, so keep a list of published filenames and their paths.

3. Create the root and upload directory

Keep the main root owned by root, and give write access only to the upload folder:

sudo install -d -o root -g root -m 0755 /srv/tftp
sudo install -d -o tftp -g tftp -m 0750 /srv/tftp/upload

The daemon can read the root but only the tftp account can write in /srv/tftp/upload. Avoid making the whole tree world-writable with permissions such as 777.

Files in the public root should be treated as readable by every allowed client. Keep that tree limited to boot images, firmware, or other material intended for that network. For private transfers, choose a protocol with authentication and encryption.

4. Add a file to serve

Create a known file in the root. TFTP’s default read checks require served files to be publicly readable, so set mode 0644:

echo 'TFTP test file' | sudo tee /srv/tftp/hello.txt
sudo chmod 0644 /srv/tftp/hello.txt

5. Enable and restart the service

Enable the unit at boot, restart it to apply the settings, and inspect its status:

sudo systemctl enable tftpd-hpa
sudo systemctl restart tftpd-hpa
sudo systemctl status tftpd-hpa --no-pager

If startup fails, check the service log with sudo journalctl -u tftpd-hpa -b --no-pager.

6. Limit firewall access

If UFW is enabled, allow the initial request only from your client subnet. Replace the example network with your trusted LAN range:

sudo ufw allow from 192.168.1.0/24 to any port 69 proto udp
sudo ufw status

See Ubuntu’s UFW guide for source-network rules. TFTP starts on UDP port 69, then uses a server-selected UDP port for file data, as described in the protocol specification. A strict firewall, router, or NAT device may allow the request but block the transfer. If clients time out, use TFTP-aware connection tracking or an appropriate firewall policy; do not open every UDP port or expose TFTP to the internet. This command adds a rule; it does not enable UFW. If you administer the server over SSH and intend to turn on an inactive firewall, allow SSH first to preserve remote access.

Test downloads and uploads

7. Download from an Ubuntu client

On the server, run ip -brief address and note its reachable LAN address. On an Ubuntu client, install the client if needed. Replace 192.0.2.10 below with the real server address:

sudo apt install tftp-hpa
tftp 192.0.2.10
tftp> binary
tftp> get hello.txt
tftp> quit

The file is saved in the client’s current directory. The Ubuntu tftp client manual documents binary and get. Binary mode is recommended for firmware, boot images, and files whose bytes must remain unchanged. Linux filenames are case-sensitive, so enter each remote name exactly.

8. Upload into the restricted folder

On the client, create a test file, then send it to a path under the server’s upload directory:

printf 'Upload test' > upload-check.txt
tftp 192.0.2.10
tftp> binary
tftp> put upload-check.txt upload/upload-check.txt
tftp> quit

Use the server’s actual address. The remote path is relative to /srv/tftp; verify the upload on the server with sudo ls -l /srv/tftp/upload/. TFTP clients use known filenames rather than browsing a directory listing.

Troubleshoot common errors

• File not found: Check the filename relative to /srv/tftp and confirm it exists.
• Access violation: Make served files publicly readable; for uploads, check the tftp ownership of the destination and confirm --create is set.
• Timeout: Confirm the client uses the server’s reachable address, the service is active, and the firewall permits the negotiated UDP data flow.

To isolate a network issue, test from a client on the same LAN first. If that works but a routed client times out, check the router or firewall for TFTP-aware handling of the negotiated data port.

For a read-only service, remove --create from TFTP_OPTIONS and restart tftpd-hpa.