The IBM Aspera Console private/secret cryptographic keys file must be group-owned by root to prevent unauthorized read access.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-252571	ASP4-CS-040240	SV-252571r831496_rule		Medium

Description
Private key data is used to prove that the entity presenting a public key certificate is the certificate's rightful owner. Compromise of private key data allows an adversary to impersonate the key holder.

STIG	Date
IBM Aspera Platform 4.2 Security Technical Implementation Guide	2022-08-24

Details

Check Text ( C-56027r817881_chk )
Verify the /opt/aspera/console/config/secret.yml file is group-owned by root with the following command: $ sudo stat -c "%G" /opt/aspera/console/config/secret.yml root If "root" is not returned as a result, this is a finding.

Fix Text (F-55977r817882_fix)
Configure the /opt/aspera/console/config/secret.yml file to be group-owned by root with the following command: $ sudo chgrp root /opt/aspera/console/config/secret.yml