The IBM Aspera Console private/secret cryptographic keys file must be owned by root to prevent unauthorized read access.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-252572	ASP4-CS-040250	SV-252572r831497_rule		Medium

Description
Private key data is used to prove that the entity presenting a public key certificate is the certificate's rightful owner. Compromise of private key data allows an adversary to impersonate the key holder.

STIG	Date
IBM Aspera Platform 4.2 Security Technical Implementation Guide	2022-08-24

Details

Check Text ( C-56028r817884_chk )
Verify the /opt/aspera/console/config/secret.yml file is owned by root with the following command: $ sudo stat -c "%U" /opt/aspera/console/config/secret.yml root If "root" is not returned as a result, this is a finding.

Fix Text (F-55978r817885_fix)
Configure the /opt/aspera/console/config/secret.yml file to be owned by root with the following command: $ sudo chown root /opt/aspera/console/config/secret.yml