The IBM Aspera Shares private/secret cryptographic keys file must be group-owned by nobody to prevent unauthorized read access.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-252610	ASP4-SH-060230	SV-252610r831515_rule		Medium

Description
Private key data is used to prove that the entity presenting a public key certificate is the certificate's rightful owner. Compromise of private key data allows an adversary to impersonate the key holder.

STIG	Date
IBM Aspera Platform 4.2 Security Technical Implementation Guide	2022-08-24

Details

Check Text ( C-56066r817998_chk )
If the IBM Aspera Shares feature of the Aspera Platform is not installed, this is Not Applicable. Verify the /opt/aspera/shares/u/shares/config/aspera/secret.rb file is group-owned by nobody with the following command: $ sudo stat -c "%G" /opt/aspera/shares/u/shares/config/aspera/secret.rb nobody If "nobody" is not returned as a result, this is a finding.

Fix Text (F-56016r817999_fix)
Configure the /opt/aspera/shares/u/shares/config/aspera/secret.rb file to be group-owned by nobody with the following command: $ sudo chgrp nobody /opt/aspera/shares/u/shares/config/aspera/secret.rb