Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-252648 | ASP4-TS-020320 | SV-252648r831534_rule | Medium |
Description |
---|
Private key data is used to prove that the entity presenting a public key certificate is the certificate's rightful owner. Compromise of private key data allows an adversary to impersonate the key holder. The rootkeystore.db functions as a backup and main source of truth for encrypted secrets. |
STIG | Date |
---|---|
IBM Aspera Platform 4.2 Security Technical Implementation Guide | 2022-08-24 |
Check Text ( C-56104r818112_chk ) |
---|
Verify the rootkeystore.db file has a mode of "0600" or less permissive with the following command: $ sudo stat -c "%a %n" /opt/aspera/etc/rootkeystore.db 600 /opt/aspera/etc/rootkeystore.db If the resulting mode is more permissive than "0600", this is a finding. |
Fix Text (F-56054r818113_fix) |
---|
Configure the rootkeystore.db file to have a mode of "0600" or less permissive with the following command: $ sudo chmod 0600 /opt/aspera/etc/rootkeystore.db |