STIGhubSTIGhub
STIGsRMF ControlsCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • RMF Controls
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated just now
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to IBM Aspera Platform 4.2 Security Technical Implementation Guide

V-252610

CAT II (Medium)

The IBM Aspera Shares private/secret cryptographic keys file must be group-owned by nobody to prevent unauthorized read access.

Rule ID

SV-252610r831515_rule

STIG

IBM Aspera Platform 4.2 Security Technical Implementation Guide

Version

V1R3

CCIs

CCI-002165

Discussion

Private key data is used to prove that the entity presenting a public key certificate is the certificate's rightful owner. Compromise of private key data allows an adversary to impersonate the key holder.

Check Content

If the IBM Aspera Shares feature of the Aspera Platform is not installed, this is Not Applicable.

Verify the /opt/aspera/shares/u/shares/config/aspera/secret.rb file is group-owned by nobody with the following command:

$ sudo stat -c "%G" /opt/aspera/shares/u/shares/config/aspera/secret.rb

nobody

If "nobody" is not returned as a result, this is a finding.

Fix Text

Configure the /opt/aspera/shares/u/shares/config/aspera/secret.rb file to be group-owned by nobody with the following command:

$ sudo chgrp nobody /opt/aspera/shares/u/shares/config/aspera/secret.rb