V-252645

Discussion

By restricting the default document root for the Aspera HSTS, this allows for explicit access to be defined on a per user basis. By default, all system users can establish a FASP connection and are only restricted by file permissions.

Check Content

Verify the Aspera High-Speed Transfer Server set the default docroot to an empty folder.

Check that the default docroot points to an empty folder with the following command:

$ sudo /opt/aspera/bin/asuserdata -a | grep absolute

canonical_absolute: "<someemptyfolder>"
absolute: "<someemptyfolder>"

If the default docroot is set to "<Empty String>", this is a finding.

Review the default docroot file path from the previous command to ensure it is empty.

$ sudo find <somefilepath> -maxdepth 0 -empty -exec echo {} is empty. \;

<somefilepath> is empty.

If the command does not return "<somefilepath> is empty.", this is a finding.