| Appendix |
337
• Create a public key and associate it with a transfer user, otherwise clients have no way of connecting to the
server.
For instructions on using public key authentication, see
on page 133 and
a User's Public Key on the Server
on page 38.
• Configure at least one non-root, non-transfer user with a public key to use to manage the server. This is
because in the following steps, root login is disabled and transfer users are restricted to aspshell, which
does not allow interactive login. This user and public key is what you use to access and manage the server
as an administrator.
Add or uncomment
PubkeyAuthentication yes
and comment out
PasswordAuthentication
yes
:
PubkeyAuthentication yes
#PasswordAuthentication yes
PasswordAuthentication no
Note:
If you choose to leave password authentication enabled, be sure to advise account creators to use strong
passwords and set
PermitEmptyPasswords
to "no".
PermitEmptyPasswords no
e) Disable root login.
CAUTION:
This step disables root access. Make sure that you have at least one user account with
sudo privileges before continuing, otherwise you may not have access to administer your server.
Comment out
PermitRootLogin yes
and add
PermitRootLogin No
:
#PermitRootLogin yes
PermitRootLogin no
f) Restart the SSH server to apply new settings. Restarting your SSH server does not affect currently connected
users.
# systemctl restart sshd.service
or for Linux systems that use
init.d
:
# service sshd restart
g) Review your logs periodically for attacks.
For information on identifying attacks, see
IBM Aspera IBM Aspera High-Speed Transfer Server Admin
Guide: Securing Your SSH Server
.
2.
Configure your server's firewall to permit inbound access to only Aspera-required ports.
Aspera requires inbound access on the following ports:
• For SSH connections that are used to set up connections, TCP/33001.
• For FASP transfers, UDP/33001.
• If you use HTTP and HTTPS fallback with HST Server, TCP/8080 and TCP/8443. If you only use HTTPS,
only open TCP/8443.
• If your clients access the HST Server web UI, TCP/80 (for HTTP) or TCP/443 (for HTTPS).
