IBM Aspera HST Admin Manual page 337

• Create a public key and associate it with a transfer user, otherwise clients have no way of connecting to the
server.
For instructions on using public key authentication, see
a User's Public Key on the Server
• Configure at least one non-root, non-transfer user with a public key to use to manage the server. This is
because in the following steps, root login is disabled and transfer users are restricted to aspshell, which
does not allow interactive login. This user and public key is what you use to access and manage the server
as an administrator.
Add or uncomment PubkeyAuthentication yes and comment out PasswordAuthentication
yes:
PubkeyAuthentication yes
#PasswordAuthentication yes
PasswordAuthentication no
Note: If you choose to leave password authentication enabled, be sure to advise account creators to use strong
passwords and set PermitEmptyPasswords to "no".
PermitEmptyPasswords no
e) Disable root login.
CAUTION: This step disables root access. Make sure that you have at least one user account with
sudo privileges before continuing, otherwise you may not have access to administer your server.
Comment out PermitRootLogin yes and add PermitRootLogin No:
#PermitRootLogin yes
PermitRootLogin no
f) Restart the SSH server to apply new settings. Restarting your SSH server does not affect currently connected
users.
# systemctl restart sshd.service
or for Linux systems that use init.d:
# service sshd restart
g) Review your logs periodically for attacks.
For information on identifying attacks, see
Guide: Securing Your SSH
2. Configure your server's firewall to permit inbound access to only Aspera-required ports.
Aspera requires inbound access on the following ports:
• For SSH connections that are used to set up connections, TCP/33001.
• For FASP transfers, UDP/33001.
• If you use HTTP and HTTPS fallback with HST Server, TCP/8080 and TCP/8443. If you only use HTTPS,
only open TCP/8443.
• If your clients access the HST Server web UI, TCP/80 (for HTTP) or TCP/443 (for HTTPS).
on page 38.
IBM Aspera IBM Aspera High-Speed Transfer Server Admin
Server.
Creating SSH Keys on page 133 and
| Appendix | 337
Setting Up