Configuring for Aspera Files

Aspera Connect Server, or Enterprise Server with a Connect-enabled license, must be configured to use the Aspera Node API, which is required to connect these standalone, on-premise systems to Aspera Files. The server accesses the Node API using a node API username and password, that is associated with a local system account called xfer. All transfers and system operations on the computer are run under xfer. Thus, to add a server as a Files node, on the server you must create the system user, configure it as an Aspera transfer user, associate the transfer user with a node username and password, and configure the server to work with Files. Files users access the Node API and Files nodes using access keys, which can be created on the server or in the Files UI.

System Requirements:

Connect Server or Enterprise Server with a Connect-enabled license version 3.6.0 or later.
The public DNS name of the system must be accessible from all internal and external clients, as well as the computer itself.

Set Up and Configure a Transfer User

Create a system user.
Restrict user permissions with aspshell.
By default, all system users can establish a FASP connection and are only restricted by file permissions. You can restrict the user's file operations through the aspshell, which permits only the following operations:
- Running Aspera uploads and downloads to or from this computer.
- Establishing connections in the application.
- Browsing, listing, creating, renaming, or deleting contents.
These instructions explain one way to change a user account so that it uses the aspshell; there may be other ways to do so on your system.

Open the following file with a text editor:
```
/etc/passwd
```
Add or replace the user's shell with aspshell. For example, to apply aspshell to the user xfer, use the following settings in this file:
```
...
xfer:x:501:501:...:/home/xfer:/bin/aspshell
...
```
Ensure that the user has read and write privileges to the local directories or mounts that Aspera must access.
Set a docroot restriction, rather than a docroot.
The docroot restriction allows access only to the specified storage. To set a docroot restriction, run the following command:
```
# asconfigurator -x "set_user_data;user_name,username;file_restriction,|path"
```
Where the "|" is a delimiter, and the restriction path syntax depends on the storage:

Local storage: file:////*
S3 storage: s3://*
Swift storage: swift//*
Azure storage: azu://*

For example, to set a docroot restriction for xfer to S3 storage, the command is as follows:
```
# asconfigurator -x "set_user_data;user_name,xfer;file_restriction,|s3://*"
```
Configure the transfer user for token authorization.
```
# asconfigurator -x "set_user_data;user_name,xfer;authorization_transfer_in_value,token;authorization_transfer_out_value,token;token_encryption_key,key"
```
Aspera recommends that the key be a random string of at least 20 characters.
Assign the SSH public key associated with the IBM Aspera Connect Browser Plug-in to xfer.
The Connect Plug-in uses the default Aspera key pair. Run the following commands to create the .ssh directory, copy the default public key into that directory and rename it authorized_keys, and set permissions on the file, run the following commands:
```
$ mkdir /home/xfer/.ssh
$ cp /opt/aspera/var/aspera_tokenauth_id_rsa.pub /home/xfer/.ssh/authorized_keys
$ chmod 700 /home/xfer/.ssh
$ chmod 600 /home/xfer/.ssh/authorized_keys
$ chown -R xfer:xfer /home/xfer/.ssh
```
Create a node username and associate it with the system user xfer.
Run the following command with root or administrator permissions:
```
# /opt/aspera/bin/asnodeadmin  -a -u node_user -p node_user_passwd -x xfer
```
For example:
```
# /opt/aspera/bin/asnodeadmin  -a -u nuser-001 -p 472830x4n -x xfer
```
Note: The node username password must meet the password requirements set in Files.
List the node usernames to confirm that your command was successful.
```
# /opt/aspera/bin/asnodeadmin -l
```

Configure the Server as a Files Node

Ensure SSHD is running on port 33001.
For information on configuring TCP ports, see Securing Your SSH Server. You must also manually configure the <WEB> section of aspera.conf; see the Aspera Connect Server Admin Guide: Configuring Your Web UI Settings.
Configure a file extenstion to identify files that are still being transferred.
To set an extension for files that are partially transferred, such as .partial, run the following command:
```
# asconfigurator -x "set_node_data;partial_file_suffix,.partial"
```
The extension is removed once the file transfer is complete.
Enable activity logging and activity event reporting by running the following command:
```
# asconfigurator -x "set_server_data;activity_logging,true;activity_event_logging,true"
```
Configure the HTTPS service to use port 443 by running the following command:
```
# asconfigurator -x "set_server_data;https_port,443"
```
Note: Aspera strongly recommends adding an Nginx reverse proxy in front of asperanoded (described in the following section), in which case the HTTPS port is set back to 9092.
Enable recursive counts by running the following command:
```
# asconfigurator -x "set_server_data;files_recursive_counts_workers,value"
```
For value, enter a number from one to eight. Lower values (one or two) result in slower updates but less load on Redis. Higher values (four to eight) increase the load on Redis and the machine should have twice as many cores. Aspera recommends starting with a value of five, and adjusting if needed.

If your Redis database is very large and you set a high number of recursive counts workers, you may encounter out-of-memory problems. To offset this issue, you can increase the time between background Redis save events and number of key changes by running the following command:
```
# asconfigurator -x "set_server_data;db_config_save,time key_changes"
```
The default value is 900 1, which sets the background save schedule for every 15 minutes (900 seconds) if at least one key changes. To set this change, you must shut down the Redis database (it is restarted in the next step) by running the following command with root or Administrator privileges:
```
# /opt/aspera/bin/asnodeadmin --db-shutdown
```
Restart the Aspera Central, Aspera NodeD, and Aspera HTTPD services.
Run the following command in a Terminal window to restart asperacentral:
```
# /etc/init.d/asperacentral restart
```
Run the following commands to restart asperanoded:
```
# /etc/init.d/asperanoded restart
```
Run the following commands to restart asperahttpd:
```
# /etc/init.d/asperahttpd restart
```
Rename the ascp4 binary.
Files does not fully support ascp4 and renaming the binary prevents the node from running ascp4 commands. Locate the file in the following directory and rename it:
- /opt/aspera/bin/ascp4

Configure Nginx Reverse Proxy and Server Certificates

Aspera strongly recommends protecting your Files transfer nodes with an Nginx reverse proxy. Transfer nodes expose the asperanoded port in order to communicate with users' browsers. Normally, asperanoded runs on port 9092, but nodes that are added to Files must have asperanoded run on port 443, the standard HTTPS port for secure browser access. Configuring a reverse proxy in front of asperanoded provides additional protection (such as against DOS attacks) and resource handling for requests to the node's 443 port.

The following instructions require that you have valid certificates for the transfer node added to Files. Nginx is in beta for Windows, so these instructions are for Linux and UNIX nodes, but can be adapted for Windows.

Download and install Nginx.

Set the HTTPS port to 9092.

# asconfigurator -x "set_server_data;https_port,9092"

Open the Nginx configuration file in a text editor.
Open /etc/nginx/nginx.conf and ensure the following include directive is present in the http section. If it is not present, add it to the file:
```
http {
…
include /etc/nginx/conf.d/*.conf;
}
```
Create a file named aspera_node_proxy.conf and save it in the following location:
/etc/nginx/conf.d/aspera_node_proxy.conf

Paste the following content into aspera_node_proxy.conf:

server {
       ssl_certificate /path/to/server_cert.pem;
       ssl_certificate_key /path/to/server_key.pem;
       ssl on;
       listen 443;
       server_name your.servername.com;
       location / {
           proxy_pass https://127.0.0.1:9092;
           proxy_set_header Host               $host:$server_port;
           proxy_set_header X-Real-IP          $remote_addr;
           proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
           proxy_set_header X-Forwarded-Proto  $scheme;
       }
}

Replace /path/to/server_cert.pem with the location of your server's signed certificate. Include any intermediate certificates, as described in Installing SSL Certificates.
Replace /path/to/server_key.pem with the location of your server's private key.
Replace your.servername.com with your server's domain name.

Restart Nginx.
```
# service nginx restart
```

Adding the Node to Files

Once you have created a system user on the server, configured the user for Aspera, associated it with a node username, configured the server, and verified your SSL certificates, you may add it as a node in the Files UI. In the process you are asked for an existing access key and secret, or you can create a new one. If you prefer to manually create an access key on the server, see the instructions in Access Key Authentication.

Parent topic: Configuring for Other Aspera Products