Securing the Aspera NodeD Service Behind a Proxy

If your Aspera server must expose the Aspera NodeD service to the internet, such as when setting it up as a Aspera on Cloud node, Aspera recommends protecting it with a reverse proxy. Normally, asperanoded runs on port 9092, but nodes that are added to Aspera on Cloud must have asperanoded run on port 443, the standard HTTPS port for secure browser access. Configuring a reverse proxy in front of asperanoded provides additional protection (such as against DOS attacks) and resource handling for requests to the node's 443 port.

The following instructions describe how to set up Nginx as a reverse proxy and require that you have valid, CA-signed SSL certificates in .pem format for the server. Other reverse proxies might be supported on your server.

Set up a system user with Node API credentials on your server.
For instructions, see Node API Setup.
Download and install Nginx.

Configure the HTTPS port for the NodeD service.

# asconfigurator -x "set_server_data;listen,127.0.0.1:9092;https_port,9092"

Open the Nginx configuration file in a text editor.
Open /etc/nginx/nginx.conf and ensure the following include directive is present in the http section. If it is not present, add it to the file:
```
http {
…
include /etc/nginx/conf.d/*.conf;
}
```
Create a file named aspera_node_proxy.conf and save it in the following location:
/etc/nginx/conf.d/aspera_node_proxy.conf

Paste the following content into aspera_node_proxy.conf:

#
# Aspera configuration - reverse proxy for asperanoded
#
server {
       listen 443;
       server_name your.servername.com;
       ssl_certificate /opt/aspera/etc/aspera_server_cert.pem;
       ssl_certificate_key /opt/aspera/etc/aspera_server_key.pem;

       ssl on;
       ssl_session_cache builtin:1000 shared:SSL:10m;
       ssl_protocols TLSv1.2;
       ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS;
       ssl_prefer_server_ciphers on;

       access_log          /var/log/nginx/node-api.access.log;

       location / {
           proxy_pass https://127.0.0.1:9092;
           proxy_read_timeout 60;
           proxy_redirect https://127.0.0.1:9092 https://your.servername.com;

           proxy_set_header Host               $host:$server_port;
           proxy_set_header X-Real-IP          $remote_addr;
           proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
           proxy_set_header X-Forwarded-Proto  $scheme;
       }
}

Replace your.servername.com with your server's domain name. The SSL certificate must include any intermediate certificates, as described in Installing SSL Certificates.

Restart the Aspera NodeD service.
Run the following commands to restart asperanoded:
```
# systemctl restart asperanoded
```
or for Linux systems that use init.d:
```
# service asperanoded restart
```
Restart Nginx.
```
# service nginx restart
```