To Next Page

To Previous Page

| Appendix | 339

Restrict Aspera transfer users to a limited part of the server's file system or bucket in object storage.

a) For on-premises servers, set a default docroot to an empty folder, then set a docroot for each user:

# asconfigurator -x "set_node_data;absolute,docroot"

# asconfigurator -x "set_user_data;user_name,username;absolute,docroot"

Replace username with the username and docroot with the directory path to which the user should have access.

b) For cloud-based servers, set a default restriction to an empty folder, then set a restriction for each user:

# asconfigurator -x "set_node_data;file_restriction,|storage_path"

# asconfigurator -x

"set_user_data;user_name,username;file_restriction,|storage_path"

Replace username with the username and storage_path with the path to which the user has access. Restriction

syntax is specific to the storage:

Storage Type Format Example

local storage file:////*

S3 and IBM Cloud Object Storage s3://*

Swift storage swift//*

Azure storage azu://*

Azure Files azure-files://*

Google Cloud Storage gs://*

Hadoop (HDFS) hdfs://*

The "|" is a delimiter, and you can add additional restrictions. For example, to restrict the system user xfer

to s3://s3.amazonaws.com/bucket_xyz/folder_a/* and not allow access to key files, run the

following command:

# asconfigurator -x "set_user_data;user_name,xfer;file_restriction,|

s3://s3.amazonaws.com/bucket_xyz/folder_a/*|!*.key"

Restrict users' read, write, and browse permissions.

Users are given read, write, and browse permissions to their docroot by default. Change the global default to deny

these permissions:

# asconfigurator -x

"set_node_data;read_allowed,false;write_allowed,false;dir_allowed,false"

Run the following commands to enable permissions per user, as required:

# asconfigurator -x "set_user_data;user_name,username;read_allowed,false"

# asconfigurator -x "set_user_data;user_name,username;write_allowed,false"

# asconfigurator -x "set_user_data;user_name,username;dir_allowed,false"

Limit transfer permissions to certain users.

Set the default transfer permissions for all users to deny:

# asconfigurator -x "set_node_data;authorization_transfer_in_value,deny"

# asconfigurator -x "set_node_data;authorization_transfer_out_value,deny"

IBM Aspera HST User Manual

Questions and Answers: