Aspera FASP Proxy

https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x
Admin
Aspera FASP Proxy is a solution that provides secure forward and reverse proxy capabilities for...
Tokens:34,919
Snippets:203
Trust Score:10
Update:10 months ago
Show doc for...
Tokens:
Raw
### Diagnose Proxy Service Start Error - Linux

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=appendices-troubleshooting

Example error message indicating a failure to initialize the proxy service. This often points to 'iptables' not being installed on the system. Installation instructions depend on the specific Linux distribution.

```log
ERR Failed to initialize proxy service
```

--------------------------------

### View Proxy Transfer Log Entries - Linux

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=appendices-troubleshooting

Example log entries showing the start and end of a proxy transfer, including connection details and IP addresses. Root access is required to view these logs in /var/log/messages or /var/log/syslog.

```log
Dec  5 17:32:11 test1 ascp_rproxy[26250]: LOG Received connection request from 10.0.31.133
Dec  5 17:32:11 test1 ascp_rproxy[26250]: LOG Established SSH connection with server 10.0.30.6:22
Dec  5 17:32:11 test1 ascp_rproxy[26250]: LOG Setup UDP forwarding between 10.0.31.133:60953 and 10.0.30.6:33001
```

```log
Dec  5 18:38:22 test1 ascp_rproxy[27238]: LOG Connection closed (EOF)
```

--------------------------------

### Example Package Name Output (DEB)

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=installation-uninstalling-aspera-proxy

Illustrates the typical output format when querying for the Aspera Proxy package on a Debian-based system, showing the package name and version.

```bash
||/ Name           Version        Description
          +++-================-==============-================================
          ii  ibm-aspera-proxy 1.2.2.100179-2 IBM Aspera Proxy Server
```

--------------------------------

### Alternative method to restart Aspera Proxy service

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=appendices-troubleshooting

Provides an alternative command to restart the Aspera proxy service, combining the stop and start actions into a single operation.

```bash
# /etc/init.d/asperaproxy restart
```

--------------------------------

### Display Aspera Proxy Default Server Setup Values

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=proxy-configuring-server-forward

The 'asuserdata -+' command displays the default configuration values for the Aspera proxy server setup. This is useful for understanding the initial state of the proxy settings before any manual modifications.

```bash
# /opt/aspera/proxy/bin/asuserdata -+
```

--------------------------------

### Aspera Proxy Server Configuration Example (XML)

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=proxy-configuring-server-forward

This XML snippet illustrates the structure within the `aspera.conf` file for configuring the Aspera proxy server. It shows how to enable HTTP and HTTPS, and how to enable the proxy server itself. These entries can be managed manually or through the `asconfigurator` utility.

```xml
<server>
  ...
    <enable_http>true</enable_http>        <!-- true | false -->
    <enable_https>true</enable_https>      <!-- true | false -->
    <proxy>
      <enabled>true</enabled>         <!-- Proxy server is enabled -->
    </proxy>
  ...
</server>
```

--------------------------------

### Connecting to Aspera Proxy with Hostname

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=installation-installing-aspera-proxy

This example demonstrates how to connect to the Aspera proxy using the 'ascp' command when the proxy server's SSL certificate includes a hostname. The hostname specified in the '--proxy' option must match the certificate's subject CN.

```shell
$ ascp --proxy=dnats://aspera.proxy.us myfile user@host:/
```

--------------------------------

### Example Reverse Proxy Configuration in aspera.conf (XML)

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=proxy-configuring-server-reverse

This XML snippet demonstrates how to configure a single reverse proxy rule within the aspera.conf file. It specifies the host IP address, the internal server address and port, and the SSH key file for authentication.

```xml
<server>
   <rproxy>
       <enabled>true</enabled>
       <rules>
           <rule host_ip="7.7.7.7">
               <host>10.0.0.10:22</host>
               <keyfile>/home/$(user)/.ssh/id_ed25519</keyfile>
           </rule>
       </rules>
   </rproxy>
</server>
```

--------------------------------

### Example Multiple Reverse Proxy Rules in aspera.conf (XML)

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=proxy-configuring-server-reverse

This XML configuration shows multiple reverse proxy rules defined in aspera.conf. It includes rules for different incoming IP addresses, specifying the internal host, port, an optional squashed user for authentication, and the location of the SSH private keyfile.

```xml
<server>
   <rproxy>
       <enabled>true</enabled>
       <rules>
       <!–- Incoming SSH connections to 7.7.7.7 -->
           <rule host_ip="7.7.7.7">
               <host>10.0.0.10:22</host>
           </rule>

           <!-- Incoming SSH connections to 7.7.7.8 -->
           <rule host_ip="7.7.7.8">
               <host>10.0.0.30:22</host>
               <squash_user>xfer</squash_user>
               <keyfile>/opt/aspera/proxy/etc/ssh_keys/id_ed25519</keyfile>
           </rule>
       </rules>
   </rproxy>
</server>
```

--------------------------------

### Example aspera.conf with src_port_filtering disabled

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=appendices-troubleshooting

Illustrates the relevant section in the aspera.conf file when source-port filtering is set to false, as configured by the asconfigurator command.

```xml
...
<rproxy>
  ...
  <rules>
    <rule>
      ...
      <src_port_filtering>false</src_port_filtering>
    </rule>
  </rules>
</rproxy>
...
```

--------------------------------

### Configure Reverse Proxy Load Balancing with Aspera FASP Proxy

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=proxy-load-balancing

This configuration example demonstrates how to set up load balancing for a reverse proxy in Aspera FASP Proxy. It specifies multiple destination servers for distributing transfer sessions and includes a keyfile for secure connections. The `<balancing>` tag is set to `round_robin`, the only supported method, and destinations are defined within `<hosts>` tags.

```xml
<rule host_ip="10.20.101.151">
   <balancing>round_robin</balancing>
   <hosts>
       <host>10.20.103.133:33001</host>
       <host>10.20.103.134:33001</host>
       <host>10.20.103.135:33001</host>
   </hosts>
   <keyfile>/home/$(user)/.ssh/id_ed25519</keyfile>
</rule>
```

--------------------------------

### Inspect iptables Forwarding Rules - Linux

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=appendices-troubleshooting

Example command demonstrating how to use 'iptables' to inspect traffic forwarding rules, particularly for 'nat' and 'filter' tables. This is useful for understanding Aspera FASP Proxy's reverse proxy configurations, as each connection typically generates three rules. Root privileges are required.

```bash
# Example iptables rules inspection command (specific rules will vary)
iptables -t nat -L
iptables -t filter -L
```

--------------------------------

### Diagnose No Matching Host Rule Error - Log

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=appendices-troubleshooting

Example error message from 'as_rproxy.log' indicating that the proxy could not find a matching rule in 'aspera.conf' for an incoming SSH connection. This requires checking client connection details against defined rules, especially if the proxy IP is NAT'd.

```log
ERR No matching rule found for host.
```

--------------------------------

### Generating a New Self-Signed SSL Certificate

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=installation-installing-aspera-proxy

This command generates a new self-signed SSL certificate for the proxy server, which must include the server's hostname. This is a requirement for forward proxy transfers to be accepted. The generated certificate replaces the default one provided by the installer.

```shell
#/opt/aspera/proxy/bin/generate-cert.sh proxy_server_hostname
```

--------------------------------

### Nginx Configuration for WebSocket Transport Reverse Proxy

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=rp-configuring-proxy-nginx-high-speed-transfer-server-hsts-other-aspera-products

This Nginx configuration snippet is intended for setting up a reverse proxy to enable WebSocket transport for Aspera transfers. It includes basic Nginx setup directives for worker connections and specifies the need to add directives for the `/v1/transfer/start` path.

```nginx
# Reverse proxy for transfers via websocket transport

pid var/run/asperanginx.pid; # Default: logs/nginx.pid

events {
  worker_connections  1024;  # Default: 1024
}

http {


```

--------------------------------

### Get Aspera Proxy Package Name (RPM)

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=installation-uninstalling-aspera-proxy

Retrieves the installed Aspera Proxy package name on RPM-based Linux systems. This command is a prerequisite for uninstalling the package.

```bash
$ rpm -q aspera-proxy
```

--------------------------------

### Get Aspera Proxy Package Name (DEB)

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=installation-uninstalling-aspera-proxy

Retrieves the installed Aspera Proxy package name on DEB-based Linux systems (e.g., Debian, Ubuntu). This command is a prerequisite for uninstalling the package.

```bash
$ dpkg -l aspera-proxy
```

--------------------------------

### Confirm Group Creation

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=proxy-configuring-server-reverse

Displays the contents of the /etc/group file to confirm that a newly created group has been successfully added to the system's group list.

```bash
# cat /etc/group
```

--------------------------------

### OpenSSL CSR Input Example

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=appendices-generating-ssl-certificate-that-contains-ip-address

This is an example of the interactive prompts when generating a Certificate Signing Request (CSR) using OpenSSL. It shows the fields that may be requested, such as Country Name, State, Locality, Organization, and Common Name. It also notes that challenge passwords should not be created.

```text
WARNING: can't open config file: /opt/aspera/ssl/openssl.cnf
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:California
Locality Name (eg, city) []:Emeryville
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Aspera
Organizational Unit Name (eg, section) []:Engineering
Common Name (e.g. server FQDN or YOUR name) []:proxy_server_hostname
Email Address []:
 
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
```

--------------------------------

### Check Supported SSL Ciphers

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=rp-configuring-proxy-nginx-high-speed-transfer-server-hsts-other-aspera-products

This command lists the SSL ciphers supported by the installed OpenSSL version on the Aspera proxy server. It is useful for configuring secure TLS connections.

```bash
/opt/aspera/bin/openssl ciphers
```

--------------------------------

### Example of SSH Login Attempt Log Entry

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=appendices-securing-your-ssh-server

This log entry shows a failed password attempt for an invalid user from a specific IP address. Reviewing such entries in system logs (e.g., /var/log/auth.log or /var/log/secure) helps identify potential brute-force attacks.

```log
...\nMar 10 18:48:02 sku sshd[1496]: Failed password for invalid user alex from 1.2.3.4 port 1585 ssh2\n...\nMar 14 23:25:52 sku sshd[1496]: Failed password for invalid user alice from 1.2.3.4 port 1585 ssh2\n...
```

--------------------------------

### Create a Group for Proxy Users

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=proxy-configuring-server-reverse

Creates a new system group on the server, which can be used to manage permissions for multiple proxy users collectively. This simplifies user management by allowing group-based access control.

```bash
# groupaddgroupname
```

--------------------------------

### Command Line Transfer via Forward Proxy (No Authentication)

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=proxy-transferring-from-command-line-through-forward

This command demonstrates how to initiate an Aspera FASP transfer using the `ascp` command through a forward proxy when no proxy authentication is needed. It specifies the proxy details and the source and destination files. The syntax assumes `<authentication>` is set to `false` in the `aspera.conf` file. The destination path is required.

```bash
$ ascp options --proxy dnat[s]://proxy_user@proxy_hostname[:port] file1[,file2,...] username@dest_hostname:target_path
```

--------------------------------

### Command Line Transfer via Forward Proxy (With Authentication)

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=proxy-transferring-from-command-line-through-forward

This command illustrates how to perform an Aspera FASP transfer through a forward proxy that requires authentication. It includes placeholders for the proxy username and password, along with the proxy hostname and port. This syntax is used when `<authentication>` is set to `true` in the `aspera.conf` file. The destination path is required.

```bash
$ ascp options --proxy dnat[s]://proxy_username:passwd@proxy_hostname[:port] file1[,file2,...] username@dest_hostname:target_path
```

--------------------------------

### Configure Token Authentication for Incoming Transfers (asconfigurator)

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=proxy-configuring-reverse-use-faspex-shares

This command uses 'asconfigurator' to set up token authentication for incoming file transfers for a specific user on Linux and MacOS. It requires root privileges. This ensures that only transfers with valid tokens are accepted.

```bash
# asconfigurator -x "set_user_data;user_name,transfer_username;authorization_transfer_in_value,token"
```

--------------------------------

### Test Nginx Configuration Syntax

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=rp-configuring-proxy-nginx-high-speed-transfer-server-hsts-other-aspera-products

This command checks the syntax of the Nginx configuration files for any errors before applying changes. A successful test indicates that the configuration is valid and Nginx can be reloaded or restarted without issues.

```bash
/opt/aspera/nginx/nginx -t
```

--------------------------------

### Configure Single Reverse Proxy Rule with asconfigurator

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=proxy-configuring-server-reverse

These commands configure a single forwarding rule for the reverse proxy. You must provide the target internal server's IP address and optionally a port. A keyfile path for SSH authentication can also be specified. The output updates the aspera.conf file.

```bash
# asconfigurator -x "set_server_data;rproxy_rules_rule_host,host_ip_address[:port]"
# asconfigurator -x "set_server_data;rproxy_rules_rule_keyfile,filepath"
```

--------------------------------

### Display iptables general rules

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=appendices-troubleshooting

Displays the current rules in the main iptables chains (INPUT, FORWARD, OUTPUT). This helps in understanding traffic filtering and acceptance policies.

```bash
# iptables -L
Chain INPUT (policy ACCEPT)
target    prot opt source        destination

Chain FORWARD (policy DROP)
target    prot opt source        destination
ACCEPT    udp  --  10.0.35.36    10.0.143.102  udp dpt:33001 /* 813d334f-b47f-46ea-83ed-e13779f9b9c8 */
ACCEPT    udp  --  10.0.35.37    10.0.143.102  udp dpt:33001 /* 813d334f-b47f-46ea-83ed-e13779f9b9c8 */
ACCEPT    udp  --  anywhere      anywhere      state ESTABLISHED

Chain OUTPUT (policy ACCEPT)
target    prot opt source        destination
```

--------------------------------

### Enable Reverse Proxy using asconfigurator

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=proxy-configuring-server-reverse

This command enables the reverse proxy functionality in Aspera FASP Proxy. It modifies the aspera.conf file to include the reverse proxy settings. No specific input files are required, and the output is a configuration update.

```bash
# asconfigurator -x "set_server_data;rproxy_enabled,true"
```

--------------------------------

### Aspera Reverse Proxy UDP Port Reuse and Squash User Rule (XML)

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=proxy-reverse-configuration-options

This rule configures the reverse proxy to receive and forward incoming transfers to an internal Windows server on incremental UDP ports starting from 5555. Transfers are then forwarded as the 'sender' user after client authentication. UDP port reuse is set to false, and the number of concurrent UDP streams dictates the required open ports.

```xml
<rule host_ip="10.20.101.151">
      <proxy_port>5555</proxy_port>
      <squash_user>sender</squash_user>
      <keyfile>/opt/aspera/proxy/etc/ssh_keys/id_ed25519</keyfile>
      <udp_port_reuse>false</udp_port_reuse>
    </rule>
```

--------------------------------

### Create Aspera Transfer User

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=proxy-using-aspera-sync-aspera-connect-reverse

This command creates a new system user, which is a prerequisite for setting up an Aspera transfer user. This user will be associated with a docroot and a Node API username/password for secure file transfers through the reverse proxy.

```bash
# useradd username
```

--------------------------------

### Configure Lua Package Paths in Nginx

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=proxy-lua-scripting-reverse

Sets the search paths for Lua external libraries (both pure Lua and C-based) within the Nginx configuration. These settings are crucial for enabling the import of external Lua modules and must be placed within the `http` directive, preceding any `server` directives.

```nginx
http {
   ...
   # set search paths for pure Lua external libraries (';;' is the default path):
   lua_package_path '/opt/aspera/nginx/lua/?.lua;;';
   # set search paths for Lua external libraries written in C (can also use ';;'):
   lua_package_cpath '/opt/aspera/nginx/lua/?.so;;';
   server {
       ...
   }
}
```

--------------------------------

### Verify Nginx Reverse Proxy with curl

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=rp-configuring-proxy-nginx-high-speed-transfer-server-hsts-other-aspera-products

This command tests the reverse proxy configuration by making a request to the '/v1/transfer/start' endpoint. The output will indicate if the request was processed successfully.

```bash
# curl -ki https://proxy_ip_address/v1/transfer/start
```

--------------------------------

### Restart Aspera Proxy Service with init

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=proxy-configuring-server-forward

This code snippet shows how to restart the Aspera proxy service on systems that use the older init system. The specific command may vary depending on the init system implementation.

```bash
# service asperaproxy restart
```

--------------------------------

### Add Users to a Group

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=proxy-configuring-server-reverse

Adds an existing user to a specified group. This command allows for flexible user management by assigning users to groups, enabling group-based permission settings.

```bash
# usermod -a -Ggroupname username
```

--------------------------------

### Apply sysctl configuration changes

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=appendices-troubleshooting

Applies the changes made to the sysctl configuration file, such as enabling IP forwarding. This command reloads the system's network tuning parameters.

```bash
# /sbin/sysctl -p /etc/sysctl.conf
```

--------------------------------

### Restart Aspera Proxy Service with systemd

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=proxy-configuring-server-forward

To apply configuration changes or to restart the proxy service, use the 'systemctl restart asperaproxy' command when the system uses systemd as its init system.

```bash
# systemctl restart asperaproxy
```

--------------------------------

### Verify Nginx Listening Ports

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=rp-configuring-proxy-nginx-high-speed-transfer-server-hsts-other-aspera-products

This command helps verify if Nginx is listening on the configured IP addresses and ports, indicating that the proxy service is active. The expected output shows TCP connections in a LISTEN state on the specified ports.

```bash
# netstat -anp | grep nginx
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 6438/nginx: master  
tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN 6438/nginx: master
```

```bash
# netstat -tulnp | grep nginx
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      268840/nginx: master
tcp6       0      0 :::443                  :::*                    LISTEN      268840/nginx: master
```

--------------------------------

### Aspera FASP Proxy Transfer With Authentication (Shell)

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=proxy-transferring-from-command-line-through-forward

This command transfers a file through an Aspera FASP proxy requiring authentication. The `--proxy` option uses a `dnats://` URI, including the proxy username and password. This ensures secure communication with the proxy server.

```shell
$ ascp --proxy dnats://aspera_proxy:pa33w0rd@phost.com /data/file1 Sue@ihost.com:/Sue_data/
```

--------------------------------

### Configure Token Authentication for Outgoing Transfers (asconfigurator)

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=proxy-configuring-reverse-use-faspex-shares

This command uses 'asconfigurator' to set up token authentication for outgoing file transfers for a specific user on Linux and MacOS. It requires root privileges. This ensures that the server only allows transfers initiated with valid tokens.

```bash
# asconfigurator -x "set_user_data;user_name,transfer_username;authorization_transfer_out_value,token"
```

--------------------------------

### Aspera FASP Proxy Reverse Proxy: Command Line Transfers (ascp)

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=proxy-transferring-files-reverse

Demonstrates how to transfer files using the `ascp` command with Aspera FASP Proxy's reverse proxy configuration. It covers both the squash-user and individual-account approaches, highlighting the use of specific proxy IP addresses, SSH ports, and target directories.

```bash
# Example using squash-user approach:
# This command transfers 'testfile_bear' using proxy instance 189.0.202.39,
# which is configured to squash all users to 'xfer' on the internal server.
# The -P flag specifies the SSH port on the proxy server.
$ ascp -P 33001 testfile_bear xfer@189.0.202.39:/user/bear

# Example using individual-user approach:
# This command transfers 'testfile_bobcat' using proxy instance 189.0.202.40,
# where the user 'bobcat' maintains their own identity on the internal server.
# The -P flag specifies the SSH port on the proxy server.
$ ascp -P 33001 testfile_bobcat bobcat@189.0.202.40:/user/bobcat
```

--------------------------------

### Restarting SSH Daemon on Systemd or Init

Source: https://www.ibm.com/docs/en/aspera-fasp-proxy/1.4.x/index_topic=installation-installing-aspera-proxy

This section details how to restart the SSH daemon depending on whether the system uses systemd or init. For systemd-based systems, the 'systemctl restart sshd' command is used. For init-based systems, the 'service ssh restart' command is the appropriate method.

```shell
# systemctl restart sshd
```

```shell
# service ssh restart
```
Tokens:
Raw