Cyber · Trackr The Free Compliance Library
⌘K
DoD Compliance · STIG

Red Hat Ansible Automation Controller Web Server Security Technical Implementation Guide

V2R4 · · · Released 30 Sep 2026 · 28 rules
Compare

Pick two releases to diff their requirements.

View

Open a previous version of this STIG.

This Security Technical Implementation Guide is published as a tool to improve the security of Department of War (DoW) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
Supporting documents DISA companion ZIP · 2.1 MB 4 PDFs

Bundled by DISA alongside this STIG release: overview, revision history, and readme files. Download the full archive or open an individual PDF.

Download full ZIP U_RH_Ansible_Automation_Controller_Y26M10_STIG.zip
Digest of Updates vs. V2R3 · 05 Jan 2026 ✎ 11

Comparison against the immediately-prior release (V2R3). Rule matching uses the Group Vuln ID. Content-change detection compares the rule’s description, check, and fix text after stripping inline markup — cosmetic-only edits aren’t flagged.

Content changes 11

  • V-256941 Medium descriptioncheckfix The Automation Controller servers must use encrypted communication for all channels given the high impact of those services to an organization's infrastructure.
  • V-256945 Medium checkfix Expansion modules must be fully reviewed, tested, and signed before they can exist on a production Automation Controller NGINX front-end web server.
  • V-256947 Medium checkfix All Automation Controller NGINX web servers must not be a proxy server for any process other than the Automation Controller application.
  • V-256949 Medium checkfix All Automation Controller NGINX web servers must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled.
  • V-256952 Medium checkfix All Automation Controller NGINX web servers must be configured to use a specified IP address and port.
  • V-256953 Medium checkfix Only authenticated system administrators or the designated PKI Sponsor for an Automation Controller NGINX web server must have access to any Automation Controller NGINX web server's private key.
  • V-256957 Medium descriptioncheckfix The Automation Controller NGINX web server must limit the character set used for data entry.
  • V-256959 Medium checkfix Debugging and trace information, within Automation Controller NGINX web server, used to diagnose the web server must be disabled.
  • V-256962 Medium checkfix The Automation Controller NGINX web server must be protected from being stopped by a nonprivileged user.
  • V-256964 Medium checkfix Automation Controller NGINX web servers must maintain the confidentiality of controlled information during transmission through the use of an approved TLS version.
  • V-256965 Medium check The Automation Controller NGINX web servers must maintain the confidentiality and integrity of information during preparation for transmission.
Sort by
b
The Automation Controller web server must manage sessions.
AC-10 - Medium - CCI-000054 - V-256940 - SV-256940r960735_rule
RMF Control
AC-10
Severity
M
CCI
CCI-000054
Version
APWS-AT-000020
Vuln IDs
  • V-256940
Rule IDs
  • SV-256940r960735_rule
Session management on client and server is required to protect identity and authorization information. Sessions for the Automation Controller web server, if compromised, could lead to execution of jobs on remote endpoints as if authenticated. Satisfies: SRG-APP-000001-WSR-000002, SRG-APP-000001-WSR-000001, SRG-APP-000295-WSR-000012, SRG-APP-000295-WSR-000134
Checks: C-60615r903545_chk

Log in to Automation Controller as an administrator and navigate to Settings >> System >> Miscellaneous Authentication. The following parameters must be set: OAuth 2 Timeout Settings < 1800 seconds (No more than 30 minutes). The maximum number of simultaneous logged session must not be less than 0 (The default is -1) and must not match the organizationally defined maximum. Disable the built-in authentication system = ON Enable HTTP Basic Auth = Off OAuth 2 Timeout settings: "ACCESS_TOKEN_EXPIRE_SECONDS": 31536000000, "AUTHORIZATION_CODE_EXPIRE_SECONDS": 600, "REFRESH_TOKEN_EXPIRE_SECONDS": 2628000 Allow External Users to Create OAuth2 Tokens = Off Login redirect override URL = Not Configured or Blank Social Auth Organization Map = Null Social Auth Team Map = Null Social Auth User Fields = Null If any of these settings are incorrect, this is a finding.

Fix: F-60557r903541_fix

Log in to Automation Controller as an administrator and navigate to Settings >> System >> Miscellaneous Authentication. Click "Edit". Set the following parameters: OAuth 2 Timeout Settings < 1800 seconds. The maximum number of simultaneous logged session must equal 0 or the organizationally defined maximum. Disable the built-in authentication system = ON Enable HTTP Basic Auth = Off Access Token Expiration = 31536000000 Authorization Code Expiration = 600 Refresh Token Expiration = 2628000 Allow External Users to Create OAuth2 Tokens = Off Login redirect override URL = Not Configured or Blank Social Auth Organization Map = Null Social Auth Team Map = Null Social Auth User Fields = Null Click "Save".

b
The Automation Controller servers must use encrypted communication for all channels given the high impact of those services to an organization's infrastructure.
AC-17 - Medium - CCI-000068 - V-256941 - SV-256941r1262561_rule
RMF Control
AC-17
Severity
M
CCI
CCI-000068
Version
APWS-AT-000030
Vuln IDs
  • V-256941
Rule IDs
  • SV-256941r1262561_rule
The Automation Controller communicates information about configuration of other information systems through its web interface and API, storing records about this information in a database. Although large portions are sanitized of sensitive information, due to the nature of this kind of information, it must always be maximally protected. Leaked details of configuration for DoW enterprise information systems could lead to compromise, so all access to and from the Automation Controller servers must be encrypted.
Checks: C-60616r1262559_chk

1. Web Server Must Enforce TLS 1.2 or Higher: nginx -T 2&gt;&amp;1 | grep -E '^[[:space:]]*ssl_protocols' | grep -E '(TLSv1\.2|TLSv1\.3)' &gt; /dev/null || echo "FAILED" If "FAILED" is displayed, this is a finding. 2. Web Server Must Use Host OS-Provided Cipher Policy: nginx -T 2&gt;&amp;1 | grep -Eq '^[[:space:]]*ssl_ciphers[[:space:]]+PROFILE=SYSTEM[[:space:]]*;[[:space:]]*$' || echo "FAILED" If "FAILED" is displayed, this is a finding. 3. External Database Connections Must Use TLS With Certificate Verification. Automation Controller may be configured to connect to PostgreSQL databases with or without TLS. The Administrator must check the contents of the file at /etc/tower/conf.d/postgres.py with root permissions to determine if pg_sslmode was configured with "verify-full" for any external databases at the time of installation. 3.1 Client-Side Execute the following command: sudo python3 -c 'exec(open("/etc/tower/conf.d/postgres.py").read()); import sys; bad=[n for n,c in DATABASES.items() if c.get("HOST") not in ("127.0.0.1","localhost","") and c.get("OPTIONS",{}).get("sslmode")!="verify-full"]; sys.exit(0 if not bad else 1)' || echo "FAILED" If "FAILED" is displayed, this is a finding. 3.2 Server-Side Confirm the database server negotiates TLS. Get DB host:port for the default connection: PGCON=$(sudo python3 -c 'exec(open("/etc/tower/conf.d/postgres.py").read()); import sys; d=DATABASES.get("default",{}); h=d.get("HOST",""); p=d.get("PORT",""); print(f"{h}:{p}" if h and p else "", end="")') Validate SSL with psql (requires psql client): test -n "$PGCON" &amp;&amp; psql "postgresql://${PGCON}/postgres?sslmode=require" -qAt -c '\conninfo' 2&gt;/dev/null | grep -qi 'SSL connection' || echo "FAILED" If "FAILED" is displayed, this is a finding.

Fix: F-60558r1262560_fix

Web Server TLS and Cipher Configuration As a system administrator for each Automation Controller NGINX web server: 1. Identify the active NGINX configuration files: nginx -T 2>&1 | grep '# configuration file' 2. Edit the relevant server block configuration file. 3. Ensure ssl_protocols line: ssl_protocols TLSv1.2 TLSv1.3; Ensure ssl_ciphers line: ssl_ciphers PROFILE=SYSTEM; (note the leading spaces:" ssl_ciphers PROFILE=SYSTEM;") If the directive does not exist, add it immediately after the ssl_ciphers line. 4. Save the file and apply the changes: sudo nginx -t && sudo systemctl restart nginx Database TLS Configuration 1. Edit the Ansible Automation Platform installer inventory file and set: pg_sslmode='verify-full' postgres_use_ssl=true 2. Reconfigure the controller: sudo ./setup.sh

b
The Automation Controller NGINX web server must use cryptography on all remote connections.
AC-17 - Medium - CCI-001453 - V-256942 - SV-256942r960762_rule
RMF Control
AC-17
Severity
M
CCI
CCI-001453
Version
APWS-AT-000040
Vuln IDs
  • V-256942
Rule IDs
  • SV-256942r960762_rule
Nondisplayed data on a web page may expose information that could put the organization at risk and negatively affect data integrity. Automation Controller's web server must be configured such that all connections, regardless of their origin, between the server and the user are encrypted using cryptography.
Checks: C-60617r903519_chk

As any user, execute the following command, substituting "&lt;controller_fqdn&gt;" for the hostname of the Automation Controller: curl -s -w '%{redirect_url}\n' -o /dev/null http://&lt;controller_fqdn&gt;/api/v2/ping/ | grep '^https' &gt;/dev/null || echo FAILED If "FAILED" is displayed, this is a finding.

Fix: F-60559r902339_fix

As a System Administrator, locate the inventory file used to install Ansible Automation Platform (usually in the installer directory). Edit this file and ensure the "nginx_disable_https" variable is absent or is set to "false". Run the setup.sh command in the installer directory to reconfigure the controller to use the new setting: sudo ./setup.sh

b
The Automation Controller must generate the appropriate log records.
AC-17 - Medium - CCI-000067 - V-256943 - SV-256943r960765_rule
RMF Control
AC-17
Severity
M
CCI
CCI-000067
Version
APWS-AT-000090
Vuln IDs
  • V-256943
Rule IDs
  • SV-256943r960765_rule
Automation Controller's web server must log all details related to user sessions in support of troubleshooting, debugging, and forensic analysis. Without a data logging feature, the organization loses an important auditing and analysis tool for event investigations. Satisfies: SRG-APP-000016-WSR-000005, SRG-APP-000095-WSR-000056, SRG-APP-000096-WSR-000057, SRG-APP-000097-WSR-000058, SRG-APP-000098-WSR-000059, SRG-APP-000098-WSR-000060, SRG-APP-000099-WSR-000061, SRG-APP-000100-WSR-000064
Checks: C-60618r902341_chk

For each Automation Controller host, determine whether the web server is logging all content related to user sessions. Log in to Automation Controller as an administrator and navigate to console Settings &gt;&gt; System &gt;&gt; Miscellaneous System. Verify the following settings: Enable Activity Stream = On Enable Activity Stream for Inventory Sync = On Organization Admins Can Manage Users and Teams = On All Users Visible to Organization Admins = On If the configuration settings are not as above, this is a finding.

Fix: F-60560r903520_fix

As a System Administrator, for each Automation Controller host, navigate to console Settings >> System >> Miscellaneous System. Click "Edit". Set the following: Enable Activity Stream = On Enable Activity Stream for Inventory Sync = On Organization Admins Can Manage Users and Teams = On All Users Visible to Organization Admins = On Click "Save".

c
All Automation Controller NGINX front-end web server files must be verified for their integrity (e.g., checksums and hashes) before becoming part of the production web server.
High - CCI-003992 - V-256944 - SV-256944r1016556_rule
RMF Control
Severity
H
CCI
CCI-003992
Version
APWS-AT-000230
Vuln IDs
  • V-256944
Rule IDs
  • SV-256944r1016556_rule
Being able to verify that a patch, upgrade, certificate, etc., being added to the web server is unchanged from the producer of the file is essential for file validation and nonrepudiation of the information. The Automation Controller NGINX web server host must have a mechanism to verify that files are valid prior to installation.
Checks: C-60619r902344_chk

As a System Administrator, for each Automation Controller NGINX web server host, verify the integrity of the Automation Controller NGINX web server hosts files: aide --check Verify the displayed checksums against previously reserved checksums of the Advanced Intrusion Detection Environment (AIDE) database. If there are any unauthorized or unexplained changes against previous checksums, this is a finding.

Fix: F-60561r902345_fix

As a System Administrator, for each Automation Controller NGINX web server host, check for existing or install AIDE: yum install -y aide Create or update the AIDE database immediately after initial installation of each Automation Controller NGINX web server host: aide --init && mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz Accept any expected changes to the host by updating the AIDE database: aide --update The output will provide checksums for the AIDE database. Save in a protected location.

b
Expansion modules must be fully reviewed, tested, and signed before they can exist on a production Automation Controller NGINX front-end web server.
Medium - CCI-003992 - V-256945 - SV-256945r1262564_rule
RMF Control
Severity
M
CCI
CCI-003992
Version
APWS-AT-000240
Vuln IDs
  • V-256945
Rule IDs
  • SV-256945r1262564_rule
In the case of a production web server, areas for content development and testing will not exist, as this type of content is only permissible on a development website. The process of developing on a functional production website entails a degree of trial and error and repeated testing. This process is often accomplished in an environment where debugging, sequencing, and formatting of content are the main goals. The opportunity for a malicious user to obtain files that reveal business logic and login schemes is high in this situation. The existence of such immature content on a web server represents a significant security risk that is totally avoidable. The Automation Controller NGINX front-end web server must enforce, either internally or through an external utility, the signing of modules before they are implemented into a production environment. By signing modules, the author guarantees that the module has been reviewed and tested before production implementation.
Checks: C-60620r1262562_chk

The Automation Controller does not require any NGINX dynamic expansion modules to function. As a system administrator for each Automation Controller NGINX web server host: NGINXMODPATH=$(nginx -V 2&gt;&amp;1 | tr ' ' '\n' | grep modules-path | sed -ne '/modules-path/{s/.*modules-path=\(.*\)/\1/;p}') nginx -T 2&gt;&amp;1 | grep -q load_module &amp;&amp; echo FAILED [ $(ls -1 $NGINXMODPATH 2&gt;/dev/null | wc -l) == 0 ] || echo FAILED If "FAILED" is displayed, this is a finding.

Fix: F-60562r1262563_fix

As a system administrator for each Automation Controller NGINX web server host: NGINXMODPATH=$(nginx -V 2>&1 | tr ' ' '\n' | grep modules-path | sed -ne '/modules-path/{s/.*modules-path=\(.*\)/\1/;p}') sudo rm -f ${NGINXMODPATH}/* Identify active config files and remove any load_module lines: nginx -T 2>&1 | grep '# configuration file' Edit each file and remove lines containing load_module. Save the file and exit the text editor. Run the following command to apply the changes: sudo systemctl restart nginx

b
All Automation Controller NGINX front-end web servers must not perform user management for hosted applications.
CM-7 - Medium - CCI-000381 - V-256946 - SV-256946r960963_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
APWS-AT-000250
Vuln IDs
  • V-256946
Rule IDs
  • SV-256946r960963_rule
Web servers require enterprise-wide user management capability in order to prevent unauthorized access, with features like attempt lockouts and password complexity requirements. Unauthorized access to the web server makes the web server and the organization vulnerable to attack. Note: The underlying NGINX web server does not perform user management or authentication. The Automation Controller includes user management and authentication capabilities. However, the user management controls built into Automation Controller may not be sufficient to enforce the appropriate level of password, sessions, and other policies required. It is strongly recommended that Automation Controller be configured to use the organization's Identity Management/Authentication Service. This may be an AD/LDAP service, OIDC, or other supported authentication service.
Checks: C-60621r902350_chk

As a system administrator for each Automation Controller NGINX web server host, navigate to Settings &gt;&gt; Authentication. Review the configuration and verify that the appropriate authentication service is configured. If no authentication service is configured, this is a finding.

Fix: F-60563r902351_fix

As a system administrator for each Automation Controller NGINX web server host, navigate to Settings >> Authentication. Configure the appropriate authentication service.

b
All Automation Controller NGINX web servers must not be a proxy server for any process other than the Automation Controller application.
CM-7 - Medium - CCI-000381 - V-256947 - SV-256947r1262567_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
APWS-AT-000270
Vuln IDs
  • V-256947
Rule IDs
  • SV-256947r1262567_rule
The Automation Controller NGINX web server must be primarily a web server or a proxy server but not both, for the same reasons that other multi-use servers are not recommended. Scanning for web servers that will also proxy requests into an otherwise protected network is a very common anonymous attack. In a scenario where Automation Controller is still reachable without use of the proxy/load balancer or when the proxy does not validate the header, X-Forwarded-For can be spoofed fairly easily to fake the originating IP addresses. Using HTTP_X_FORWARDED_FOR in the REMOTE_HOST_HEADERS setting poses a vulnerability that essentially gives users access to certain resources that they must not have. Satisfies: SRG-APP-000141-WSR-000076, SRG-APP-000141-WSR-000083, SRG-APP-000141-WSR-000087
Checks: C-60622r1262565_chk

As a system administrator (SA) for each Automation Controller NGINX web server host, ensure that the only upstream servers configured are for the Automation Controller ASGI and WSGI modules. Dump the full active NGINX configuration: nginx -T 2&gt;&amp;1 | grep -E 'proxy_pass|uwsgi_pass' | grep -Pqz '^\s+proxy_pass http://daphne;\n\s+uwsgi_pass uwsgi;\n$' || echo FAILED nginx -T 2&gt;&amp;1 | grep -Pzo 'upstream\s+daphne\s+{[^}]+}' | grep -a server | grep -v 'server unix:/var/run/tower/daphne.sock;' &amp;&amp; echo FAILED nginx -T 2&gt;&amp;1 | grep -Pzo 'upstream\s+uwsgi\s+{[^}]+}' | grep -a server | grep -v 'server unix:/var/run/tower/uwsgi.sock;' &amp;&amp; echo FAILED If "FAILED" is displayed, this is a finding.

Fix: F-60564r1262566_fix

As an SA, remove any content present and served from the static content location (/var/lib/awx/public/static) that is not acceptable per organizationally defined policy. Run the setup.sh command in the Ansible Automation Platform installer directory to reconfigure the controller to the default state, which only contains the required configuration: sudo ./setup.sh (Note: Identify the active NGINX configuration files using nginx -T 2>&1 | grep '# configuration file' to locate all included config files before editing.)

b
All Automation Controller NGINX webserver accounts not utilized by installed features (i.e., tools, utilities, specific services, etc.) must not be created and must be deleted when the web server feature is uninstalled.
CM-7 - Medium - CCI-000381 - V-256948 - SV-256948r960963_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
APWS-AT-000290
Vuln IDs
  • V-256948
Rule IDs
  • SV-256948r960963_rule
If web server accounts are not being used, they must be deleted when the web server is uninstalled. This is because the accounts become stale over time and are not tended to. Best practice also dictates that if accounts are not going to be used, they must not be created for the same reason. Both situations create an opportunity for web server exploitation. When accounts used for web server features such as documentation, sample code, example applications, tutorials, utilities, and services are created, even though the feature is not installed, they become an exploitable threat to a web server. These accounts become inactive and are not monitored through regular use, and passwords for the accounts are not created or updated. An attacker can use these accounts to gain access to the web server and begin investigating ways to elevate the account privileges. The accounts used for all Automation Controller NGINX web server features not installed must not be created and must be deleted when these features are uninstalled.
Checks: C-60623r902356_chk

As a System Administrator for each Automation Controller NGINX web server, examine NGINX users in /etc/passwd. Verify a single user "nginix" exists using the command: [ `grep -c nginx /etc/passwd` == 1 ] || echo FAILED If "FAILED" is displayed, this is a finding.

Fix: F-60565r902357_fix

As a System Administrator for each Automation Controller NGINX web server, reinstall Automation Controller if no "nginx" users exist in /etc/passwd. Review all users enumerated in /etc/passwd, and remove any that are not attributable to RHEL or Automation Controller and/or organizationally disallowed.

b
All Automation Controller NGINX web servers must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled.
CM-7 - Medium - CCI-000381 - V-256949 - SV-256949r1262570_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
APWS-AT-000310
Vuln IDs
  • V-256949
Rule IDs
  • SV-256949r1262570_rule
Controlling what a user of a hosted application can access is part of the security posture of the Automation Controller NGINX web server. Any time a user can access more functionality than is needed for the operation of the hosted application, it poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner. A MIME tells the Automation Controller NGINX web servers what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type. A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of Automation Controller.
Checks: C-60624r1262568_chk

As a system administrator (SA) for each Automation Controller NGINX web server, check the allowed MIME types: MIME_TYPES=$(nginx -T 2&gt;&amp;1 | grep -m1 'include.*mime' | awk '{print $2}' | sed 's/;$//') disallowed_mime_types=('application.*\sbin' 'application.*\sexe' 'application.*\srpm' 'application.*\smsi' 'application.*\smsp' 'application.*\smsm') echo "${disallowed_mime_types[*]}" | tr ' ' '\n' &gt; tempfile; cat $MIME_TYPES | grep -f tempfile 1&gt;/dev/null &amp;&amp; echo "FAILED"; rm -f tempfile If "FAILED" is displayed, this is a finding.

Fix: F-60566r1262569_fix

As an SA for each Automation Controller NGINX web server, identify the MIME types file: MIME_TYPES=$(nginx -T 2>&1 | grep -m1 'include.*mime' | awk '{print $2}' | sed 's/;$//') Remove disallowed MIME types from the file and restart NGINX.

b
All Automation Controller NGINX web servers must have Web Distributed Authoring (WebDAV) disabled.
CM-7 - Medium - CCI-000381 - V-256950 - SV-256950r960963_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
APWS-AT-000340
Vuln IDs
  • V-256950
Rule IDs
  • SV-256950r960963_rule
Automation Controller NGINX web servers can be installed with functionality that, just by its nature, is not secure. Web Distributed Authoring (WebDAV) is an extension to the HTTP protocol that, when developed, was meant to allow users to create, change, and move documents on a server, typically a web server or web share. Allowing this functionality, development, and deployment is much easier for web authors. WebDAV is not widely used and has serious security concerns because it may allow clients to modify unauthorized files on the web server.
Checks: C-60625r902362_chk

As a system administrator, for each Automation Controller NGINX web server host, check the Automation Controller NGINX web server configuration for WebDAV modules: disallowed_modules=(nginx-dav-ext-module headers-more-nginx-module) ; echo "${disallowed_modules[*]}" | tr ' ' '\n' &gt;tempfile ; nginx -V 2&gt;&amp;1 | grep module | tr ' ' '\n' | grep module | grep -v modules-path | grep -Ff tempfile &amp;&amp; echo "FAILED"; rm -f tempfile If "FAILED" is displayed, this is a finding. Check the Automation Controller NGINX web server configuration for WebDAV modules for disallowed WebDAV verbs, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK: NGINXCONF=`nginx -V 2&gt;&amp;1 | tr ' ' '\n' | sed -ne '/conf-path/{s/.*conf-path=\(.*\)/\1/;p}' ` ; grep dev_(.*)methods $NGINXCONF | grep 'COPY|MOVE|MKCO|PROPFIND|PROPPATCH|LOCK|UNLOCK' &amp;&amp; echo 'FAILED' If "FAILED" is displayed, this is a finding.

Fix: F-60567r902363_fix

As a system administrator, for each Automation Controller nginx web server host, remove all WebDAV modules from the NGINX configuration file (nominally /etc/nginx/nginx.conf). Reload the NGINX server configurations for all NGINX processes: $ pkill -HUP nginx

a
All Automation Controller NGINX web servers must protect system resources and privileged operations from hosted applications.
CM-7 - Low - CCI-000381 - V-256951 - SV-256951r960963_rule
RMF Control
CM-7
Severity
L
CCI
CCI-000381
Version
APWS-AT-000350
Vuln IDs
  • V-256951
Rule IDs
  • SV-256951r960963_rule
Automation Controller NGINX web servers may host too many applications. Each application will need certain system resources and privileged operations to operate correctly. The Automation Controller NGINX web servers must be configured to contain and control the applications and protect the system resources and privileged operations from those not needed by the application for operation. Not limiting the application will exacerbate the potential harm a compromised application could cause to a system.
Checks: C-60626r902365_chk

As a system administrator for each Automation Controller NGINX web server host, check if SELinux is enabled in enforcing mode: getenforce | grep Enforcing &gt;/dev/null || echo FAILED If "FAILED" is displayed, this is a finding.

Fix: F-60568r902366_fix

As a system administrator for each Automation Controller NGINX web server host, place the server in SELinux enforcing mode: setenforce 1

b
All Automation Controller NGINX web servers must be configured to use a specified IP address and port.
CM-7 - Medium - CCI-000382 - V-256952 - SV-256952r1262573_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000382
Version
APWS-AT-000370
Vuln IDs
  • V-256952
Rule IDs
  • SV-256952r1262573_rule
From a security perspective, it is important that all Automation Controller NGINX web servers are configured to use a specified IP address and port because “listening” on all IP addresses poses a vulnerability to the web server. Not confining the web server to a specified IP address and port puts all web server content at risk of access by bad actors wanting to take advantage of those resources.
Checks: C-60627r1262571_chk

As a system administrator (SA) for each Automation Controller NGINX web server host, verify the web server is configured to use a static IP address and port: nginx -T 2&gt;&amp;1 | grep '^\s*listen\s*\*\|\s*listen\s*\[.*\]\|\s*listen\s*0\.0\.0\.0\|\s*listen\s*\[.*\]\|^\s*listen\s\+.*:[^[:digit:]\s]\+.*' &amp;&amp; echo FAILED If "FAILED" is displayed, this is a finding.

Fix: F-60569r1262572_fix

As an SA, identify the active NGINX configuration files: nginx -T 2>&1 | grep '# configuration file' Edit the relevant configuration file(s) to replace any wildcard or ranged IP address references with IP addresses from the pool of allowed and/or designated addresses. Reload the NGINX server configuration: pkill -HUP nginx

b
Only authenticated system administrators or the designated PKI Sponsor for an Automation Controller NGINX web server must have access to any Automation Controller NGINX web server's private key.
IA-5 - Medium - CCI-000186 - V-256953 - SV-256953r1262576_rule
RMF Control
IA-5
Severity
M
CCI
CCI-000186
Version
APWS-AT-000400
Vuln IDs
  • V-256953
Rule IDs
  • SV-256953r1262576_rule
Each Automation Controller NGINX web server's private key is used to prove the identity of the server to clients and securely exchange the shared secret key used to encrypt communications between the Automation Controller NGINX web server and clients. By gaining access to the private key, an attacker can pretend to be an authorized server and decrypt the SSL traffic between a client and the Automation Controller NGINX web server.
Checks: C-60628r1262574_chk

As a system administrator (SA) for each Automation Controller NGINX web server host, verify the location and permissions of the private key: For containerized deployments, enter the controller web container namespace or use podman exec: TOWER_KEY=$(nginx -T 2&gt;&amp;1 | sed -n 's/^\s*ssl_certificate_key\s*\(.*\);/\1/p' | head -1) stat -c "%a %U %G" $TOWER_KEY Verify the key file is readable only by the service account running the NGINX process (permission mode 400 or 600, owned by the service user). If the key is world-readable or group-readable by an unauthorized group, this is a finding.

Fix: F-60570r1262575_fix

As an SA for each Automation Controller NGINX web server host, set the permissions: TOWER_KEY=$(nginx -T 2>&1 | sed -n 's/^\s*ssl_certificate_key\s*\(.*\);/\1/p' | head -1) chown <service_user>:<service_group> $TOWER_KEY chmod 600 $TOWER_KEY Note: In containerized deployments (AAP 2.6+), the service user is typically 'rhel' or the mapped UID, not root:awx. Verify the key is owned by the user running the NGINX process.

b
All Automation Controller NGINX web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.
SC-2 - Medium - CCI-001082 - V-256954 - SV-256954r1138072_rule
RMF Control
SC-2
Severity
M
CCI
CCI-001082
Version
APWS-AT-000440
Vuln IDs
  • V-256954
Rule IDs
  • SV-256954r1138072_rule
AIT is important to limit access to Automation Controller nginx web servers and provide access on a need-to-know basis. For example, only System Administrators must have access to all the system's capabilities, while the web administrator and associated staff require access and control of the web content and Automation Controller NGINX web server configuration files. Without close monitoring and control over access to the web server and its resources, there is the risk of unskilled personnel making mistakes, and a risk of characters performing malicious acts.
Checks: C-60629r903528_chk

As a system administrator for each Automation Controller NGINX web server host, enumerate all (nonroot) privileged users on the system: allowed_privileged_users=('root') ; echo "${allowed_privileged_users}" | tr ' ' '\n' &gt;/tmp/allowed_privileged_users ; getent passwd | cut -f1 -d ':' | sudo xargs -L1 sudo -l -U | grep -v 'not allowed' | tail -n +3 | sed -n '/^User/s/User\s*\(\w*\).*/\1/p' | grep -v -f /tmp/allowed_privileged_users 1&gt;/dev/null &amp;&amp; echo "FAILED" ; rm -f /tmp/allowed_privileged_users If "FAILED" is displayed, this is a finding.

Fix: F-60571r902375_fix

As a System Administrator for each Automation Controller NGINX web server host, enumerate all (nonroot) privileged users on the system: getent passwd | cut -f1 -d ':' | sudo xargs -L1 sudo -l -U | grep -v 'not allowed' | tail -n +3 | sed -n '/^User/s/User\s*\(\w*\).*/\1/p' | grep -v root For each user shown, perform one of the following actions: - Remove the indicated user from the system; - Remove the indicated user from any privileged groups (wheel); - Remove login access for the user; - Verify via organizationally defined procedures the indicated user is an authorized administrative account.

b
Cookies exchanged between any Automation Controller NGINX web server and any client, such as session cookies, must have security settings that disallow cookie access outside the originating Automation Controller NGINX web server and hosted application.
SC-23 - Medium - CCI-001664 - V-256955 - SV-256955r1043180_rule
RMF Control
SC-23
Severity
M
CCI
CCI-001664
Version
APWS-AT-000480
Vuln IDs
  • V-256955
Rule IDs
  • SV-256955r1043180_rule
It is important that cookies exchanged between any Automation Controller NGINX webserver and any client have security settings that do not allow cookie access outside the originating Automation Controller server and the hosted application. This is because exchanged cookies may have session information such as user credentials that enable the web server application and the client to maintain a persistent connection. If cookie access outside of the originating Automation Controller NGINX webserver and the hosted application are allowed, it puts the security of the server at risk of malicious acts by bad actors. Satisfies: SRG-APP-000223-WSR-000011, SRG-APP-000439-WSR-000154, SRG-APP-000439-WSR-000155
Checks: C-60630r902377_chk

The Automation Controller application configures cookie properties appropriately by default. Any local modifications to cookie-related settings must be located and removed. As a System Administrator for each Automation Controller NGINX web server host, search for modified cookie variables in the Automation Controller configuration: sudo grep -r -E '(CSRF|SESSION)_COOKIE_(HTTPONLY|SECURE|SAMESITE)' /etc/tower/settings.py /etc/tower/conf.d/ If any output is shown, this is a finding.

Fix: F-60572r902378_fix

As a System Administrator for each Automation Controller NGINX web server host, remove any local variable changes related to cookie properties: sudo grep -r -E '(CSRF|SESSION)_COOKIE_(HTTPONLY|SECURE|SAMESITE)' /etc/tower/settings.py /etc/tower/conf.d/ For each result, edit the relevant file. For example, if a variable is found in /etc/tower/settings.py, edit the file with the following command: sudo -e /etc/tower.settings.py Remove any line where the following variables are defined: SESSION_COOKIE_HTTPONLY SESSION_COOKIE_SECURE SESSION_COOKIE_SAMESITE CSRF_COOKIE_HTTPONLY CSRF_COOKIE_SECURE CSRF_COOKIE_SAMESITE Execute the following command to restart the Automation Controller service: sudo automation-controller-service restart

b
The Automation Controller NGINX web server document directory must be in a separate partition from the web server's system files.
SC-3 - Medium - CCI-001084 - V-256956 - SV-256956r961131_rule
RMF Control
SC-3
Severity
M
CCI
CCI-001084
Version
APWS-AT-000590
Vuln IDs
  • V-256956
Rule IDs
  • SV-256956r961131_rule
It is important that Automation Controller NGINX web server restricts the ability of clients to launch denial-of-service (DoS) attacks against other information systems or networks by disallowing access to system files via document and system file partitioning. DoS attacks are an attempt to negatively affect the availability of the server to end users through directory traversal and URL manipulation. An attack could compromise the end user’s access to websites and applications, which could be critical. If a client is allowed to enable a DoS attack through access to system files, it means that the whole server or network could be shut down. In a best-case scenario, it could deny the user access to required websites and applications, which poses a threat to productivity as well as the need to spend time researching and resolving the attack. This is why it is important that Automation Controller NGINX web server does not allow access to any system files.
Checks: C-60631r903529_chk

Automation Controller serves static public content from the directory /var/lib/awx/public. As a System Administrator for each Automation Controller NGINX web server host, verify that a separate file system/partition has been created for /var/lib/awx/public: [[ $(sudo awk '$0~"/var/lib/awx/public" {print $2}' /etc/fstab) == "/var/lib/awx/public" ]] || echo "FAILED" If "FAILED" is displayed, this is a finding.

Fix: F-60573r902381_fix

As a System Administrator for each Automation Controller NGINX web server host, migrate the "/var/lib/awx/public" path onto a separate file system. No automated fix is available for this action.

b
The Automation Controller NGINX web server must limit the character set used for data entry.
SI-10 - Medium - CCI-001310 - V-256957 - SV-256957r1262579_rule
RMF Control
SI-10
Severity
M
CCI
CCI-001310
Version
APWS-AT-000610
Vuln IDs
  • V-256957
Rule IDs
  • SV-256957r1262579_rule
It is important that Automation Controller NGINX web server limit the character set used for data entry and disallow Unicode use in hosted applications to avoid application compromise. Definition of the available character set for data entry can trap efforts to bypass security checks. The presence of nonstandard characters may cause the browser to interpret the content using a different character set than the defined one, because the system may interpret the content using a different CHARSET. Nonstandard encodings can be used to bypass the application's defensive filters. If character sets for data entry are not defined, it leaves open the door for attackers to bypass security checks and make the server vulnerable to malicious attack.
Checks: C-60632r1262577_chk

As a system administrator (SA) for each Automation Controller NGINX web server, verify the NGINX configuration includes a default charset directive: nginx -T 2&gt;&amp;1 | grep -E '^\s*charset\s' || echo "FAILED" If "FAILED" is displayed, this is a finding. (Note: On a default AAP 2.6 installation, this directive is not present. The fix below must be applied.)

Fix: F-60574r1262578_fix

As an SA for each Automation Controller NGINX web server, add the charset directive to the NGINX configuration. Identify the active configuration files: nginx -T 2>&1 | grep '# configuration file' Edit the server block (within the http {} context) and add: charset utf-8; Validate and reload: nginx -t && systemctl reload nginx For containerized deployments, apply the directive within the container's NGINX configuration and restart the container service.

b
The Automation Controller NGINX web server must display a default hosted application web page, not a directory listing, when a requested web page cannot be found.
SI-11 - Medium - CCI-001312 - V-256958 - SV-256958r961167_rule
RMF Control
SI-11
Severity
M
CCI
CCI-001312
Version
APWS-AT-000620
Vuln IDs
  • V-256958
Rule IDs
  • SV-256958r961167_rule
It is important that Automation Controller NGINX web server display a default hosted application web paged and not a directory listing when a requested web page cannot be found, because the web server will be vulnerable to intrusion. For this reason, access to directory listings must be disabled. If a user or attacker have access to the website directory listing, they may have access to all the files in that folder. Additionally, they may be privy to specific details regarding the web server.
Checks: C-60633r903555_chk

For each Automation Controller NGINX web server, a system administrator must view to see whether autoindex is turned on or off (autoindex on/autoindex off): NGINXCONF=`nginx -V 2&gt;&amp;1 | tr ' ' '\n' | sed -ne '/conf-path/{s/.*conf-path=\(.*\)/\1/;p}' ` ; grep -E 'autoindex\s+on' $NGINXCONF &amp;&amp; echo "FAILED" If "FAILED" is displayed, this is a finding.

Fix: F-60575r902387_fix

As a System Administrator for each Automation Controller nginx web server host, remove any configuration that turns the autoindexing on: NGINXCONF=`nginx -V 2>&1 | tr ' ' '\n' | sed -ne '/conf-path/{s/.*conf-path=\(.*\)/\1/;p}' ` ; sed -Ei -e '/autoindex\s+on/d;' $NGINXCONF To apply these changes to the running service immediately, restart the NGINX service with the following command: sudo systemctl restart nginx

b
Debugging and trace information, within Automation Controller NGINX web server, used to diagnose the web server must be disabled.
SI-11 - Medium - CCI-001312 - V-256959 - SV-256959r1262582_rule
RMF Control
SI-11
Severity
M
CCI
CCI-001312
Version
APWS-AT-000640
Vuln IDs
  • V-256959
Rule IDs
  • SV-256959r1262582_rule
It is important that Automation Controller NGINX web server debugging and trace information used to diagnose the web server is disabled, because debugging information can yield information about the Automation Controller NGINX webserver, like web server type, version, patches installed, plugins, modules, the hosted app’s code type. Back ends used for storage could be revealed, as well. An attacker would not need to cause an error condition to gain this information because they could reside in logs and general messages. If debugging/trace information is enabled, attackers could get the information from logs and general information, without drawing attention to themselves via an error message.
Checks: C-60634r1262580_chk

For each Automation Controller NGINX web server, a system administrator must check to determine if any error or debug information is being logged to a persistent file (not stdout/stderr): nginx -T 2&gt;&amp;1 | grep '^\s*error_log' | grep -v '/dev/stdout\|/dev/stderr\|/dev/null' &amp;&amp; echo FAILED If "FAILED" is displayed, this is a finding. Note: In containerized deployments (AAP 2.6+), error_log /dev/stdout error; is the expected configuration - container runtimes collect stdout via journald or the container logging driver. This is NOT a finding. Only error_log directives pointing to persistent files on disk constitute a finding.

Fix: F-60576r1262581_fix

For each Automation Controller NGINX web server, identify the active configuration files: nginx -T 2>&1 | grep '# configuration file' If error_log points to a file on disk, either remove the directive or redirect to /dev/stdout: error_log /dev/stdout error; Cause NGINX to reload its configuration file: pkill -HUP nginx

b
Nonprivileged accounts on the hosting system must only access Automation Controller NGINX web server security-relevant information and functions through a distinct administrative account.
SC-2 - Medium - CCI-001082 - V-256960 - SV-256960r961353_rule
RMF Control
SC-2
Severity
M
CCI
CCI-001082
Version
APWS-AT-000700
Vuln IDs
  • V-256960
Rule IDs
  • SV-256960r961353_rule
It is important that Automation Controller NGINX web server security features are separated from nonprivileged users. Special “privileged” roles need to be developed so that only they can have access to those features and administer the web server, when necessary. These privileged roles will be better trained in the security features and will limit loss of data for forensic analysis and limits accidental changes to the web server. Without isolating privileged users from nonprivileged users when administering to the web server, organizations run the risk of having limited access to forensic data, as well as increased risk of accidental changes, by nonprivileged and presumably less-trained individuals. Satisfies: SRG-APP-000340-WSR-000029, SRG-APP-000211-WSR-000031
Checks: C-60635r903547_chk

As a system administrator, for each Automation Controller NGINX web server host, inspect the current permissions and owner of Tower's web server configuration directory: stat -c "%a %U %G" /etc/nginx | grep -q "755 root root" || echo "FAILED" stat -c "%a %U %G" /etc/nginx/conf.d | grep -q "755 root root" || echo "FAILED" stat -c "%a %U %G" /etc/nginx/nginx.conf | grep -q "644 root root" || echo "FAILED" If "FAILED" is displayed, this is a finding. Inspect the current permissions and owner of Automation Controller web server program configuration files: stat -c "%a %U %G" /usr/lib/systemd/system/nginx.service | grep -q "644 root root" || echo "FAILED" If "FAILED" is displayed, this is a finding. Inspect the current permissions and owner of Automation Controller application content directory: stat -c "%a %U %G" /var/lib/awx/public/static | grep -q "755 root awx" || echo "FAILED" If "FAILED" is displayed, this is a finding. Inspect the current permissions and owner of Automation Controller web server log directory: stat -c "%a %U %G" /var/log/nginx| grep -q "770 nginx root" || echo "FAILED" If "FAILED" is displayed, this is a finding.

Fix: F-60577r902393_fix

As a system administrator, for each Automation Controller NGINX web server host, set the permissions and owner of Automation Controller web server program configuration directory: sudo chown -R root:root /etc/nginx/ sudo chmod 755 /etc/nginx /etc/nginx sudo chmod 755 /etc/nginx /etc/nginx/conf.d sudo chmod 644 /etc/nginx/nginx.conf As a system administrator, for each Automation Controller NGINX web server program configuration files. sudo chown root:root /usr/lib/systemd/system/nginx.service sudo chmod 644 /usr/lib/systemd/system/nginx.service Set the permissions and owner of Automation Controller application content directory: sudo chmod 755 /var/lib/awx/public/static sudo chown root:awx /var/lib/awx/public/static

b
The Automation Controller NGINX web server application, libraries, and configuration files must only be accessible to privileged users.
CM-5 - Medium - CCI-001813 - V-256961 - SV-256961r961461_rule
RMF Control
CM-5
Severity
M
CCI
CCI-001813
Version
APWS-AT-000780
Vuln IDs
  • V-256961
Rule IDs
  • SV-256961r961461_rule
Automation Controller NGINX web servers can be modified through parameter modification, patch installation, upgrades to the web server or modules, and security parameter changes. With each of these changes, there is the potential for an adverse effect such as a DoS, web server instability, or hosted application instability. To limit changes to Automation Controller NGINX web servers and limit exposure to any adverse effects from the changes, files such as the web server application files, libraries, and configuration files must have permissions and ownership set properly to only allow privileged users access.
Checks: C-60636r902395_chk

As a System Administrator for each Automation Controller NGINX web server host, check that the file permissions for the web server components require privileged access: $ [ `find /etc/nginx -type f -not -perm 644 | wc -l` -gt 0 ] &amp;&amp; echo "FAILED" If "FAILED" is displayed, this is a finding.

Fix: F-60578r902396_fix

As a System Administrator for each Automation Controller NGINX web server host, modify the file permissions for the web server components require privileged access: chmod -R 644 /etc/nginx && chown -R nginx /etc/nginx

b
The Automation Controller NGINX web server must be protected from being stopped by a nonprivileged user.
SC-5 - Medium - CCI-002385 - V-256962 - SV-256962r1262585_rule
RMF Control
SC-5
Severity
M
CCI
CCI-002385
Version
APWS-AT-000830
Vuln IDs
  • V-256962
Rule IDs
  • SV-256962r1262585_rule
An attacker has at least two reasons to stop an Automation Controller NGINX web server. The first is to cause a DoS, and the second is to put in place changes the attacker made to an Automation Controller NGINX web server configuration. To prohibit an attacker from stopping the Automation Controller NGINX web server, the process ID (PID) of the web server and the utilities used to start/stop the web server must be protected from access by nonprivileged users. By knowing the PID and having access to the Automation Controller NGINX web server utilities, a nonprivileged user has a greater capability of stopping the server, whether intentionally or unintentionally.
Checks: C-60637r1262583_chk

As a system administrator (SA) for each Automation Controller NGINX web server host, verify required service definition is protected from unprivileged users: stat -c "%a %U %G" /usr/lib/systemd/system/automation-controller.service | grep -q "644 root root" || echo "FAILED" stat -c "%a %U %G" /usr/lib/systemd/system/supervisord.service | grep -q "644 root root" || echo "FAILED" stat -c "%a %U %G" /usr/lib/systemd/system/nginx.service | grep -q "644 root root" || echo "FAILED" If "FAILED" is displayed, this is a finding. Verify the required services are enabled: systemctl is-enabled automation-controller.service &gt;/dev/null || echo FAILED systemctl is-enabled supervisord.service &gt;/dev/null || echo FAILED systemctl is-enabled nginx.service &gt;/dev/null || echo FAILED If "FAILED" is displayed, this is a finding. Verify application services are correctly managed by supervisord. Verify protection of and capture supervisord configuration. stat -c "%a %U %G" /etc/supervisord.d/*.ini | grep -q "644 root root" || echo "FAILED" cat /etc/supervisord.d/*.ini | sed -n -E "/^\[.*\]/{s/\[(.*)\]/\1/;h;n;};/^[a-zA-Z]/{s/#.*//;G;s/([^ ]*) *= *(.*)\n(.*)/\3_\1='\2'/;p;}" &gt; /tmp/supervisord.parsed.conf Verify specific start and restart properties for application services: application_services=(program:awx-dispatcher_autostart program:awx-dispatcher_autorestart program:awx-uwsgi_autostart program:awx-uwsgi_autorestart program:awx-daphne_autostart program:awx-daphne_autorestart program:awx-rsyslogd_autostart program:awx-rsyslogd_autorestart) for SUPERVISOR_CHECK in ${application_services[@]}; do grep $SUPERVISOR_CHECK /tmp/supervisord.parsed.conf | grep -q true || echo "FAILED" ; done rm /tmp/supervisord.parsed.conf If "FAILED" is displayed, this is a finding.

Fix: F-60579r1262584_fix

As an SA for each Automation Controller NGINX web server host, set the permissions correctly on the nginx service file: sudo chown root:root /usr/lib/systemd/system/nginx.service sudo chmod 644 /usr/lib/systemd/system/nginx.service Reset the Ansible Automation Platform configuration to the defaults, which meet the requirements for the supervisord and automation-controller services. Locate the inventory file used to install Ansible Automation Platform (usually in the installer directory). Run the setup.sh command in the installer directory to reconfigure the controller to use the new setting: sudo ./setup.sh

c
The Automation Controller NGINX web server must employ cryptographic mechanisms (TLS/DTLS/SSL) to prevent the unauthorized disclosure of information during transmission.
SC-8 - High - CCI-002418 - V-256963 - SV-256963r1016551_rule
RMF Control
SC-8
Severity
H
CCI
CCI-002418
Version
APWS-AT-000850
Vuln IDs
  • V-256963
Rule IDs
  • SV-256963r1016551_rule
Preventing the disclosure of transmitted information requires that the Automation Controller web server take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS). Transmission of data can take place between the web server and a large number of devices/applications external to the web server. Examples are a web client used by a user, a backend database, an audit server, or other web servers in a web cluster. If data is transmitted unencrypted, the data then becomes vulnerable to disclosure. The disclosure may reveal user identifier/password combinations, website code revealing business logic, or other user personal information. Satisfies: SRG-APP-000439-WSR-000151, SRG-APP-000439-WSR-000152, SRG-APP-000442-WSR-000182, SRG-APP-000429-WSR-000113
Checks: C-60638r1016549_chk

As a System Administrator for each Automation Controller NGINX web server host, enumerate all available server connections: NGINXCONF=$(nginx -V 2&gt;&amp;1 | tr ' ' '\n' | sed -ne '/conf-path/{s/.*conf-path=\(.*\)/\1/;p}') grep '\s*listen' NGINXCONF | grep -v ssl Ensure each available server connection that does not use SSL upgrades this connection to use SSL via an allowed method: - is redirected to an SSL server connection, e.g., "return 301 https://$host:443$request_uri"; - is rewritten to an SSL server URL, e.g., "rewrite ^ https://$host$request_uri? permanent;"; - is dropped silently; - or used other organizationally approved connection handling. Examine the NGINX configuration, for example: vi $NGINXCONF If any available server connection is not handled or upgraded to SSL via an organizationally approved method, this is a finding. vi $NGINXCONF If any available server connection is not handled or upgraded to SSL via an organizationally approved method, this is a finding.

Fix: F-60580r1016550_fix

As a System Administrator for each Automation Controller NGINX web server host, for each available server connection that is not handled or upgraded to SSL via an organizationally approved method, perform one of the following actions: Remove the available server connections. OR Upgrade the connection via redirect to an SSL server connection. OR Rewrite the connection URL to an HTTPS server connection. OR Other organizationally defined handling method. Reload the NGINX server configuration by executing the following: pkill -HUP nginx (Alternatively, reinstall Automation Controller for each web server host.)

b
Automation Controller NGINX web servers must maintain the confidentiality of controlled information during transmission through the use of an approved TLS version.
SC-8 - Medium - CCI-002418 - V-256964 - SV-256964r1262588_rule
RMF Control
SC-8
Severity
M
CCI
CCI-002418
Version
APWS-AT-000900
Vuln IDs
  • V-256964
Rule IDs
  • SV-256964r1262588_rule
Transport Layer Security (TLS) is a required transmission protocol for a web server hosting controlled information. The use of TLS provides confidentiality of data in transit between the web server and client. FIPS 140-2 approved TLS versions must be enabled and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 defines the approved TLS versions for government applications.
Checks: C-60639r1262586_chk

As a system administrator (SA), for each Automation Controller NGINX web server, validate the TLS version configuration: nginx -T 2&gt;&amp;1 | grep ssl_protocols | grep -E 'ssl_protocols\s+TLSv1.2;' || echo "FAILED" If "FAILED" is displayed, this is a finding.

Fix: F-60581r1262587_fix

As an SA, identify the active NGINX configuration files: nginx -T 2>&1 | grep '# configuration file' Edit the relevant configuration file. Replace or add the ssl_protocols line: ssl_protocols TLSv1.2; Save the file and restart NGINX: sudo systemctl restart nginx

b
The Automation Controller NGINX web servers must maintain the confidentiality and integrity of information during preparation for transmission.
SC-8 - Medium - CCI-002420 - V-256965 - SV-256965r1262590_rule
RMF Control
SC-8
Severity
M
CCI
CCI-002420
Version
APWS-AT-000920
Vuln IDs
  • V-256965
Rule IDs
  • SV-256965r1262590_rule
Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. An example of this would be an SMTP queue. This queue may be added to a web server through an SMTP module to enhance error reporting or to allow developers to add SMTP functionality to their applications. Any modules used by the web server that queue data before transmission must maintain the confidentiality and integrity of the information before the data is transmitted.
Checks: C-60640r1262589_chk

As a system administrator (SA) for each Automation Controller NGINX web server host, verify the NGINX web server configuration file in use is located at "/etc/nginx/nginx.conf": NGINXCONF=`nginx -V 2&gt;&amp;1 | tr ' ' '\n' | sed -ne '/conf-path/{s/.*conf-path=\(.*\)/\1/;p}' ` If the file does not exist, this is a finding. Verify the use of only dynamic modules witch are allowed by organizational policy: allowed_modules=(ssl_module http_v2_module http_realip_module http_addition_module http_xslt_module=dynamic http_image_filter_module=dynamic http_sub_module http_dav_module http_mp4_module http_gunzip_module http_gzip_static_module http_random_index_module http_secure_link_module http_degradation_module http_slice_module http_stub_status_module http_perl_module=dynamic http_auth_request_module mail_ssl_module stream_ssl_module stream_ssl_preread_module http_flv_module stream_realip_module) echo "${allowed_modules[*]}" | tr ' ' '\n' &gt; /tmp/allowed_modules nginx -V 2&gt;&amp;1 | grep module | tr ' ' '\n' | grep module | grep -v modules-path | sed 's/--with-//g' | grep -v -Ff /tmp/allowed_modules &amp;&amp; echo "FAILED" Verify the use of only runtime modules which are allowed by organizational policy: nginx -T 2&gt;&amp;1 | grep load_module | sed -n 's/^\s*load_module\s*\(.*\)/\1/p' | grep -v -Ff /tmp/allowed_modules &amp;&amp; echo "FAILED"; rm -f /tmp/allowed_modules If the output shows "FAILED", this is a finding.

Fix: F-60582r1155092_fix

As an SA for each Automation Controller NGINX web server host, verify the NGINX web server configuration file in use is located at "/etc/nginx/nginx.conf": NGINXCONF=`nginx -V 2>&1 | tr ' ' '\n' | sed -ne '/conf-path/{s/.*conf-path=\(.*\)/\1/;p}' ` ; Verify the location of the NGINX modules libraries: pushd `nginx -V 2>&1 | grep module | tr ' ' '\n' | grep module | sed -n 's/.*modules-path.*=\s*\(.*\)/\1/p'` Remove all modules that violate organizationally defined policy. Examine runtime loaded modules: grep load_module nginx.conf.test | sed -n 's/^\s*load_module\s*\(.*\)/\1/p' Remove all modules that violate organizationally defined policy. Examine the remainder of the modules: nginx -V 2>&1 | grep module | tr ' ' '\n' | grep module | grep -v modules-path These modules are compiled into the core NGINX binaries are cannot be removed. Use of any these modules that violate organizationally defined policy must be mitigated. To apply these changes to the running service immediately, restart the NGINX service with the following command: sudo systemctl restart nginx Alternatively, reinstall Automation Controller for each web server host.

b
Automation Controller NGINX web servers must install security-relevant software updates within the configured time period directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).
SI-2 - Medium - CCI-002605 - V-256966 - SV-256966r1138080_rule
RMF Control
SI-2
Severity
M
CCI
CCI-002605
Version
APWS-AT-000940
Vuln IDs
  • V-256966
Rule IDs
  • SV-256966r1138080_rule
Security flaws with software applications are discovered daily. Red Hat constantly updates and patches Automation Controller to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously. The Automation Controller NGINX web server will be configured to check for and install security-relevant software updates from an authoritative source within an organizationally identified time period from the availability of the update. By default, this time period will be every 24 hours.
Checks: C-60641r902410_chk

As a System Administrator for each Automation Controller NGINX web server host, verify the system is configured to receive updates from an organizationally defined source for authoritative system updates: yum -v repolist If each URL is not valid and consistent with organizationally defined requirements, this is a finding. If each repository is not enabled in accordance with organizationally defined requirements, this is a finding. If the system is not configured to automatically receive and apply system updates from this source at least every 30 days, or manually receive and apply updates at least every 30 days, this is a finding.

Fix: F-60583r903536_fix

As a system administrator, for each Automation Controller NGINX web server host, perform the following: 1. Either configure update repositories in accordance with organizationally defined requirements or subscribe to Red Hat update repositories for the underlying operating system. 2. Execute an update from these repositories: $ yum update -y 3. Perform one of the following: 3.1. Schedule an update to occur every 30 days, or in accordance with organizationally defined policy: $ yum install -y dnf-automatic && sed -i '/apply_updates/s/no/yes/' /etc/dnf/automatic.conf && sed -i '/OnCalendar/s/^OnCalendar\s*=.*/OnCalendar=*-1-* 6:00/' /usr/lib/systemd/system/dnf-automatic.timer && systemctl enable --now dnf-automatic.timer 3.2. Schedule manual updates to occur at least every 30 days, or in accordance with organizationally defined policy. 4. Restart the Automation Controller NGINX web server host.

b
All accounts installed with the Automation Controller NGINX web server's software and tools must have passwords assigned and default passwords changed.
CM-6 - Medium - CCI-000366 - V-256967 - SV-256967r961863_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
APWS-AT-000950
Vuln IDs
  • V-256967
Rule IDs
  • SV-256967r961863_rule
During installation of the Automation Controller NGINX web server software, accounts are created for the web server to operate properly. The accounts installed can have either no password installed or a default password, which will be known and documented by the vendor and the user community. The first thing an attacker will try when presented with a login screen are the default user identifiers with default passwords. Installed applications may also install accounts with no password, making the login even easier. Once the Automation Controller NGINX web server is installed, the passwords for any created accounts must be changed and documented. The new passwords must meet the requirements for all passwords (i.e., upper/lower characters, numbers, special characters, time until change, reuse policy, etc.). Service accounts or system accounts that have no login capability do not need to have passwords set or changed.
Checks: C-60642r903537_chk

As a System Administrator for each Automation Controller NGINX web server host, verify the NGINX account is configured to disallow interactive login" grep '^nginx.*\(/sbin/nologin$\|/bin/false$\)' /etc/passwd If "FAILED" is displayed, this is a finding.

Fix: F-60584r902414_fix

As a System Administrator for each Automation Controller NGINX web server host, change the NGINX account to disallow interactive login: $ usermod -s /sbin/nologin nginx