All Automation Controller NGINX web servers must be configured to use a specified IP address and port.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-256952	SRG-APP-000142-WSR-000089	APWS-AT-000370	SV-256952r960966_rule	2024-08-27	2

Description
From a security perspective, it is important that all Automation Controller NGINX web servers are configured to use a specified IP address and port because “listening” on all IP addresses poses a vulnerability to the web server. Not confining the web server to a specified IP address and port puts all web server content at risk of access by bad actors wanting to take advantage of those resources.

Description

From a security perspective, it is important that all Automation Controller NGINX web servers are configured to use a specified IP address and port because “listening” on all IP addresses poses a vulnerability to the web server. Not confining the web server to a specified IP address and port puts all web server content at risk of access by bad actors wanting to take advantage of those resources.

ℹ️ Check
As a System Administrator for each Automation Controller NGINX web server host, verify the web server is configured to use a static IP address and port. NGINXCONF=`nginx -V 2>&1 \| tr ' ' '\n' \| sed -ne '/conf-path/{s/.conf-path=\(.\)/\1/;p}' ` ; grep '^\slisten\s\\\|\slisten\s\[.\]\\|\slisten\s0\.0\.0\.0\\|\slisten\s\[.\]\|^\slisten\s\+.:[^[:digit:]\s]\+.' $NGINXCONF && echo FAILED If "FAILED" is displayed, this is a finding.

ℹ️ Check

As a System Administrator for each Automation Controller NGINX web server host, verify the web server is configured to use a static IP address and port. NGINXCONF=`nginx -V 2>&1 | tr ' ' '\n' | sed -ne '/conf-path/{s/.*conf-path=$.*$/\1/;p}' ` ; grep '^\s*listen\s*\*\|\s*listen\s*\[.*\]\|\s*listen\s*0\.0\.0\.0\|\s*listen\s*\[.*\]|^\s*listen\s\+.*:[^[:digit:]\s]\+.*' $NGINXCONF && echo FAILED If "FAILED" is displayed, this is a finding.

✔️ Fix
As a System Administrator for each Automation Controller NGINX web server host, identify the allowed and/or designated IP address(es) for the Automation Controller system. Replace any wildcard or ranged IP address references in the NGINX configuration with IP addresses from the pool of allowed and/or designated address. Reload the NGINX server configurations for all NGINX processes: $ pkill -HUP nginx

✔️ Fix

As a System Administrator for each Automation Controller NGINX web server host, identify the allowed and/or designated IP address(es) for the Automation Controller system. Replace any wildcard or ranged IP address references in the NGINX configuration with IP addresses from the pool of allowed and/or designated address. Reload the NGINX server configurations for all NGINX processes: $ pkill -HUP nginx