What changed in Red Hat Ansible Automation Controller Application Server STIG V2R4V2R4 changes

Check text

As a Systemsystem Administratoradministrator (SA) for each Automation Controller host, navigate to the Automation Controller web administrator console: Settings >> System >> Miscellaneous Authentication settings. Verify the "Maximum Number of simultaneous logged in sessions" field is set according to policy. If this configuration setting does not match the organizationally defined maximum, or is set to -1 (negative one), this is a finding.

Fix text

As aan SystemSA Administrator for each Automation Controller host, navigate to the Automation Controller web administrator console: Settings >> System >> Miscellaneous Authentication settings. Click "Edit". Change "Maximum Number of simultaneous logged in sessions" to match the organizationally defined maximum or greater than 0. Click "Save".

Discussion

Application management includes the ability to control the number of sessions that utilize an application by all accounts and/or account types. Limiting the number of allowed sessions is helpful in limiting risks related to denial-of-service attacks. Automation Controllers host and expose business logic and application processes. Automation Controller limits the maximum number of concurrent sessions in a manner that affects the entire application server or on an individual application basis. The settings must follow DODDoW-recommended values, but the settings should be configurable to allow for future DODDoW direction. While the DODDoW will specify recommended values, the values can be adjusted to accommodate the operational requirement of a given system. Satisfies: SRG-APP-000001-AS-000001, SRG-APP-000295-AS-000263

V-256896 in V2R4

Title

The Automation Controller management interface must display the Standard Mandatory DODoW Notice and Consent Banner before granting access to the system.

Check text

Navigate to the Automation Controller login page. Verify that the Standard Mandatory DODDoW Notice and Consent Banner is displayed with the following text: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If the required DODDoW banner is not displayed on the login page or the CUSTOM_LOGIN_INFO does not contain the correct text, this is a finding. Alternatively, verify the setting CUSTOM_LOGIN_INFO setting in the REST API at /api/v2/settings/ui by running the following command: curl https://&ltAutomation Controller HOST>/api/v2/settings/ui

Discussion

Automation Controller is required to display the Standard Mandatory DODDoW Notice and Consent Banner before granting access to the system management interface, providing privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance that states that: (i) users are accessing a U.S. Government information system; (ii) system usage may be monitored, recorded, and subject to audit; (iii) unauthorized use of the system is prohibited and subject to criminal and civil penalties; and (iv) the use of the system indicates consent to monitoring and recording. System use notification messages can be implemented in the form of warning banners displayed when individuals log on to the information system. System use notification is intended only for information system access including an interactive logon interface with a human user, and is not required when an interactive interface does not exist. Automation Controller supports displaying the Standard Mandatory DODDoW Notice and Consent Banner prior to logging in via the web console. Satisfies: SRG-APP-000068-AS-000035, SRG-APP-000069-AS-000036

V-256899 in V2R4

Discussion

Automation Controller must be configured to use external logging to compile log records from multiple components within the server. The events occurring must be time-correlated in order to conduct accurate forensic analysis. In addition, the correlation must meet certain tolerance criteria. For instance, DODDoW may define that the time stamps of different logged events must not differ by any amount greater than ten seconds. Automation Controller must utilize an external logging tool that provides this capability. Satisfies: SRG-APP-000080-AS-000045, SRG-APP-000086-AS-000048, SRG-APP-000108-AS-000067, SRG-APP-000125-AS-000084, SRG-APP-000181-AS-000255, SRG-APP-000358-AS-000064, SRG-APP-000505-AS-000230, SRG-APP-000506-AS-000231, SRG-APP-000515-AS-000203

V-256900 in V2R4

Check text

AdministratorAs musta check,system administrator (SA) for each Automation Controller host, verify the rsyslogexternal logging configuration tovia verify the logAPI: curl rollover-sk against-u an&ltadmin_user>:&ltpassword> organizationallyhttps://&ltcontroller_fqdn>/api/controller/v2/settings/logging/ defined| logpython3 capture-m sizejson.tool CheckVerify LOG_AGGREGATOR_MAX_DISK_USAGE_GB field in the Automationfollowing Controllerfields configuration. Onare theconfigured host,per executeorganizational requirements: awx-manage print_settingsLOG_AGGREGATOR_HOST LOG_AGGREGATOR_MAX_DISK_USAGE_GB If this field is not set to the organizationally defined log captureaggregator - sizeLOG_AGGREGATOR_PORT is set appropriately - LOG_AGGREGATOR_ENABLED is true If external logging is not configured, this is a finding. CheckVerify LOG_AGGREGATOR_MAX_DISK_USAGE_PATHthe fieldlocal infilesystem thehas Automationadequate Controllercapacity configuration for the log filebuffering: df location-h to "/var/liblog/awx". OnIf theavailable host,space execute: awx-managedoes print_settingsnot LOG_AGGREGATOR_MAX_DISK_USAGE_PATHmeet Ifthe thisorganizationally fielddefined isrequirement notfor setlog to "/var/lib/awx"buffering, this is a finding.

Fix text

OpenAs aan webSA, browserconfigure andthe navigateexternal tolog aggregator via the API: curl -sk -u &ltadmin_user>:&ltpassword> -X PATCH -H "Content-Type: application/json" https://&ltAutomation Controller serverltcontroller_fqdn>/api/controller/v2/settings/logging/ (If the-d '{"Log InLOG_AGGREGATOR_HOST": button is displayed"&ltorg_log_host>", click"LOG_AGGREGATOR_PORT": it&ltport>, enter"LOG_AGGREGATOR_ENABLED": an Automation Controller administratortrue}'s credentials, and continue.) InEnsure the Content/var/log/ section,partition modifymeets the followingorganizationally values: LOG_AGGREGATOR_MAX_DISK_USAGE_GB = organization-defined requirement for log buffering. LOG_AGGREGATOR_MAX_DISK_USAGE_PATH = "/var/lib/awx" Click "PUT"capacity.

V-256901 in V2R4

Check text

As an administrator, log intoin to each Automation Controller host. Inspect the current permissions and owner of Automation Controller's NGINX log directory: stat -c "%a %U %G" /var/log/nginx/ | grep "770 nginx root" || echo "FAILED" If "FAILED" is displayed, this is a finding. Inspect the current permissions and owner of Automation Controller's log directory: $ stat -c "%a %U %G" /var/log/tower/ | grep "750 awx awx" || echo "FAILED" If "FAILED" is displayed, this is a finding. Inspect the current permissions and owner of Automation Controller's supervisor log directory: stat -c "%a %U %G" /var/log/supervisor/ | grep "770 root root" || echo "FAILED" If "FAILED" is displayed, this is a finding.

Fix text

As a system administrator for each Automation Controller host, set the permissions and owner of Automation Controller's NGINX log directory: chmod 770 /var/log/nginx chown nginx:root /var/log/nginx Set the permissions and owner of Automation Controller's log directory: chmod 770750 /var/log/tower chown awx:awx /var/log/tower Set the permissions and owner of Automation Controller's supervisor log directory: chmod 770 /var/log/supervisor/ chown root:root /var/log/supervisor/

V-256903 in V2R4

Check text

As an administrator, log in to each Automation Controller host. Verify the correct Red Hat RPM signing key is available on each host by listing the keys using the following command: rpm -qa gpg-pubkey* Manually inspect against publicly listed keys on https://www.redhat.com. If the keys do not match, this is a finding. Import the key usingif the following commandmissing: rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release Verify the signaturesintegrity of installed RPMs necessary for Automation Controller: For RPM in $(rpm -qa);Va do rpm -K-nofiles --nosignaturenoconfig ${RPM}2>/dev/null | grep "NOT-v OK"'^$' && returnecho 1;"FINDING" done|| ; echo "FAILEDPASSED" If this outputs "FAILEDFINDING" is displayed, investigate the modified files. If modifications are unauthorized, this is a finding.

V-256908 in V2R4

Title

Automation Controller must only allow the use of DODoW PKI-established certificate authorities for verification of the establishment of protected sessions.

Check text

The Administrator must check the Automation Controller configuration. Download the latest DODDoW PKI CA certificate bundle: curl https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/zip/certificates_pkcs7_DODcertificates_pkcs7_DoW.zip > /root/certificates_pkcs7_DODcertificates_pkcs7_DoW.zip && gunzip /root/certificates_pkcs7_DODcertificates_pkcs7_DoW.zip Check the certificate at /etc/tower/tower.cert: openssl verify -verbose -x509_strict -CAfile /root/certificates_pkcs7_DODcertificates_pkcs7_DoW.pem -CApath nosuchdir &lt(cat /etc/tower/tower.cert >>&ltorganizationally defined intermediate certificate file in PEM format>>>) If the >>&ltorganizationally defined intermediate certificate file in PEM format>>> does not exist, this is a finding. Check the certificate at /etc/tower/tower.key: openssl verify -CAfile /root/certificates_pkcs7_DODcertificates_pkcs7_DoW.pem /etc/tower/tower.cert If the >>&ltorganizationally defined intermediate certificate file in PEM format>>> does not exist, this is a finding. Check the trusted ca certificate: openssl x509 -in /etc/pki/ca-trust/tls-ca-bundle.pam custom_ca_cert If the >>&ltorganizationally defined intermediate certificate file in PEM format>>> does not exist, this is a finding. If the >>&ltorganizationally defined intermediate certificate file in PEM format>>> does not exist, this is a finding.

Fix text

For each Automation Controller host, the administrator must: Download the >>&ltorganizationally defined intermediate certificate file in PEM format>>>; Generate the appropriate /etc/tower/tower.key files, certificates, and CSRs and have the organizationally defined PKI authority issue a certificate signed by the >>&ltorganizationally defined intermediate certificate file in PEM format>>>; Place the signed certificate in /etc/tower/tower.cert. Place the >>&ltorganizationally defined intermediate certificate file in PEM format>>> in /etc/pki/ca-trust/source/anchors. Execute: update-ca-trust extract && update-ca-trust; Download the latest DODDoW PKI CA certificate bundle: curl https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/zip/certificates_pkcs7_DODcertificates_pkcs7_DoW.zip > /root/certificates_pkcs7_DODcertificates_pkcs7_DoW.z && gunzip /root/certificates_pkcs7_DODcertificates_pkcs7_DoW.z > /etc/pki/ca-trust/source/anchors Install trusted root and intermediate CA certificates: update-ca-trust extract && update-ca-trust;

V-256910 in V2R4