What changed in Red Hat Ansible Automation Controller Web Server STIG V2R4V2R4 changes

Check text

1. Web Server Must Enforce TLS 1.2 or Higher: As a system administrator for each Automation Controller NGINX web server, validate the effective TLS protocol configuration. Obtain the active nginx.conf path: NGINXCONF=$(nginx -VT 2>&1 | tr ' ' '1n' | sed -ne '/conf-path/{s/.*conf-path=1(.*1)/11/;p}') Execute the following command: sudo grep -E '^[[:space:]]*ssl_protocols[[:space:]]+.*' | grep -E '(TLSv11.2|TLSv11.3)' "$NGINXCONF" > /dev/null || echo "FAILED" Pass condition: ssl_protocols includes TLSv1.2 or TLSv1.3. Fail condition: ssl_protocols missing, or only legacy protocols configured. If "FAILED" is displayed, this is a finding. 2. Web Server Must Use Host OS–-Provided Cipher Policy.: Validate the cipher suite binding is set to the system crypto policy. Obtain the active nginx.conf path: NGINXCONF=$(nginx -VT 2>&1 | tr ' ' '1n' | sed -ne '/conf-path/{s/.*conf-path=1(.*1)/11/;p}') Execute the following command: sudo grep -Eq '^[[:space:]]*ssl_ciphers[[:space:]]+PROFILE=SYSTEM[[:space:]]*;[[:space:]]*$' "$NGINXCONF" || echo "FAILED" Pass condition: ssl_ciphers PROFILE=SYSTEM; (exact directive, whitespace-tolerant). If "FAILED" is displayed, this is a finding. 3. External Database Connections Must Use TLS With Certificate Verification. Automation Controller may be configured to connect to PostgreSQL databases with or without TLS. The Administrator must check the contents of the file at /etc/tower/conf.d/postgres.py with root permissions to determine if pg_sslmode was configured with "verify-full" for any external databases at the time of installation. 3.1 Client-Side Execute the following command: sudo python3 -c 'exec(open("/etc/tower/conf.d/postgres.py").read()); import sys; bad=[n for n,c in DATABASES.items() if c.get("HOST") not in ("127.0.0.1","localhost","") and c.get("OPTIONS",{}).get("sslmode")!="verify-full"]; sys.exit(0 if not bad else 1)' || echo "FAILED" If "FAILED" is displayed, this is a finding. 3.2 Server-Side Confirm the database server negotiates TLS. Get DB host:port for the default connection: PGCON=$(sudo python3 -c 'exec(open("/etc/tower/conf.d/postgres.py").read()); import sys; d=DATABASES.get("default",{}); h=d.get("HOST",""); p=d.get("PORT",""); print(f"{h}:{p}" if h and p else "", end="")') Validate SSL with psql (requires psql client): test -n "$PGCON" && psql "postgresql://${PGCON}/postgres?sslmode=require" -qAt -c '1conninfo' 2>/dev/null | grep -qi 'SSL connection' || echo "FAILED" If "FAILED" is displayed, this is a finding.

Fix text

Web Server TLS and Cipher Configuration As a system administrator for each Automation Controller NGINX web server: 1. Identify the active NGINX configuration filefiles: NGINXCONF=$(nginx -VT 2>&1 | trgrep '# 'configuration file'1n' | sed -ne '/conf-path/{s/.*conf-path=1(.*1)/11/;p}') 2. Edit the configuration: sudorelevant -eserver "$NGINXCONF"block configuration file. 3. Ensure the ssl_protocols line: ssl_protocols isTLSv1.2 configuredTLSv1.3; Ensure asssl_ciphers line: ssl_ciphers PROFILE=SYSTEM; (note the leading spaces): " ssl_protocolsssl_ciphers TLSv1.2 TLSv1.3PROFILE=SYSTEM;") If the directive does not exist, add it immediately after the ssl_ciphers line. 4. Ensure the ssl_ciphers line is configured as(note the leading spaces): " ssl_ciphers PROFILE=SYSTEM;" 5. Save the file and apply the changes: sudo nginx -t && sudo systemctl restart nginx Database TLS Configuration 1. Edit the Ansible Automation Platform installer inventory file and set: pg_sslmode='verify-full' postgres_use_ssl=true 2. Reconfigure the controller: sudo ./setup.sh

Discussion

The Automation Controller communicates information about configuration of other information systems through its web interface and API, storing records about this information in a database. Although large portions are sanitized of sensitive information, due to the nature of this kind of information, it must always be maximally protected. Leaked details of configuration for DODDoW enterprise information systems could lead to compromise, so all access to and from the Automation Controller servers must be encrypted.

V-256941 in V2R4

Check text

The Automation Controller does not require any nginxNGINX dynamic expansion modules to function. Determine if any dynamic modules are specified in the nginx configuration. As a system administrator for each Automation Controller NGINX web server host, execute the following: NGINXCONF=`nginx -V 2>&1 | tr ' ' '1n' | sed -ne '/conf-path/{s/.*conf-path=1(.*1)/11/;p}' ` NGINXMODPATH=`$(nginx -V 2>&1 | tr ' ' '1n' | grep modules-path | sed -ne '/modules-path/{s/.*modules-path=1(.*1)/11/;p}'`) NGINXMODINC=`grep include /etc/ nginx/nginx.conf |-T grep modules | awk '{print $2}'>&1 | xargs dirname` grep -q load_module ${NGINXCONF} && echo FAILED [ `$(ls -1 $NGINXMODPATH 2>/dev/null | wc -l`) == 0 ] || echo FAILED [ `ls -1 $NGINXMODINC | wc -l` == 0 ] || echo FAILED If "FAILED" is displayed, this is a finding.

Fix text

As a system administrator for each Automation Controller NGINX web server host, execute the following: NGINXCONF=`nginx -V 2>&1 | tr ' ' '1n' | sed -ne '/conf-path/{s/.*conf-path=1(.*1)/11/;p}' ` NGINXMODPATH=`$(nginx -V 2>&1 | tr ' ' '1n' | grep modules-path | sed -ne '/modules-path/{s/.*modules-path=1(.*1)/11/;p}'`) NGINXMODINC=`grep include /etc/nginx/nginx.conf | grep modules | awk '{print $2}' | xargs dirname` sudo rm -f ${NGINXMODPATH}/* sudo Identify rmactive -fconfig ${NGINXMODINC}/*files and remove any load_module lines: sudonginx -eT ${NGINXCONF}2>&1 | grep '# configuration file' InEdit theeach editor,file and remove any lines thatcontaining contain "load_module". Save the file and exit the text editor. Run the following command to apply the changes: sudo systemctl restart nginx

V-256945 in V2R4

Check text

As a system administrator (SA) for each Automation Controller NGINX web server host, ensure that the only upstream servers configured are for the Automation Controller ASGI and WSGI modules. Dump the full active NGINX configuration: NGINXCONF=`nginx -VT 2>&1 | tr ' ' '1n' | sed -ne '/conf-path/{s/.*conf-path=1(.*1)/11/;p}' ` sudo grep -E 'proxy_pass|uwsgi_pass' $NGINXCONF | grep -Pqz '^1s+proxy_pass http://daphne;1n1s+uwsgi_pass uwsgi;1n$' || echo FAILED [ nginx "`sudo-T 2>&1 | grep -Pzo 'upstream1s+daphne1s+{[^}]+}' $NGINXCONF | grep -a server | grep -v 'server unix:/var/run/tower/daphne.sock;'`" ==&& '' ] || echo FAILED [ nginx "`sudo-T 2>&1 | grep -Pzo 'upstream1s+uwsgi1s+{[^}]+}' $NGINXCONF | grep -a server | grep -v 'server unix:/var/run/tower/uwsgi.sock;'`" ==&& '' ] || echo FAILED If "FAILED" is displayed, this is a finding. Ensure all locations are served by either these upstream servers or other well-known content: [ "`sudo grep location $NGINXCONF | grep -v '^1s*#' | grep -Ev '^1s+location1s+/(favicon.ico|static|websocket)?1s+{'`" == "" ] || echo "FAILED" sudo grep -Eq 'location1s+/favicon.ico1s+{1s+alias1s+/var/lib/awx/public/static/media/favicon.ico;1s+}' $NGINXCONF || echo "FAILED" sudo grep -Eq 'location1s+/static1s+{1s+alias1s+/var/lib/awx/public/static;1s+}' $NGINXCONF || echo "FAILED" sudo grep -Pzo 'location1s+/websocket1s+({([^{}]|(?1))*})' $NGINXCONF | grep -Eq '^1s+proxy_pass1s+http://daphne;' || echo "FAILED" sudo grep -Pzo 'location1s+/1s+({([^{}]|(?1))*})' $NGINXCONF | grep -Eq '^1s+uwsgi_pass1s+uwsgi;' || echo "FAILED" If "FAILED" is displayed, this is a finding. Verify the content present and served from the static content location (/var/lib/awx/public/static) is acceptable per organizationally defined policy. If any content present in this location (or its subdirectories) is not acceptable per organizationally defined policy, this is a finding.

Fix text

As aan System AdministratorSA, remove any content present and served from the static content location (/var/lib/awx/public/static) that is not acceptable per organizationally defined policy. Run the setup.sh command in the Ansible Automation Platform installer directory to reconfigure the controller to the default state, which only contains the required configuration: sudo ./setup.sh (Note: Identify the active NGINX configuration files using nginx -T 2>&1 | grep '# configuration file' to locate all included config files before editing.)

V-256947 in V2R4

Check text

As a system administrator (SA) for each Automation Controller NGINX web server, check the allowed mimeMIME types and associated shell applications: NGINXCONFMIME_TYPES=`$(nginx -VT 2>&1 | trgrep ' ' '1n' | sed -nem1 '/conf-path/{s/include.*conf-path=1(.*1)/11/;p}mime' ` ; MIME_TYPES=`grep mime $NGINXCONF | awk '{printfprint $2}' | sed 's/;$//' ` ; ) disallowed_mime_types=('application.*1sbin' 'application.*1sexe' 'application.*1srpm' 'application.*1smsi' 'application.*1smsp' 'application.*1smsm' ) ; echo "${disallowed_mime_types[*]}" | tr ' ' '1n' >tempfile tempfile; cat $MIME_TYPES | grep -f tempfile 1>/dev/null && echo "FAILED"; rm -f tempfile If "FAILED" is displayed, this is a finding.

Fix text

As an SA for each Automation Controller NGINX web server, removeidentify the disallowedMIME mime types file: NGINXCONFMIME_TYPES=`$(nginx -VT 2>&1 | trgrep ' ' '1n' | sed -nem1 '/conf-path/{s/include.*conf-path=1(.*1)/11/;p}mime' ` ; MIME_TYPES=`grep mime $NGINXCONF | awk '{printfprint $2}' | sed 's/;$//' ` ; disallowed_mime_types=('application.*1sbin' 'application.*1sexe' 'application.*1srpm' 'application.*1smsi' 'application.*1smsp application.*1smsm') ; echo Remove "${disallowed_mime_types[*]}"disallowed |MIME trtypes 'from 'the '1n'file >tempfileand ;restart cat $MIME_TYPES | grep -vf tempfile >$MIME_TYPES; rm -f tempfile Restart NGINX.

V-256949 in V2R4

Check text

As a Systemsystem Administratoradministrator (SA) for each Automation Controller NGINX web server host, verify the web server is configured to use a static IP address and port.: NGINXCONF=`nginx -VT 2>&1 | tr ' ' '1n' | sed -ne '/conf-path/{s/.*conf-path=1(.*1)/11/;p}' ` ; grep '^1s*listen1s*1*1|1s*listen1s*1[.*1]1|1s*listen1s*01.01.01.01|1s*listen1s*1[.*1]1|^1s*listen1s1+.*:[^[:digit:]1s]1+.*' $NGINXCONF && echo FAILED If "FAILED" is displayed, this is a finding.

Fix text

As aan SystemSA, Administratoridentify forthe eachactive AutomationNGINX Controllerconfiguration NGINXfiles: nginx web-T server2>&1 host,| identifygrep the'# allowedconfiguration and/orfile' Edit designatedthe IPrelevant addressconfiguration file(ess) forto thereplace Automation Controller system. Replace any wildcard or ranged IP address references in the NGINX configuration with IP addresses from the pool of allowed and/or designated addressaddresses. Reload the NGINX server configurations for all NGINX processesconfiguration: $ pkill -HUP nginx

V-256952 in V2R4

Check text

As a Systemsystem Administratoradministrator (SA) for each Automation Controller NGINX web server host, verify the location and permissions of the NGINXprivate configurationkey: NGINXCONF=`nginxFor -Vcontainerized 2>&1deployments, |enter trthe 'controller 'web '1n'container |namespace sedor -neuse '/conf-path/{s/.*conf-path=1(.*1)/11/;p}'podman `exec: TOWER_KEY=`$(nginx -T 2>&1 | sed -n 's/^1s*ssl_certificate_key1s*1(.*1);/11/p' $NGINXCONF`| head -1) stat -c "%a %U %G" $TOWER_KEY| Verify grepthe "key file is readable only by the service account running the NGINX process (permission mode 400 or 600, rootowned awx"by ||the echoservice "FAILED"user). If "FAILED"the key is displayedworld-readable or group-readable by an unauthorized group, this is a finding.

Fix text

As aan SystemSA Administrator for each Automation Controller NGINX web server host, set the permissions: NGINXCONFTOWER_KEY=`$(nginx -VT 2>&1 | tr ' ' '1n' | sed -ne '/conf-path/{s/.*conf-path=1(.*1)/11/;p}' ` TOWER_KEY=`sed -n 's/^1s*ssl_certificate_key1s*1(.*1);/11/p' $NGINXCONF` sudo| head -1) chown root&ltservice_user>:awx&ltservice_group> $TOWER_KEY sudo chmod 600 $TOWER_KEY Note: In containerized deployments (AAP 2.6+), the service user is typically 'rhel' or the mapped UID, not root:awx. Verify the key is owned by the user running the NGINX process.

V-256953 in V2R4

Check text

As a system administrator (SA) for each Automation Controller NGINX web server, verify the NGINX configuration requiresincludes a default charset is mandatory.directive: grep 'charset_required' "$(nginx -VT 2>&1 | trgrep ' ' '1n' | sed -neE '/conf-path/{s/.^1s*conf-path=1(.*1)/11/;p}charset1s')" || echo "FAILED" If "FAILED" is displayed, this is a finding. (Note: On a default AAP 2.6 installation, this directive is not present. The fix below must be applied.)

Fix text

As an SA for each Automation Controller NGINX web server, verifyadd the NGINXcharset webdirective serverto configurationthe fileNGINX inconfiguration. Identify usethe isactive locatedconfiguration at '/etc/nginx/nginx.conf'files: NGINXCONF=`nginx -VT 2>&1 | trgrep '# 'configuration file'1n' Edit |the sedserver -neblock '/conf-path/{s/.*conf-path=1(.*1)/11/;p}'within `the ;http Add{} thecontext) directiveand toadd: charset theutf-8; Validate NGINXand configurationreload: nginx to-t force&& asystemctl requiredreload charset.nginx sedFor -i '/location/icontainerized charset_required;deployments, 'apply $NGINXCONF Reload the NGINXdirective serverwithin configurationsthe forcontainer's all NGINX processes. $configuration pkilland -HUPrestart nginxthe container service.

Discussion

It is important that Automation Controller NGINX web server limit the character set used for data entry and disallow Unicode use in hosted applications to avoid application compromise. Definition of the available character set for data entry can trap efforts to bypass security checks. The presence of nonstandard characters may cause the browser to interpret the content using a different character set than the defined one, because the system may interpret the content using a different CHARSET. Nonstandard encodings like UTF-7 can be used to bypass the application's defensive filters. If character sets for data entry are not defined, it leaves open the door for attackers to bypass security checks and make the server vulnerable to malicious attack.

V-256957 in V2R4

Check text

For each Automation Controller NGINX web server, a system administrator must check to determine if any error or debug information is being logged orto generateda persistent file (not stdout/stderr): NGINXCONF=`nginx -VT 2>&1 | trgrep ' ^1s*error_log' '1n' | sedgrep -nev '/conf-pathdev/{sstdout1|/.*conf-path=1(.*1)dev/11stderr1|/;p}dev/null' ` ; cat $NGINXCONF | grep '^1s*error_log' && echo FAILED If "FAILED" is displayed, this is a finding. Note: In containerized deployments (AAP 2.6+), error_log /dev/stdout error; is the expected configuration - container runtimes collect stdout via journald or the container logging driver. This is NOT a finding. Only error_log directives pointing to persistent files on disk constitute a finding.

Fix text

For each Automation Controller NGINX web server, aidentify system administrator must complete the followingactive steps. Verify the NGINX configuration file in usefiles: NGINXCONF=`nginx -VT 2>&1 | trgrep '# 'configuration file'1n' If |error_log sedpoints -neto '/conf-path/{s/.*conf-path=1(.*1)/11/;p}'a `file ; echoon $NGINXCONF Removedisk, theeither error_logremove the directive fromor theredirect NGINXto configuration/dev/stdout: error_log file./dev/stdout error; Cause NGINX to reload its configuration file: pkill -HUP nginx

V-256959 in V2R4

Check text

As a Systemsystem Administratoradministrator (SA) for each Automation Controller NGINX web server host, verify required service definition is protected from unprivileged users: stat -c "%a %U %G" /usr/lib/systemd/system/automation-controller.service | grep -q "644 root root" || echo "FAILED" stat -c "%a %U %G" /usr/lib/systemd/system/supervisord.service | grep -q "644 root root" || echo "FAILED" stat -c "%a %U %G" /usr/lib/systemd/system/nginx.service | grep -q "644 root root" || echo "FAILED" If "FAILED" is displayed, this is a finding. Verify the required services are enabled: systemctl is-enabled automation-controller.service >/dev/null || echo FAILED systemctl is-enabled supervisord.service >/dev/null || echo FAILED systemctl is-enabled nginx.service >/dev/null || echo FAILED If "FAILED" is displayed, this is a finding. Verify application services are correctly managed by supervisord. Verify protection of and capture supervisord configuration. stat -c "%a %U %G" /etc/supervisord.d/*.ini | grep -q "644 root root" || echo "FAILED" cat /etc/supervisord.d/*.ini | sed -n -E "/^1[.*1]/{s/1[(.*)1]/11/;h;n;};/^[a-zA-Z]/{s/#.*//;G;s/([^ ]*) *= *(.*)1n(.*)/13_11='12'/;p;}" > /tmp/supervisord.parsed.conf Verify specific start and restart properties for application services: application_services=(program:awx-dispatcher_autostart program:awx-dispatcher_autorestart program:awx-wsbroadcast_autostart program:awx-wsbroadcast_autorestart program:awx-uwsgi_autostart program:awx-uwsgi_autorestart program:awx-daphne_autostart program:awx-daphne_autorestart program:awx-rsyslogd_autostart program:awx-rsyslogd_autorestart) for SUPERVISOR_CHECK in ${application_services[@]}; do grep $SUPERVISOR_CHECK /tmp/supervisord.parsed.conf | grep -q true || echo "FAILED" ; done rm /tmp/supervisord.parsed.conf If "FAILED" is displayed, this is a finding.

Fix text

As aan SystemSA Administrator for each Automation Controller NGINX web server host, set the permissions correctly on the nginx service file: sudo chown root:root /usr/lib/systemd/system/nginx.service sudo chmod 644 /usr/lib/systemd/system/nginx.service Reset the Ansible Automation Platform configuration to the defaults, which meet the requirements for the supervisord and automation-controller services. Locate the inventory file used to install Ansible Automation Platform (usually in the installer directory). Run the setup.sh command in the installer directory to reconfigure the controller to use the new setting: sudo ./setup.sh

V-256962 in V2R4

Check text

As a Systemsystem Administratoradministrator (SA), for each Automation Controller NGINX web server, avalidate TLS Configuration Check validates the TLS version used by the serverconfiguration: NGINXCONF=`nginx -VT 2>&1 | tr ' ' '1n' | sed -ne '/conf-path/{s/.*conf-path=1(.*1)/11/;p}' ` sudo grep ssl_protocols ${NGINXCONF} | grep -E 'ssl_protocols1s+TLSv1.2;' || echo "FAILED" If "FAILED" is displayed, this is a finding.

Fix text

As aan System Administrator for each Automation Controller Web ServerSA, reconfigureidentify the TLSactive versionsNGINX orconfiguration ciphers used in Automation Controller's web serverfiles: NGINXCONF=`nginx -VT 2>&1 | trgrep '# 'configuration file'1n' | sed -ne '/conf-path/{s/.*conf-path=1(.*1)/11/;p}' ` sudo -e ${NGINXCONF} ReplaceEdit the linerelevant beginningconfiguration withfile. "ssl_protocols"Replace toor matchadd (note the leadingssl_protocols spaces)line: " ssl_protocols TLSv1.2;" If the "ssl_protocols" variable does not exist, add it after the line beginning with "ssl_ciphers". Save the file and exit the text editor. To apply these changes to the running service immediately, restart the NGINX service with the following command: sudo systemctl restart nginx

V-256964 in V2R4

Check text

As a system administrator (SA) for each Automation Controller NGINX web server host, verify the NGINX web server configuration file in use is located at "/etc/nginx/nginx.conf": NGINXCONF=`nginx -V 2>&1 | tr ' ' '1n' | sed -ne '/conf-path/{s/.*conf-path=1(.*1)/11/;p}' ` If the file does not exist, this is a finding. Verify the use of only dynamic modules witch are allowed by organizational policy: allowed_modules=(ssl_module http_v2_module http_realip_module http_addition_module http_xslt_module=dynamic http_image_filter_module=dynamic http_sub_module http_dav_module http_mp4_module http_gunzip_module http_gzip_static_module http_random_index_module http_secure_link_module http_degradation_module http_slice_module http_stub_status_module http_perl_module=dynamic http_auth_request_module mail_ssl_module stream_ssl_module stream_ssl_preread_module http_flv_module) ; stream_realip_module) echo "${allowed_modules[*]}" | tr ' ' '1n' > /tmp/allowed_modules ; nginx -V 2>&1 | grep module | tr ' ' '1n' | grep module | grep -v modules-path | sed 's/--with-//g' | grep -v -Ff /tmp/allowed_modules && echo "FAILED"; Verify the use of only runtime modules which are allowed by organizational policy: nginx -T 2>&1 | grep load_module $NGINXCONF | sed -n 's/^1s*load_module1s*1(.*1)/11/p' | grep -v -Ff /tmp/allowed_modules && echo "FAILED" ; rm -f /tmp/allowed_modules If the output shows "FAILED", this is a finding.

V-256965 in V2R4