STIGQter: STIG Summary: Red Hat Ansible Automation Controller Application Server Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 05 Jan 2026:

Automation Controller must use encryption strength in accordance with the categorization of the management data during remote access management sessions.

DISA Rule

SV-256897r960759_rule

Vulnerability Number

V-256897

Group Title

SRG-APP-000014-AS-000009

Rule Version

APAS-AT-000011

Severity

CAT II

CCI(s)

CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.
CCI-000197 - For password-based authentication, transmit passwords only cryptographically-protected channels.
CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.
CCI-002420 - Maintain the confidentiality and/or integrity of information during preparation for transmission.
CCI-002422 - Maintain the confidentiality and/or integrity of information during reception.

Weight

Fix Recommendation

Enable HTTPS by running the following command:

./setup.sh -e nginx_disable_https=false

The "nginx_disable_https" variable disables HTTPS traffic through NGINX, this is useful if offloading HTTPS to a load balancer.

By default, this variable is set to false in the installers "roles/nginx/defaults/main.yml" file. If a load balancer is not needed, ensure this value has not been set to true.

Check Contents

As an unauthenticated user, open a new web browser and go to http://<Automation Controller HOST>

If not redirected to https://<Automation Controller HOST>, this is a finding.

Vulnerability Number

V-256897

Documentable

False

Rule Version

APAS-AT-000011

Severity Override Guidance

As an unauthenticated user, open a new web browser and go to http://<Automation Controller HOST>

If not redirected to https://<Automation Controller HOST>, this is a finding.

Check Content Reference

Target Key

5534