STIGQter: STIG Summary: Red Hat Ansible Automation Controller Application Server Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 05 Jan 2026:

Automation Controller must implement cryptography mechanisms to protect the integrity of information.

DISA Rule

SV-256898r1107643_rule

Vulnerability Number

V-256898

Group Title

SRG-APP-000015-AS-000010

Rule Version

APAS-AT-000012

Severity

CAT I

CCI(s)

• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
• CCI-001188 - Generate a unique session identifier for each session with organization-defined randomness requirements.
• CCI-001199 - Protects the confidentiality and/or integrity of organization-defined information at rest.
• CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.
• CCI-002418 - Protect the confidentiality and/or integrity of transmitted information.
• CCI-002421 - Implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.
• CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.
• CCI-002475 - Implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information when at rest on organization-defined system components.
• CCI-002476 - Implement cryptographic mechanisms to prevent unauthorized disclosure of organization-defined information at rest on organization-defined system components.

Weight

10

Fix Recommendation

As an administrator for each Automation Controller host, configure the operating system to be FIPS-enabled with the following command:

sudo fips-mode-setup --enable

Reboot each system.

Configure Ansible Automation Platform installation location to reside on a LUKS encrypted volume:

Add a LUKS volume using default or other encrypted volume in accordance with organizationally defined policy. The '/var/lib/awx' filesystem must reside on this volume.

Reinstall the Ansible Automation Platform.

Note: The phrasing "Reinstall the Ansible Automation Platform." is applicable here; the installer cannot just be rerun on the same system.

Reinstall the operating system on the Automation Controller server with FIPS mode enabled at install time by following the guidance located here:
https://access.redhat.com/solutions/5416081
OR
Enable FIPS mode without reinstalling the operating system by following the guidance located here:
https://access.redhat.com/solutions/137833

If the operating system was reinstalled, reinstall Automation Controller by following the guidance located here:
https://docs.ansible.com/ansible-tower/latest/html/installandreference/index.html

Check Contents

As a system administrator for each Automation Controller host, check if the operating system is FIPS-enabled:

sysctl crypto.fips_enabled

If "fips_enabled" is not "1", this is a finding.

Verify the installed volume for Automation Controller is on a LUKS encrypted volume command:

AAPROOT='/var/lib/awx' && cryptsetup status `df -T ${AAPROOT} | cut -d ' ' -f 1 | tail -n 1 ` | grep type | grep -i luks || echo "FAILED"

If "FAILED" is displayed, this is a finding.

Verify this LUKS encrypted volume is using FIPS-compliant cryptographic functions command:

allowed_FIPS_ciphers=('aes.*\(256\|384\|512\)') ; echo "${allowed_FIPS_ciphers[*]}" | tr ' ' '\n' >tempfile && cryptsetup status `df -T ${AAPROOT} | cut -d ' ' -f 1 | tail -n 1 ` | grep -e '\(cipher\|keysize\)' | awk '{print $2}' | paste -s -d '-' | grep -f tempfile 1>/dev/null || echo "FAILED" && rm -f tempfile

If "FAILED" is displayed, this is a finding.

Vulnerability Number

V-256898

Documentable

False

Rule Version

APAS-AT-000012

Severity Override Guidance

As a system administrator for each Automation Controller host, check if the operating system is FIPS-enabled:

sysctl crypto.fips_enabled

If "fips_enabled" is not "1", this is a finding.

Verify the installed volume for Automation Controller is on a LUKS encrypted volume command:

AAPROOT='/var/lib/awx' && cryptsetup status `df -T ${AAPROOT} | cut -d ' ' -f 1 | tail -n 1 ` | grep type | grep -i luks || echo "FAILED"

If "FAILED" is displayed, this is a finding.

Verify this LUKS encrypted volume is using FIPS-compliant cryptographic functions command:

allowed_FIPS_ciphers=('aes.*\(256\|384\|512\)') ; echo "${allowed_FIPS_ciphers[*]}" | tr ' ' '\n' >tempfile && cryptsetup status `df -T ${AAPROOT} | cut -d ' ' -f 1 | tail -n 1 ` | grep -e '\(cipher\|keysize\)' | awk '{print $2}' | paste -s -d '-' | grep -f tempfile 1>/dev/null || echo "FAILED" && rm -f tempfile

If "FAILED" is displayed, this is a finding.

Check Content Reference

M

Target Key

5534