STIGQter: STIG Summary: Red Hat Ansible Automation Controller Application Server Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 05 Jan 2026:

Automation Controller's log files must be accessible by explicitly defined privilege.

DISA Rule

SV-256903r1155081_rule

Vulnerability Number

V-256903

Group Title

SRG-APP-000118-AS-000078

Rule Version

APAS-AT-000034

Severity

CAT II

CCI(s)

• CCI-000162 - Protect audit information from unauthorized access.
• CCI-000163 - Protect audit information from unauthorized modification.
• CCI-000164 - Protect audit information from unauthorized deletion.
• CCI-001314 - Reveal error messages only to organization-defined personnel or roles.
• CCI-001493 - Protect audit tools from unauthorized access.
• CCI-001494 - Protect audit tools from unauthorized modification.
• CCI-001495 - Protect audit tools from unauthorized deletion.

Weight

10

Fix Recommendation

As a system administrator for each Automation Controller host, set the permissions and owner of Automation Controller's NGINX log directory:
chmod 770 /var/log/nginx
chown nginx:root /var/log/nginx

Set the permissions and owner of Automation Controller's log directory:
chmod 750 /var/log/tower
chown awx:awx /var/log/tower

Set the permissions and owner of Automation Controller's supervisor log directory:
chmod 770 /var/log/supervisor/
chown root:root /var/log/supervisor/

Check Contents

As an administrator, log in to each Automation Controller host. Inspect the current permissions and owner of Automation Controller's NGINX log directory:
stat -c "%a %U %G" /var/log/nginx/ | grep "770 nginx root" || echo "FAILED"

If "FAILED" is displayed, this is a finding.

Inspect the current permissions and owner of Automation Controller's log directory:
$ stat -c "%a %U %G" /var/log/tower/ | grep "750 awx awx" || echo "FAILED"

If "FAILED" is displayed, this is a finding.

Inspect the current permissions and owner of Automation Controller's supervisor log directory:
stat -c "%a %U %G" /var/log/supervisor/ | grep "770 root root" || echo "FAILED"

If "FAILED" is displayed, this is a finding.

Vulnerability Number

V-256903

Documentable

False

Rule Version

APAS-AT-000034

Severity Override Guidance

As an administrator, log in to each Automation Controller host. Inspect the current permissions and owner of Automation Controller's NGINX log directory:
stat -c "%a %U %G" /var/log/nginx/ | grep "770 nginx root" || echo "FAILED"

If "FAILED" is displayed, this is a finding.

Inspect the current permissions and owner of Automation Controller's log directory:
$ stat -c "%a %U %G" /var/log/tower/ | grep "750 awx awx" || echo "FAILED"

If "FAILED" is displayed, this is a finding.

Inspect the current permissions and owner of Automation Controller's supervisor log directory:
stat -c "%a %U %G" /var/log/supervisor/ | grep "770 root root" || echo "FAILED"

If "FAILED" is displayed, this is a finding.

Check Content Reference

M

Target Key

5534