STIGQter: STIG Summary: Red Hat Ansible Automation Controller Web Server Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 05 Jan 2026:

Only authenticated system administrators or the designated PKI Sponsor for an Automation Controller NGINX web server must have access to any Automation Controller NGINX web server's private key.

DISA Rule

SV-256953r961041_rule

Vulnerability Number

V-256953

Group Title

SRG-APP-000176-WSR-000096

Rule Version

APWS-AT-000400

Severity

CAT II

CCI(s)

• CCI-000186 - For public key-based authentication, enforce authorized access to the corresponding private key.

Weight

10

Fix Recommendation

As a System Administrator for each Automation Controller NGINX web server host, set the permissions:

NGINXCONF=`nginx -V 2>&1 | tr ' ' '\n' | sed -ne '/conf-path/{s/.*conf-path=\(.*\)/\1/;p}' `
TOWER_KEY=`sed -n 's/^\s*ssl_certificate_key\s*\(.*\);/\1/p' $NGINXCONF`
sudo chown root:awx $TOWER_KEY
sudo chmod 600 $TOWER_KEY

Check Contents

As a System Administrator for each Automation Controller NGINX web server host, verify the location of the NGINX configuration:

NGINXCONF=`nginx -V 2>&1 | tr ' ' '\n' | sed -ne '/conf-path/{s/.*conf-path=\(.*\)/\1/;p}' `
TOWER_KEY=`sed -n 's/^\s*ssl_certificate_key\s*\(.*\);/\1/p' $NGINXCONF`
stat -c "%a %U %G" $TOWER_KEY| grep "600 root awx" || echo "FAILED"

If "FAILED" is displayed, this is a finding.

Vulnerability Number

V-256953

Documentable

False

Rule Version

APWS-AT-000400

Severity Override Guidance

As a System Administrator for each Automation Controller NGINX web server host, verify the location of the NGINX configuration:

NGINXCONF=`nginx -V 2>&1 | tr ' ' '\n' | sed -ne '/conf-path/{s/.*conf-path=\(.*\)/\1/;p}' `
TOWER_KEY=`sed -n 's/^\s*ssl_certificate_key\s*\(.*\);/\1/p' $NGINXCONF`
stat -c "%a %U %G" $TOWER_KEY| grep "600 root awx" || echo "FAILED"

If "FAILED" is displayed, this is a finding.

Check Content Reference

M

Target Key

5535