STIGQter: STIG Summary: Red Hat Ansible Automation Controller Web Server Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 05 Jan 2026:

All Automation Controller NGINX web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.

DISA Rule

SV-256954r1138072_rule

Vulnerability Number

V-256954

Group Title

SRG-APP-000211-WSR-000030

Rule Version

APWS-AT-000440

Severity

CAT II

CCI(s)

• CCI-001082 - Separate user functionality, including user interface services, from system management functionality.

Weight

10

Fix Recommendation

As a System Administrator for each Automation Controller NGINX web server host, enumerate all (nonroot) privileged users on the system:

getent passwd | cut -f1 -d ':' | sudo xargs -L1 sudo -l -U | grep -v 'not allowed' | tail -n +3 | sed -n '/^User/s/User\s*\(\w*\).*/\1/p' | grep -v root

For each user shown, perform one of the following actions:
- Remove the indicated user from the system;
- Remove the indicated user from any privileged groups (wheel);
- Remove login access for the user;
- Verify via organizationally defined procedures the indicated user is an authorized administrative account.

Check Contents

As a system administrator for each Automation Controller NGINX web server host, enumerate all (nonroot) privileged users on the system:

allowed_privileged_users=('root') ; echo "${allowed_privileged_users}" | tr ' ' '\n' >/tmp/allowed_privileged_users ; getent passwd | cut -f1 -d ':' | sudo xargs -L1 sudo -l -U | grep -v 'not allowed' | tail -n +3 | sed -n '/^User/s/User\s*\(\w*\).*/\1/p' | grep -v -f /tmp/allowed_privileged_users 1>/dev/null && echo "FAILED" ; rm -f /tmp/allowed_privileged_users

If "FAILED" is displayed, this is a finding.

Vulnerability Number

V-256954

Documentable

False

Rule Version

APWS-AT-000440

Severity Override Guidance

As a system administrator for each Automation Controller NGINX web server host, enumerate all (nonroot) privileged users on the system:

allowed_privileged_users=('root') ; echo "${allowed_privileged_users}" | tr ' ' '\n' >/tmp/allowed_privileged_users ; getent passwd | cut -f1 -d ':' | sudo xargs -L1 sudo -l -U | grep -v 'not allowed' | tail -n +3 | sed -n '/^User/s/User\s*\(\w*\).*/\1/p' | grep -v -f /tmp/allowed_privileged_users 1>/dev/null && echo "FAILED" ; rm -f /tmp/allowed_privileged_users

If "FAILED" is displayed, this is a finding.

Check Content Reference

M

Target Key

5535