STIGQter: STIG Summary: Red Hat Ansible Automation Controller Web Server Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 05 Jan 2026:

The Automation Controller NGINX web server must display a default hosted application web page, not a directory listing, when a requested web page cannot be found.

DISA Rule

SV-256958r961167_rule

Vulnerability Number

V-256958

Group Title

SRG-APP-000266-WSR-000142

Rule Version

APWS-AT-000620

Severity

CAT II

CCI(s)

• CCI-001312 - Generates error messages that provide information necessary for corrective actions without revealing information that could be exploited.

Weight

10

Fix Recommendation

As a System Administrator for each Automation Controller nginx web server host, remove any configuration that turns the autoindexing on:

NGINXCONF=`nginx -V 2>&1 | tr ' ' '\n' | sed -ne '/conf-path/{s/.*conf-path=\(.*\)/\1/;p}' ` ;
sed -Ei -e '/autoindex\s+on/d;' $NGINXCONF

To apply these changes to the running service immediately, restart the NGINX service with the following command:

sudo systemctl restart nginx

Check Contents

For each Automation Controller NGINX web server, a system administrator must view to see whether autoindex is turned on or off (autoindex on/autoindex off):

NGINXCONF=`nginx -V 2>&1 | tr ' ' '\n' | sed -ne '/conf-path/{s/.*conf-path=\(.*\)/\1/;p}' ` ;
grep -E 'autoindex\s+on' $NGINXCONF && echo "FAILED"

If "FAILED" is displayed, this is a finding.

Vulnerability Number

V-256958

Documentable

False

Rule Version

APWS-AT-000620

Severity Override Guidance

For each Automation Controller NGINX web server, a system administrator must view to see whether autoindex is turned on or off (autoindex on/autoindex off):

NGINXCONF=`nginx -V 2>&1 | tr ' ' '\n' | sed -ne '/conf-path/{s/.*conf-path=\(.*\)/\1/;p}' ` ;
grep -E 'autoindex\s+on' $NGINXCONF && echo "FAILED"

If "FAILED" is displayed, this is a finding.

Check Content Reference

M

Target Key

5535