STIGQter: STIG Summary: Red Hat Ansible Automation Controller Web Server Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 05 Jan 2026:

Debugging and trace information, within Automation Controller NGINX web server, used to diagnose the web server must be disabled.

DISA Rule

SV-256959r961167_rule

Vulnerability Number

V-256959

Group Title

SRG-APP-000266-WSR-000160

Rule Version

APWS-AT-000640

Severity

CAT II

CCI(s)

• CCI-001312 - Generates error messages that provide information necessary for corrective actions without revealing information that could be exploited.

Weight

10

Fix Recommendation

For each Automation Controller NGINX web server, a system administrator must complete the following steps.

Verify the NGINX configuration file in use:

NGINXCONF=`nginx -V 2>&1 | tr ' ' '\n' | sed -ne '/conf-path/{s/.*conf-path=\(.*\)/\1/;p}' ` ; echo $NGINXCONF

Remove the error_log directive from the NGINX configuration file.

Cause NGINX to reload its configuration file:

pkill -HUP nginx

Check Contents

For each Automation Controller NGINX web server, a system administrator must check to determine if any error or debug information is being logged or generated:

NGINXCONF=`nginx -V 2>&1 | tr ' ' '\n' | sed -ne '/conf-path/{s/.*conf-path=\(.*\)/\1/;p}' ` ; cat $NGINXCONF | grep '^\s*error_log' && echo FAILED

If "FAILED" is displayed, this is a finding.

Vulnerability Number

V-256959

Documentable

False

Rule Version

APWS-AT-000640

Severity Override Guidance

For each Automation Controller NGINX web server, a system administrator must check to determine if any error or debug information is being logged or generated:

NGINXCONF=`nginx -V 2>&1 | tr ' ' '\n' | sed -ne '/conf-path/{s/.*conf-path=\(.*\)/\1/;p}' ` ; cat $NGINXCONF | grep '^\s*error_log' && echo FAILED

If "FAILED" is displayed, this is a finding.

Check Content Reference

M

Target Key

5535