STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

The NGINX service account must be configured to not have shell access.

DISA Rule

SV-278382r1171898_rule

Vulnerability Number

V-278382

Group Title

SRG-APP-000033

Rule Version

NGNX-APP-000140

Severity

CAT II

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

Set a nonlogin shell for the nginx user:

sudo usermod -s /sbin/nologin nginx

Check Contents

Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Identify the NGINX runtime user:

grep -E '^\s*user\s+' /etc/nginx/nginx.conf

Expected output (example):

user nginx;

Verify the user has no login shell:

getent passwd nginx

Expected output:

nginx:x:998:998:Nginx user:/nonexistent:/sbin/nologin

Ensure the shell is "/sbin/nologin", "/usr/sbin/nologin", or "/bin/false".

If the NGINX runtime user has shell access, this is a finding.

Vulnerability Number

V-278382

Documentable

False

Rule Version

NGNX-APP-000140

Severity Override Guidance

Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Identify the NGINX runtime user:

grep -E '^\s*user\s+' /etc/nginx/nginx.conf

Expected output (example):

user nginx;

Verify the user has no login shell:

getent passwd nginx

Expected output:

nginx:x:998:998:Nginx user:/nonexistent:/sbin/nologin

Ensure the shell is "/sbin/nologin", "/usr/sbin/nologin", or "/bin/false".

If the NGINX runtime user has shell access, this is a finding.

Check Content Reference

M

Target Key

5720