STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

The NGINX service account must be configured to not have admin group access.

DISA Rule

SV-278383r1171901_rule

Vulnerability Number

V-278383

Group Title

SRG-APP-000038

Rule Version

NGNX-APP-000150

Severity

CAT II

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Remove the user from privileged groups:

sudo gpasswd -d nginx sudo
sudo gpasswd -d nginx wheel
sudo gpasswd -d nginx admin

Check Contents

Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Identify the NGINX runtime user:

grep -E '^\s*user\s+' /etc/nginx/nginx.conf

Expected output (example):

user nginx;

Ensure the user is not in a privileged group:

id nginx

Expected output:

uid=980(nginx) gid=979(nginx) groups=979(nginx)

The user should not be a member of sudo, wheel, admin, or similar elevated groups.

If the NGINX runtime user is a member of an elevated group, this is a finding.

Vulnerability Number

V-278383

Documentable

False

Rule Version

NGNX-APP-000150

Severity Override Guidance

Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Identify the NGINX runtime user:

grep -E '^\s*user\s+' /etc/nginx/nginx.conf

Expected output (example):

user nginx;

Ensure the user is not in a privileged group:

id nginx

Expected output:

uid=980(nginx) gid=979(nginx) groups=979(nginx)

The user should not be a member of sudo, wheel, admin, or similar elevated groups.

If the NGINX runtime user is a member of an elevated group, this is a finding.

Check Content Reference

M

Target Key

5720