STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must protect audit information from unauthorized access.

DISA Rule

SV-278388r1171916_rule

Vulnerability Number

V-278388

Group Title

SRG-APP-000118

Rule Version

NGNX-APP-000400

Severity

CAT II

CCI(s)

• CCI-000162 - Protect audit information from unauthorized access.
• CCI-000163 - Protect audit information from unauthorized modification.
• CCI-000164 - Protect audit information from unauthorized deletion.
• CCI-001493 - Protect audit tools from unauthorized access.
• CCI-001494 - Protect audit tools from unauthorized modification.
• CCI-001495 - Protect audit tools from unauthorized deletion.
• CCI-001314 - Reveal error messages only to organization-defined personnel or roles.

Weight

10

Fix Recommendation

Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Determine the location of the access and error logs:

grep "_log" <path to config>

Set appropriate permissions for the log files:

chmod 644 <path to error.log>
chmod 644 <path to access.log>

Check Contents

Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Determine the location of the access and error logs:

grep "_log" <path to config>

Determine the permissions for the log files:

ls -la <path to error.log>
-rw-r--r-- 1 root root 0 May 23 15:04 /var/log/nginx/error.log
ls -la <path to access.log>
-rw-r--r-- 1 root root 0 May 23 15:04 /var/log/nginx/access.log

If files have write permissions for anyone other than the owner, this is a finding.

Vulnerability Number

V-278388

Documentable

False

Rule Version

NGNX-APP-000400

Severity Override Guidance

Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Determine the location of the access and error logs:

grep "_log" <path to config>

Determine the permissions for the log files:

ls -la <path to error.log>
-rw-r--r-- 1 root root 0 May 23 15:04 /var/log/nginx/error.log
ls -la <path to access.log>
-rw-r--r-- 1 root root 0 May 23 15:04 /var/log/nginx/access.log

If files have write permissions for anyone other than the owner, this is a finding.

Check Content Reference

M

Target Key

5720