STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must be configured to prohibit or restrict using ports, protocols, and/or services.

DISA Rule

SV-278389r1172704_rule

Vulnerability Number

V-278389

Group Title

SRG-APP-000142

Rule Version

NGNX-APP-000510

Severity

CAT II

CCI(s)

• CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.
• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.
• CCI-001762 - Disable or remove organization-defined functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure.

Weight

10

Fix Recommendation

Edit the NGINX configuration file(s) and remove any unnecessary listen directives.

On listen directives that are organizationally defined to need TLS, ensure that the listen directive includes SSL and SSL redirection.

After saving the configuration, reload NGINX:

# nginx -s reload

Check Contents

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Review the configurations looking for any listen directives.

If listen directives are enabled but unnecessary, this is a finding.

Verify that listeners are using SSL and redirects to SSL-enabled listeners.

# nginx -c <path to nginx config> -qT | grep -A5 listen
listen 192.168.0.254:80;
return 301 https://$host/$request_uri;
}

`
listen 192.168.0.254:443 ssl default_server;
...

If the listen directive does not include SSL and there is not a redirect to an SSL listener, this is a finding.

Vulnerability Number

V-278389

Documentable

False

Rule Version

NGNX-APP-000510

Severity Override Guidance

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Review the configurations looking for any listen directives.

If listen directives are enabled but unnecessary, this is a finding.

Verify that listeners are using SSL and redirects to SSL-enabled listeners.

# nginx -c <path to nginx config> -qT | grep -A5 listen
listen 192.168.0.254:80;
return 301 https://$host/$request_uri;
}

`
listen 192.168.0.254:443 ssl default_server;
...

If the listen directive does not include SSL and there is not a redirect to an SSL listener, this is a finding.

Check Content Reference

M

Target Key

5720