STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must restrict access to configuration files.

DISA Rule

SV-278397r1171943_rule

Vulnerability Number

V-278397

Group Title

SRG-APP-000380

Rule Version

NGNX-APP-001590

Severity

CAT II

CCI(s)

CCI-001813 - Enforce access restrictions using organization-defined mechanisms.
CCI-003938 - Automatically generate audit records of the enforcement actions.

Weight

Fix Recommendation

Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Ensure permissions on the configuration directory do not allow write permissions for "Other":

# chmod o-w /etc/nginx

Check Contents

Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Check the permissions on the directory:

# ls -la /etc
drwxr-x-r-x 3 root root 4096 Sep 16 18:28 nginx

If permissions to write are allowed for "Other", this is a finding.

Vulnerability Number

V-278397

Documentable

False

Rule Version

NGNX-APP-001590

Severity Override Guidance

Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Check the permissions on the directory:

# ls -la /etc
drwxr-x-r-x 3 root root 4096 Sep 16 18:28 nginx

If permissions to write are allowed for "Other", this is a finding.

Check Content Reference

Target Key

5720