STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must be configured with a deny-all, permit-by-exception policy to allow the execution of authorized software programs.

DISA Rule

SV-278398r1171946_rule

Vulnerability Number

V-278398

Group Title

SRG-APP-000386

Rule Version

NGNX-APP-001630

Severity

CAT II

CCI(s)

CCI-001774 - Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system.
CCI-001764 - Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage.

Weight

Fix Recommendation

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Set allow/deny according to organizational policy.

Restart NGINX after modifying the configuration.

# nginx -s reload

Check Contents

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Verify allow/deny is set according to organizational policy:

location / {
allow 192.168.0.0;
allow 10.0.0.0/16;
deny all;
}

If allow or deny is not set to organizational policy, this is a finding.

Vulnerability Number

V-278398

Documentable

False

Rule Version

NGNX-APP-001630

Severity Override Guidance

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Verify allow/deny is set according to organizational policy:

location / {
allow 192.168.0.0;
allow 10.0.0.0/16;
deny all;
}

If allow or deny is not set to organizational policy, this is a finding.

Check Content Reference

Target Key

5720