STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must protect against denial-of-service (DoS) attacks.

DISA Rule

SV-278404r1171964_rule

Vulnerability Number

V-278404

Group Title

SRG-APP-000435

Rule Version

NGNX-APP-001940

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.
• CCI-001095 - Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.

Weight

10

Fix Recommendation

Define a connection limiting zone.

Open the NGINX configuration file in a text editor:

sudo nano /etc/nginx/nginx.conf

Establish a shared memory zone to track and limit connections from each client.

Add this directive above the server block in the nginx.conf:

limit_conn_zone $binary_remote_addr zone=conn_limit_zone:10m;

$binary_remote_addr: Uses the client's IP address for limiting.

zone=conn_limit_zone:10m: Allocates 10MB of memory for tracking connections. Adjust size based on your needs.

Apply connection limiting in the server block.

Now, apply connection limiting to the desired location block. Inside the location block, add the connection limiting directive:

nginx
Copy code
server {
location / {
limit_req zone=one burst=20 nodelay;
limit_conn conn_limit_zone 10;
proxy_pass http://backend;
}
}
limit_conn conn_limit_zone 10: Limits the client to 10 concurrent connections.

Save and exit the file. Restart NGINX:

# nginx -s reload

Check Contents

Check for the "limit_req" or "limit_conn" directives in the NGINX configuration files:

grep -R "limit_req\|limit_conn" /etc/nginx/

Determine if NGINX App Protect is enabled:

grep -R "app_protect_enable on" /etc/nginx/

If the "lmit_req" or "limit connections" are not present, this is a finding.

Vulnerability Number

V-278404

Documentable

False

Rule Version

NGNX-APP-001940

Severity Override Guidance

Check for the "limit_req" or "limit_conn" directives in the NGINX configuration files:

grep -R "limit_req\|limit_conn" /etc/nginx/

Determine if NGINX App Protect is enabled:

grep -R "app_protect_enable on" /etc/nginx/

If the "lmit_req" or "limit connections" are not present, this is a finding.

Check Content Reference

M

Target Key

5720