STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must separate API maintenance sessions from other network sessions within the system by logically separated communications paths.

DISA Rule

SV-278409r1171979_rule

Vulnerability Number

V-278409

Group Title

SRG-APP-000880

Rule Version

NGNX-APP-003060

Severity

CAT II

CCI(s)

• CCI-004192 - Protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by logically separated communications paths.
• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure the API directive to use a separate listen address from production traffic:

http {
server {
listen 192.168.0.1:80;
location / {
proxy_pass http://backend;
}
}
server {
listen 10.0.0.1:80;
location /api {
api write=on;
}
}
}

After saving the updated config, restart NGINX:

nginx -s reload.

Check Contents

If not using the NGINX API, this is Not Applicable.

Determine path to NGINX config file:

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Check that the nginx.conf file contains the API directive and a separate listen address:

http {
server {
listen 192.168.0.1:80;
location / {
proxy_pass http://backend;
}
location /api {
api write=on;
}
}
}

If the API is running on the same network as production traffic, this is a finding.

Vulnerability Number

V-278409

Documentable

False

Rule Version

NGNX-APP-003060

Severity Override Guidance

If not using the NGINX API, this is Not Applicable.

Determine path to NGINX config file:

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Check that the nginx.conf file contains the API directive and a separate listen address:

http {
server {
listen 192.168.0.1:80;
location / {
proxy_pass http://backend;
}
location /api {
api write=on;
}
}
}

If the API is running on the same network as production traffic, this is a finding.

Check Content Reference

M

Target Key

5720