Automation Controller's log files must be accessible by explicitly defined privilege.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-256903 | APAS-AT-000034 | SV-256903r960930_rule | CCI-000162 | medium |
| Description | ||||
| A failure of the confidentiality of Automation Controller log files would enable an attacker to identify key information about the system that they might not otherwise be able to obtain that would enable them to enumerate more information to enable escalation or lateral movement. Satisfies: SRG-APP-000118-AS-000078, SRG-APP-000119-AS-000079, SRG-APP-000120-AS-000080, SRG-APP-000121-AS-000081, SRG-APP-000122-AS-000082, SRG-APP-000123-AS-000083, SRG-APP-000267-AS-000170 | ||||
| STIG | Date | |||
| Red Hat Ansible Automation Controller Application Server Security Technical Implementation Guide | 2025-05-23 | |||
Related Frameworks
3 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
AU-9
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1711 mapping
3.3.8
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000162
1.00
- DISA · 2 · disa_xccdf · related
Details
Check Text (C-256903r960930_chk)
As an administrator, log into each Automation Controller host. Inspect the current permissions and owner of Automation Controller's NGINX log directory:
stat -c "%a %U %G" /var/log/nginx/ | grep "770 nginx root" || echo "FAILED"
If "FAILED" is displayed, this is a finding.
Inspect the current permissions and owner of Automation Controller's log directory:
$ stat -c "%a %U %G" /var/log/tower/ | grep "750 awx awx" || echo "FAILED"
If "FAILED" is displayed, this is a finding.
Inspect the current permissions and owner of Automation Controller's supervisor log directory:
stat -c "%a %U %G" /var/log/supervisor/ | grep "770 root root" || echo "FAILED"
If "FAILED" is displayed, this is a finding.
Fix Text (F-60520r902278_fix)
As a system administrator for each Automation Controller host, set the permissions and owner of Automation Controller's NGINX log directory:
chmod 770 /var/log/nginx
chown nginx:root /var/log/nginx
Set the permissions and owner of Automation Controller's log directory:
chmod 770 /var/log/tower
chown awx:awx /var/log/tower
Set the permissions and owner of Automation Controller's supervisor log directory:
chmod 770 /var/log/supervisor/
chown root:root /var/log/supervisor/