NGINX must limit the number of concurrent sessions to an organization-defined number for all accounts and/or account types.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-278380	SRG-APP-000001	NGNX-APP-000010	SV-278380r1172745_rule	2026-01-07	1

Description
NGINX management includes the ability to control the number of users and user sessions that use an application. Limiting the number of allowed users and sessions per user is helpful in limiting risks related to denial-of-service (DoS) attacks. This requirement can be met via the application or by using information system session control provided by a web server with specialized session management capabilities. If it has been specified that this requirement will be handled by the application, the capability to limit the maximum number of concurrent single user sessions must be designed and built into the application. This requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based upon mission needs and the operational environment for each system.

Description

NGINX management includes the ability to control the number of users and user sessions that use an application. Limiting the number of allowed users and sessions per user is helpful in limiting risks related to denial-of-service (DoS) attacks. This requirement can be met via the application or by using information system session control provided by a web server with specialized session management capabilities. If it has been specified that this requirement will be handled by the application, the capability to limit the maximum number of concurrent single user sessions must be designed and built into the application. This requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based upon mission needs and the operational environment for each system.

ℹ️ Check
Determine path to NGINX config file(s): nginx -qT \| grep "# configuration" # configuration file /etc/nginx/nginx.conf: Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included. nginx -c <path to nginx config> -qT \| grep worker_connections worker_connections 512; Verify "worker_connections" is set in the configuration to an organization-defined number. If the "worker_connections" is not set to an organization-defined number, this is a finding.

ℹ️ Check

Determine path to NGINX config file(s): nginx -qT | grep "# configuration" # configuration file /etc/nginx/nginx.conf: Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included. nginx -c <path to nginx config> -qT | grep worker_connections worker_connections 512; Verify "worker_connections" is set in the configuration to an organization-defined number. If the "worker_connections" is not set to an organization-defined number, this is a finding.

✔️ Fix
Determine the path to NGINX config file(s): nginx -qT \| grep "# configuration" # configuration file /etc/nginx/nginx.conf: Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included. Add or modify the number of "worker_connections" based on the needs of the application. Note: By default, NGINX limits the number of concurrent connections to 512 per worker process, and the number of worker processes is equal the number of CPUs present. This results in a maximum number of connections equal to "worker_connections" multiplied by the number of "worker_processes". In a proxy configuration, NGINX will use a connection on both the client side and the server side. This results in two connections for each client side connection. Restart NGINX: systemctl restart nginx

✔️ Fix

Determine the path to NGINX config file(s): nginx -qT | grep "# configuration" # configuration file /etc/nginx/nginx.conf: Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included. Add or modify the number of "worker_connections" based on the needs of the application. Note: By default, NGINX limits the number of concurrent connections to 512 per worker process, and the number of worker processes is equal the number of CPUs present. This results in a maximum number of connections equal to "worker_connections" multiplied by the number of "worker_processes". In a proxy configuration, NGINX will use a connection on both the client side and the server side. This results in two connections for each client side connection. Restart NGINX: systemctl restart nginx