NGINX must be configured to prohibit or restrict using ports, protocols, and/or services.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-278389	SRG-APP-000142	NGNX-APP-000510	SV-278389r1172704_rule	2026-01-07	1

Description
Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions. Application communication sessions are protected using transport encryption protocols, such as TLS. TLS provides web applications with a means to be able to authenticate user sessions and encrypt application traffic. Session authentication can be single (one-way) or mutual (two-way) in nature. Single authentication authenticates the server for the client, whereas mutual authentication provides a means for both the client and the server to authenticate each other. This requirement applies to applications that use communications sessions. This includes, but is not limited to, web-based applications and service-oriented architectures (SOA). This requirement addresses communications protection at the application session, versus the network packet, and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted. Depending on the required degree of confidentiality and integrity, web services/SOA will require using TLS mutual authentication (two-way/bidirectional). Satisfies: SRG-APP-000142, SRG-APP-000141, SRG-APP-000383, SRG-APP-000645

Description

Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions. Application communication sessions are protected using transport encryption protocols, such as TLS. TLS provides web applications with a means to be able to authenticate user sessions and encrypt application traffic. Session authentication can be single (one-way) or mutual (two-way) in nature. Single authentication authenticates the server for the client, whereas mutual authentication provides a means for both the client and the server to authenticate each other. This requirement applies to applications that use communications sessions. This includes, but is not limited to, web-based applications and service-oriented architectures (SOA). This requirement addresses communications protection at the application session, versus the network packet, and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted. Depending on the required degree of confidentiality and integrity, web services/SOA will require using TLS mutual authentication (two-way/bidirectional). Satisfies: SRG-APP-000142, SRG-APP-000141, SRG-APP-000383, SRG-APP-000645

ℹ️ Check
Determine the path to NGINX config file(s): # nginx -qT \| grep "# configuration" # configuration file /etc/nginx/nginx.conf: Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included. Review the configurations looking for any listen directives. If listen directives are enabled but unnecessary, this is a finding. Verify that listeners are using SSL and redirects to SSL-enabled listeners. # nginx -c <path to nginx config> -qT \| grep -A5 listen listen 192.168.0.254:80; return 301 https://$host/$request_uri; } ` listen 192.168.0.254:443 ssl default_server; ... If the listen directive does not include SSL and there is not a redirect to an SSL listener, this is a finding.

ℹ️ Check

Determine the path to NGINX config file(s): # nginx -qT | grep "# configuration" # configuration file /etc/nginx/nginx.conf: Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included. Review the configurations looking for any listen directives. If listen directives are enabled but unnecessary, this is a finding. Verify that listeners are using SSL and redirects to SSL-enabled listeners. # nginx -c <path to nginx config> -qT | grep -A5 listen listen 192.168.0.254:80; return 301 https://$host/$request_uri; } ` listen 192.168.0.254:443 ssl default_server; ... If the listen directive does not include SSL and there is not a redirect to an SSL listener, this is a finding.

✔️ Fix
Edit the NGINX configuration file(s) and remove any unnecessary listen directives. On listen directives that are organizationally defined to need TLS, ensure that the listen directive includes SSL and SSL redirection. After saving the configuration, reload NGINX: # nginx -s reload