The Automation Controller servers must use encrypted communication for all channels given the high impact of those services to an organization's infrastructure.

The Automation Controller communicates information about configuration of other information systems through its web interface and API, storing records about this information in a database. Although large portions are sanitized of sensitive information, due to the nature of this kind of information, it must always be maximally protected. Leaked details of configuration for DoW enterprise information systems could lead to compromise, so all access to and from the Automation Controller servers must be encrypted.

1. Web Server Must Enforce TLS 1.2 or Higher:

nginx -T 2>&1 | grep -E '^[[:space:]]*ssl_protocols' | grep -E '(TLSv1\.2|TLSv1\.3)' > /dev/null || echo "FAILED"

If "FAILED" is displayed, this is a finding.

2. Web Server Must Use Host OS-Provided Cipher Policy:

nginx -T 2>&1 | grep -Eq '^[[:space:]]*ssl_ciphers[[:space:]]+PROFILE=SYSTEM[[:space:]]*;[[:space:]]*$' || echo "FAILED"

If "FAILED" is displayed, this is a finding.

3. External Database Connections Must Use TLS With Certificate Verification.

Automation Controller may be configured to connect to PostgreSQL databases with or without TLS. The Administrator must check the contents of the file at /etc/tower/conf.d/postgres.py with root permissions to determine if pg_sslmode was configured with "verify-full" for any external databases at the time of installation.

3.1 Client-Side

Execute the following command: sudo python3 -c 'exec(open("/etc/tower/conf.d/postgres.py").read()); import sys; bad=[n for n,c in DATABASES.items() if c.get("HOST") not in ("127.0.0.1","localhost","") and c.get("OPTIONS",{}).get("sslmode")!="verify-full"]; sys.exit(0 if not bad else 1)' || echo "FAILED"

If "FAILED" is displayed, this is a finding.

3.2 Server-Side

Confirm the database server negotiates TLS.

Get DB host:port for the default connection: PGCON=$(sudo python3 -c 'exec(open("/etc/tower/conf.d/postgres.py").read()); import sys; d=DATABASES.get("default",{}); h=d.get("HOST",""); p=d.get("PORT",""); print(f"{h}:{p}" if h and p else "", end="")')

Validate SSL with psql (requires psql client):

test -n "$PGCON" && psql "postgresql://${PGCON}/postgres?sslmode=require" -qAt -c '\conninfo' 2>/dev/null | grep -qi 'SSL connection' || echo "FAILED"

If "FAILED" is displayed, this is a finding.

Web Server TLS and Cipher Configuration

As a system administrator for each Automation Controller NGINX web server:

1. Identify the active NGINX configuration files: nginx -T 2>&1 | grep '# configuration file'

2. Edit the relevant server block configuration file.

3. Ensure ssl_protocols line: ssl_protocols TLSv1.2 TLSv1.3;

Ensure ssl_ciphers line: ssl_ciphers PROFILE=SYSTEM; (note the leading spaces:" ssl_ciphers PROFILE=SYSTEM;")

If the directive does not exist, add it immediately after the ssl_ciphers line.

4. Save the file and apply the changes: sudo nginx -t && sudo systemctl restart nginx

Database TLS Configuration

1. Edit the Ansible Automation Platform installer inventory file and set: pg_sslmode='verify-full' postgres_use_ssl=true

2. Reconfigure the controller: sudo ./setup.sh