All Automation Controller NGINX web servers must not be a proxy server for any process other than the Automation Controller application.

The Automation Controller NGINX web server must be primarily a web server or a proxy server but not both, for the same reasons that other multi-use servers are not recommended. Scanning for web servers that will also proxy requests into an otherwise protected network is a very common anonymous attack.

In a scenario where Automation Controller is still reachable without use of the proxy/load balancer or when the proxy does not validate the header, X-Forwarded-For can be spoofed fairly easily to fake the originating IP addresses. Using HTTP_X_FORWARDED_FOR in the REMOTE_HOST_HEADERS setting poses a vulnerability that essentially gives users access to certain resources that they must not have.

Satisfies: SRG-APP-000141-WSR-000076, SRG-APP-000141-WSR-000083, SRG-APP-000141-WSR-000087

As a system administrator (SA) for each Automation Controller NGINX web server host, ensure that the only upstream servers configured are for the Automation Controller ASGI and WSGI modules.

Dump the full active NGINX configuration:

nginx -T 2>&1 | grep -E 'proxy_pass|uwsgi_pass' | grep -Pqz '^\s+proxy_pass http://daphne;\n\s+uwsgi_pass uwsgi;\n$' || echo FAILED

nginx -T 2>&1 | grep -Pzo 'upstream\s+daphne\s+{[^}]+}' | grep -a server | grep -v 'server unix:/var/run/tower/daphne.sock;' && echo FAILED

nginx -T 2>&1 | grep -Pzo 'upstream\s+uwsgi\s+{[^}]+}' | grep -a server | grep -v 'server unix:/var/run/tower/uwsgi.sock;' && echo FAILED

If "FAILED" is displayed, this is a finding.

As an SA, remove any content present and served from the static content location (/var/lib/awx/public/static) that is not acceptable per organizationally defined policy.

Run the setup.sh command in the Ansible Automation Platform installer directory to reconfigure the controller to the default state, which only contains the required configuration:

sudo ./setup.sh

(Note: Identify the active NGINX configuration files using nginx -T 2>&1 | grep '# configuration file' to locate all included config files before editing.)