All Automation Controller NGINX web servers must be configured to use a specified IP address and port.

From a security perspective, it is important that all Automation Controller NGINX web servers are configured to use a specified IP address and port because “listening” on all IP addresses poses a vulnerability to the web server.

Not confining the web server to a specified IP address and port puts all web server content at risk of access by bad actors wanting to take advantage of those resources.

As a system administrator (SA) for each Automation Controller NGINX web server host, verify the web server is configured to use a static IP address and port:

nginx -T 2>&1 | grep '^\s*listen\s*\*\|\s*listen\s*\[.*\]\|\s*listen\s*0\.0\.0\.0\|\s*listen\s*\[.*\]\|^\s*listen\s\+.*:[^[:digit:]\s]\+.*' && echo FAILED

If "FAILED" is displayed, this is a finding.

As an SA, identify the active NGINX configuration files: nginx -T 2>&1 | grep '# configuration file'

Edit the relevant configuration file(s) to replace any wildcard or ranged IP address references with IP addresses from the pool of allowed and/or designated addresses.

Reload the NGINX server configuration: pkill -HUP nginx