Automation Controller's log files must be accessible by explicitly defined privilege.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-256903	APAS-AT-000034	SV-256903r903539_rule		Medium

Description
A failure of the confidentiality of Automation Controller log files would enable an attacker to identify key information about the system that they might not otherwise be able to obtain that would enable them to enumerate more information to enable escalation or lateral movement. Satisfies: SRG-APP-000118-AS-000078, SRG-APP-000119-AS-000079, SRG-APP-000120-AS-000080, SRG-APP-000121-AS-000081, SRG-APP-000122-AS-000082, SRG-APP-000123-AS-000083, SRG-APP-000267-AS-000170

Description

A failure of the confidentiality of Automation Controller log files would enable an attacker to identify key information about the system that they might not otherwise be able to obtain that would enable them to enumerate more information to enable escalation or lateral movement. Satisfies: SRG-APP-000118-AS-000078, SRG-APP-000119-AS-000079, SRG-APP-000120-AS-000080, SRG-APP-000121-AS-000081, SRG-APP-000122-AS-000082, SRG-APP-000123-AS-000083, SRG-APP-000267-AS-000170

STIG	Date
Red Hat Ansible Automation Controller Application Server Security Technical Implementation Guide	2023-03-15

Details

Check Text ( C-60578r903539_chk )
As an administrator, log into each Automation Controller host. Inspect the current permissions and owner of Automation Controller's NGINX log directory: stat -c "%a %U %G" /var/log/nginx/ \| grep "770 nginx root" \|\| echo "FAILED" If "FAILED" is displayed, this is a finding. Inspect the current permissions and owner of Automation Controller's log directory: $ stat -c "%a %U %G" /var/log/tower/ \| grep "750 awx awx" \|\| echo "FAILED" If "FAILED" is displayed, this is a finding. Inspect the current permissions and owner of Automation Controller's supervisor log directory: stat -c "%a %U %G" /var/log/supervisor/ \| grep "770 root root" \|\| echo "FAILED" If "FAILED" is displayed, this is a finding.

Check Text ( C-60578r903539_chk )

As an administrator, log into each Automation Controller host. Inspect the current permissions and owner of Automation Controller's NGINX log directory:
stat -c "%a %U %G" /var/log/nginx/ | grep "770 nginx root" || echo "FAILED"

If "FAILED" is displayed, this is a finding.

Inspect the current permissions and owner of Automation Controller's log directory:
$ stat -c "%a %U %G" /var/log/tower/ | grep "750 awx awx" || echo "FAILED"

If "FAILED" is displayed, this is a finding.

Inspect the current permissions and owner of Automation Controller's supervisor log directory:
stat -c "%a %U %G" /var/log/supervisor/ | grep "770 root root" || echo "FAILED"

If "FAILED" is displayed, this is a finding.

Fix Text (F-60520r902278_fix)
As a system administrator for each Automation Controller host, set the permissions and owner of Automation Controller's NGINX log directory: chmod 770 /var/log/nginx chown nginx:root /var/log/nginx Set the permissions and owner of Automation Controller's log directory: chmod 770 /var/log/tower chown awx:awx /var/log/tower Set the permissions and owner of Automation Controller's supervisor log directory: chmod 770 /var/log/supervisor/ chown root:root /var/log/supervisor/

Fix Text (F-60520r902278_fix)

As a system administrator for each Automation Controller host, set the permissions and owner of Automation Controller's NGINX log directory:
chmod 770 /var/log/nginx
chown nginx:root /var/log/nginx

Set the permissions and owner of Automation Controller's log directory:
chmod 770 /var/log/tower
chown awx:awx /var/log/tower

Set the permissions and owner of Automation Controller's supervisor log directory:
chmod 770 /var/log/supervisor/
chown root:root /var/log/supervisor/