All accounts installed with the Automation Controller NGINX web server's software and tools must have passwords assigned and default passwords changed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-256967	APWS-AT-000950	SV-256967r961863_rule		Medium

Description
During installation of the Automation Controller NGINX web server software, accounts are created for the web server to operate properly. The accounts installed can have either no password installed or a default password, which will be known and documented by the vendor and the user community. The first thing an attacker will try when presented with a login screen are the default user identifiers with default passwords. Installed applications may also install accounts with no password, making the login even easier. Once the Automation Controller NGINX web server is installed, the passwords for any created accounts must be changed and documented. The new passwords must meet the requirements for all passwords (i.e., upper/lower characters, numbers, special characters, time until change, reuse policy, etc.). Service accounts or system accounts that have no login capability do not need to have passwords set or changed.

Description

During installation of the Automation Controller NGINX web server software, accounts are created for the web server to operate properly. The accounts installed can have either no password installed or a default password, which will be known and documented by the vendor and the user community. The first thing an attacker will try when presented with a login screen are the default user identifiers with default passwords. Installed applications may also install accounts with no password, making the login even easier. Once the Automation Controller NGINX web server is installed, the passwords for any created accounts must be changed and documented. The new passwords must meet the requirements for all passwords (i.e., upper/lower characters, numbers, special characters, time until change, reuse policy, etc.). Service accounts or system accounts that have no login capability do not need to have passwords set or changed.

STIG	Date
Red Hat Ansible Automation Controller Web Server Security Technical Implementation Guide	2024-06-10

Details

Check Text ( C-60642r903537_chk )
As a System Administrator for each Automation Controller NGINX web server host, verify the NGINX account is configured to disallow interactive login" grep '^nginx.*$/sbin/nologin$\\|/bin/false$$' /etc/passwd If "FAILED" is displayed, this is a finding.

Fix Text (F-60584r902414_fix)
As a System Administrator for each Automation Controller NGINX web server host, change the NGINX account to disallow interactive login: $ usermod -s /sbin/nologin nginx