################################################################################
DOCUMENT         : F5_NGINX_STIG
VERSION          : 001.001.001.001
CHECKSUM         : 99984cc7bb1c337e65b0c05fa46a2ec9476ead1fb8b307125c0ac152fd65d6ae
MANUAL QUESTIONS : 10

IMPORTANT: Make sure to save the completed version of this file to: 
<SCC Install>/Resources/Content/Manual_Questions/Completed_Files

This file contains all of the non-automated STIG requirements found in the STIG.
Results from this file will be combined with automated checks in SCC to provide
complete STIG compliance results.

This file will be programmaticaly imported, so do not modify anything in this file
except for placing an '[X]' to select a Single answer, and entering text comments.

The list of questions is printed in order of severity, listing CAT I (High), then CAT II, etc..

################################################################################

QUESTION         : 1 of 10
TITLE            : CAT II, V-278384, SV-278384r1171904, SRG-APP-000068
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.sql.server:testaction:901
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.sql.server:question:901
RULE             : NGINX must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the application.
QUESTION_TEXT    : Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Check nginx.conf for a section that verifies that user consent has been given. Setting a cookie upon user acceptance after reading the banner and checking for the presence of that cookie is one way to accomplish this.

Check for this block in nginx.conf under the http block:

    # Define whether consent has been given based on the cookie
    map $http_cookie $consent_given {
        "~*user_consent=1" 1;
        default 0;
    }

Check nginx.conf for a section that handles user consent and setting the cookie under the server block:

    # Serve the consent banner page if consent is not given
    location /consent {
        default_type text/html;
        return 200 "<html><body>
                        <h1>Consent Required</h1>
                        <p>You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.

By using this IS (which includes any device attached to this IS), you consent to the following conditions:

-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.

-At any time, the USG may inspect and seize data stored on this IS.

-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.

-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.

-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.</p>
                        <a href='/set-consent'>I Accept</a>
                    </body></html>";
    }

    # Handle consent acceptance and set the cookie
    location /set-consent {
        add_header Set-Cookie "user_consent=1; Path=/; Max-Age=31536000; HttpOnly";
        return 302 /;
    }

    location / {
        # Redirect users to the consent page if they haven't given consent
        if ($consent_given = 0) {
                return 302 /consent;
            }

If NGINX is not configured to display the Standard Mandatory DOD Notice and Consent Banner before granting access to the application, this is a finding.

References:
CCI-000048
CCI-000050
CCI-001384
CCI-001385
CCI-001386
CCI-001387
CCI-001388
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 1 *******************************

QUESTION         : 2 of 10
TITLE            : CAT II, V-278390, SV-278390r1172747, SRG-APP-000157
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.sql.server:testaction:2101
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.sql.server:question:2101
RULE             : NGINX must implement replay-resistant authentication mechanisms for network access.
QUESTION_TEXT    : Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Identify authentication mechanism in use by checking whether NGINX is configured to protect access to administrative interfaces or APIs:

grep -Ri 'auth_' /etc/nginx/nginx.conf
grep -Ri 'proxy_pass' /etc/nginx/nginx.conf
grep -Ri 'ssl_verify_client' /etc/nginx/nginx.conf

Also inspect references to:

auth_jwt
auth_request
ssl_client_certificate

If JWT is in use, validate the config:

auth_jwt_key_file /etc/nginx/jwt.pub;
auth_jwt_require exp iat;

Ensure the token includes expiration (exp) and ideally issued-at (iat) fields.

If using mutual TLS:

ssl_verify_client on;
ssl_client_certificate /etc/nginx/certs/ca.pem;

Ensure client-side certificate verification is required and the certificate authority (CA) trust is defined.

If using auth_request:

Ensure the upstream authentication server is enforcing replay resistance (such as nonce or short-lived tokens). Validate token behavior and session timeout logic.

If no replay-resistant mechanism is found for network-based access, this is a finding.

References:
CCI-001941
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 2 *******************************

QUESTION         : 3 of 10
TITLE            : CAT II, V-278393, SV-278393r1171931, SRG-APP-000206
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.sql.server:testaction:2701
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.sql.server:question:2701
RULE             : NGINX must identify prohibited mobile code.
QUESTION_TEXT    : Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

# grep load_module /etc/nginx/nginx.conf
load_module modules/ngx_http_app_protect_module.so;

If modules are loaded that are not required or known, this is a finding.

References:
CCI-001166
CCI-001662
CCI-001169
CCI-001170
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 3 *******************************

QUESTION         : 4 of 10
TITLE            : CAT II, V-278398, SV-278398r1171946, SRG-APP-000386
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.sql.server:testaction:3701
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.sql.server:question:3701
RULE             : NGINX must be configured with a deny-all, permit-by-exception policy to allow the execution of authorized software programs.
QUESTION_TEXT    : Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Verify allow/deny is set according to organizational policy:

location / {
  allow 192.168.0.0;
  allow 10.0.0.0/16;
  deny all;
}

If allow or deny is not set to organizational policy, this is a finding.

References:
CCI-001774
CCI-001764
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 4 *******************************

QUESTION         : 5 of 10
TITLE            : CAT II, V-278402, SV-278402r1171958, SRG-APP-000419
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.sql.server:testaction:4501
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.sql.server:question:4501
RULE             : NGINX must be configured to pass security attributes to proxies.
QUESTION_TEXT    : Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Verify the embedded security attributes are present as HTTP Headers:

server {
    listen 443 ssl;
    server_name secure-api.example.com;

    location /data {
        proxy_pass http://backend_service;

        proxy_set_header X-Security-Classification "Confidential";
        proxy_set_header X-Data-Origin "Internal-System";
        proxy_set_header X-Access-Permissions "Read,Write";
    }
}
If the "proxy_pass" variable is not set nor the "proxy_set_header" is not set for the required headers, this is a finding.

References:
CCI-002455
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 5 *******************************

QUESTION         : 6 of 10
TITLE            : CAT II, V-278403, SV-278403r1171961, SRG-APP-000427
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.sql.server:testaction:4701
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.sql.server:question:4701
RULE             : NGINX must only allow using DOD approved certificate authorities for PKI.
QUESTION_TEXT    : Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Find any "ssl_certificate" ssl_client_certificate" directives and verify they are DOD approved.

If the certificates are not DOD approved, this is a finding.

References:
CCI-002470
CCI-000187
CCI-004909
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 6 *******************************

QUESTION         : 7 of 10
TITLE            : CAT II, V-278406, SV-278406r1171970, SRG-APP-000605
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.sql.server:testaction:5301
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.sql.server:question:5301
RULE             : NGINX must be configured to use Online Certificate Status Protocol (OCSP) for certificate path validation and revocation. (OCSP is the preferred configuration.)
QUESTION_TEXT    : If using CRL for certificate revocation, this requirement is Not Applicable.

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

# cat <path to config>

Check the http { blocks for the following example:

http {
    server {
        listen 443 ssl;
        server_name example.com;

        ssl_certificate /etc/nginx/ssl/server.crt;
        ssl_certificate_key /etc/nginx/ssl/server.key;

        ssl_client_certificate /etc/nginx/ssl/ca.crt;

        ssl_verify_client on;

        ssl_crl /etc/nginx/ssl/crl.pem;

        ssl_ocsp on;
        ssl_ocsp_responder http://ocsp.disa.mil;

ssl_stapling on;
ssl_stapling_verify on;
ssl_stapling_file /etc/nginx/ssl/ocsp_cache.pem;
ssl_stapling_responder_timeout 3s;  # Timeout for OCSP responder queries
ssl_stapling_responder_error_cache_time 300s;  # Cache time for responder errors

        location / {
            proxy_pass http://backend;
        }
    }
}             

Check for certificate path validation. If "ssl_verify_client on" is not in the configuration, this is a finding.

Check if OCSP is enabled. If "ssl_ocsp on" is not in the configuration, this is a finding.

Check if OCSP Stapling is configured. If "ssl_stapling on" or "ssl_stapling_verify on" is not in the configuration, this is a finding.

If "ssl_stapling_file <file>" is not present in the configuration, this is a finding.

References:
CCI-000185
CCI-004068
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 7 *******************************

QUESTION         : 8 of 10
TITLE            : CAT II, V-278409, SV-278409r1171979, SRG-APP-000880
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.sql.server:testaction:5901
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.sql.server:question:5901
RULE             : NGINX must separate API maintenance sessions from other network sessions within the system by logically separated communications paths.
QUESTION_TEXT    : If not using the NGINX API, this is Not Applicable.

Determine path to NGINX config file:

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Check that the nginx.conf file contains the API directive and a separate listen address:

http {
    server {
        listen 192.168.0.1:80;
        location / {
            proxy_pass http://backend;
        }
        location /api {
            api write=on;
        }
    }
}             

If the API is running on the same network as production traffic, this is a finding.

References:
CCI-004192
CCI-001414
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 8 *******************************

QUESTION         : 9 of 10
TITLE            : CAT II, V-278410, SV-278410r1172694, SRG-APP-000965
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.sql.server:testaction:6101
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.sql.server:question:6101
RULE             : NGINX must generate, manage, and protect from disclosure and misuse the cryptographic keys that protect access tokens.
QUESTION_TEXT    : Check SSL/TLS certificate and private key file permissions:

# ls -la /home/ubuntu/nginx.com.crt
# ls -la /home/ubuntu/nginx.com.key

Verify:
- Certificate file permissions are 644 or more restrictive.
- Private key file permissions are 600 or more restrictive.
- Files are owned by nginx user or root.
- Files are not world-readable or group-writable.

If these permissions are not set, this is a finding.

Verify certificate validity and strength:

# openssl x509 -in /home/ubuntu/nginx.com.crt -text -noout

Verify:
- Certificate is not expired.
- Uses RSA key length of 2048 bits minimum or ECDSA P-256 minimum.
- Signature algorithm is SHA-256 or stronger (not SHA-1 or MD5).
- Certificate chain is complete and valid.

If these values are not met, this is a finding.

Verify private key strength and protection:

# openssl rsa -in /home/ubuntu/nginx.com.key -text -noout -check

Verify:
- Key length is 2048 bits minimum.
- Key is not encrypted with weak algorithms.
- Key passes integrity check.

If these key values are not set, this is a finding.

References:
CCI-005156
CCI-000366
CCI-005157
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 9 *******************************

QUESTION         : 10 of 10
TITLE            : CAT II, V-278411, SV-278411r1172756, SRG-APP-001020
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.sql.server:testaction:6301
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.sql.server:question:6301
RULE             : NGINX must revoke access tokens in accordance with organization-defined identification and authentication policy.
QUESTION_TEXT    : Verify NGINX Plus revokes or invalidates access tokens:

Check support for token revocation enforcement:

# grep -i "introspect\|revok\|blacklist\|logout" /etc/nginx/conf.d/*.conf

Confirm token validation includes checking revocation status using:
- OAuth2 introspection endpoint.
- Token revocation list.
- Allowlist or deny-list implementation.
- Explicit session logout propagation.

Inspect logout and session termination handling:

# grep -i "session_timeout\|logout\|revoke" /etc/nginx/conf.d/*.conf

Ensure sessions are invalidated upon:
- User logout.
- Token expiration.
- Authentication source change (e.g., password reset).

Token revocation events (manual or automatic) must be logged with user ID, reason, and timestamp.

If NGINX Plus does not support access token revocation or fails to enforce revocation upon compromise or logout, this is a finding.

References:
CCI-005167
CCI-000366
CCI-005168
     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 10 *******************************

