F5 NGINX STIG

18 items · Security · Hard difficulty · 4 hours

Practical steps to harden F5 NGINX servers to DISA STIG standards.

• Download and review the F5 NGINX STIG document

  Obtain Ver 1, Rel 1 from DISA or public.cyber.mil and read scope/requirements.

• Inventory NGINX instances and versions

  List hosts, roles (proxy/load balancer/app server), and installed NGINX variants.

• Backup current NGINX configuration and certificates

  Export nginx.conf, vhosts, TLS certs, and related files to secure storage.

• Apply system and NGINX security patches

  Update OS packages and NGINX to latest stable or STIG-approved releases.

• Enforce least privilege on NGINX files and directories

  Set correct ownership and restrictive permissions for configs, logs, and web roots.

• Disable unused NGINX modules and features

  Remove or turn off modules not required by your deployment to reduce attack surface.

• Configure strong TLS settings

  Apply STIG-recommended TLS controls for confidentiality and integrity.

• Set minimum TLS version to TLS 1.2 or higher

  Enforce ssl_protocols TLSv1.2 TLSv1.3 (or per STIG guidance).

• Enable strong cipher suites and disable weak ciphers

  Configure ssl_ciphers and prefer_server_ciphers to STIG-approved lists.

• Enable OCSP stapling and HSTS where appropriate

  Turn on stapling and set HSTS only for HTTPS sites that support it.

• Implement access controls for management interfaces

  Restrict admin UI/API by IP, use strong auth and MFA for management accounts.

• Enable and centralize access and error logging

  Configure detailed logs and forward to SIEM or centralized syslog for analysis.

• Configure rate limiting and connection limits

  Use limit_req, limit_conn and worker_connections to mitigate abuse and DoS.

• Harden HTTP headers and disable information leakage

  Disable server tokens and add X-Frame-Options, X-Content-Type-Options, CSP.

• Enable WAF or application-layer protections

  Activate ModSecurity or F5 WAF and apply rulesets appropriate to apps.

• Automate configuration backups and change tracking

  Use version control and scheduled exports for nginx configs and certs.

• Perform vulnerability scan and review CVEs

  Scan instances and consult NIST/NVD and DISA for applicable advisories.

• Validate STIG compliance and document exceptions

  Run STIG tools, record findings, and document any accepted waivers or mitigations.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.