Red Hat Ansible Automation Controller STIG (Y26M01)

22 items · Security · Hard difficulty · 4 hours

Practical STIG checklist to harden Red Hat Ansible Automation Controller.

• Download the Red Hat Ansible Automation Controller STIG and XCCDF files from DISA

  Get latest STIG/XCCDF from cyber.mil or public.cyber.mil

• Verify Ansible Automation Platform version 2.2 is installed

  Confirm the controller version matches the STIG scope

• Review Red Hat installation and product documentation

  Follow vendor install guides before applying STIG settings

• Test configurations in a representative staging environment

  Mirror production architecture to validate functionality

• Integrate controller with central IAM (SSO/LDAP)

  Use enterprise identity provider for authentication

• Enforce role-based access control and least privilege

  Define roles and remove unnecessary admin rights

• Remove or disable default and unused accounts

  Eliminate default credentials and orphaned users

• Configure TLS/HTTPS for the controller web UI
• Install a trusted TLS certificate from your CA

  Avoid self-signed certs in production

• Verify certificate chain and enforce strong TLS ciphers

  Prefer TLS 1.2/1.3 and strong cipher suites

• Harden the PostgreSQL database for the controller
• Require strong DB authentication and encrypt connections

  Use SCRAM/SASL and SSL for DB connections

• Limit network access to the database host

  Restrict via firewall rules and pg_hba.conf

• Enable encrypted database backups and secure storage

  Encrypt backups and control access to them

• Enable and forward logs to a central logging system

  Include controller, automation, and system logs

• Enable audit logging and set retention policies

  Ensure retention meets compliance requirements

• Apply OS and controller product security patches

  Keep host OS and Ansible components up to date

• Run an automated STIG compliance scan using XCCDF/SCAP

  Use downloaded XCCDF to scan the controller

• Review scan findings and remediate non-compliant items

  Record remediation actions and dates

• Backup controller configuration and database before changes

  Snapshot configs and DB to enable rollback

• Document exceptions and obtain AO approval for deviations

  Capture risk acceptance and justification

• Maintain change log and update checklist with version info

  Record STIG version, update dates, and changelog

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.