V-256903

Discussion

A failure of the confidentiality of Automation Controller log files would enable an attacker to identify key information about the system that they might not otherwise be able to obtain that would enable them to enumerate more information to enable escalation or lateral movement. Satisfies: SRG-APP-000118-AS-000078, SRG-APP-000119-AS-000079, SRG-APP-000120-AS-000080, SRG-APP-000121-AS-000081, SRG-APP-000122-AS-000082, SRG-APP-000123-AS-000083, SRG-APP-000267-AS-000170

Check Content

As an administrator, log into each Automation Controller host. Inspect the current permissions and owner of Automation Controller's NGINX log directory:<br />stat -c "%a %U %G" /var/log/nginx/ | grep "770 nginx root" || echo "FAILED"<br /><br />If "FAILED" is displayed, this is a finding.<br /><br />Inspect the current permissions and owner of Automation Controller's log directory:<br />$ stat -c "%a %U %G" /var/log/tower/ | grep "750 awx awx" || echo "FAILED"<br /><br />If "FAILED" is displayed, this is a finding.<br /><br />Inspect the current permissions and owner of Automation Controller's supervisor log directory:<br />stat -c "%a %U %G" /var/log/supervisor/ | grep "770 root root" || echo "FAILED"<br /><br />If "FAILED" is displayed, this is a finding.