cis-nginx-v300-2-3-2

CIS 2.3.2 — Ensure access to NGINX directories and files is restricted

Profile Applicability

• Level 1 - Webserver
• Level 1 - Proxy
• Level 1 - Loadbalancer

Description

The NGINX configuration directory (/etc/nginx or equivalent) and its contents should have restrictive permissions to enforce the principle of least privilege.

• Directories should be accessible only by the root user and the root group (and potentially read/execute by the group), but not by others.
• Files should be readable/writable by root and readable by the group, but inaccessible to others.

Rationale

Restrictive file permissions prevent unauthorized users on the system from viewing sensitive configuration details, such as backend IP addresses, routing logic, or loaded module paths. By removing "world" access (permissions for "other"), we ensure that only administrators (via sudo) can interact with the web server configuration. This is a fundamental defense against information disclosure.

Impact

Setting permissions to 640 (files) and 750 (directories) prevents non-privileged users from listing the configuration directory or reading configuration files.

Audit Procedure

1. Identify Configuration Directory:

Run nginx -V and identify the --conf-path to determine the configuration root (e.g., /etc/nginx).

2. Audit Directory Permissions:

Run the following command to find directories with loose permissions:

find /etc/nginx -type d -exec stat -Lc "%n %a" {} +

Evaluation:

Verify that the output shows permissions of 750 (drwxr-x---) or more restrictive (e.g., 700).

• Standard: 755 (drwxr-xr-x) allows world read/execute.
• Hardened Target: 750 or 700.

3. Audit File Permissions:

Run the following command to find files with loose permissions:

find /etc/nginx -type f -exec stat -Lc "%n %a" {} +

Evaluation:

Verify that the output shows permissions of 640 (-rw-r-----) or more restrictive (e.g., 600).

• Standard: 644 (-rw-r--r--) allows world read.
• Hardened Target: 640 or 600.

Remediation

To restrict access to the NGINX configuration directory and files, execute the following commands:

1. Restrict Directories (750):

Allow owner (root) full access, group read/execute, deny others.

find /etc/nginx -type d -exec chmod 750 {} +

2. Restrict Files (640):

Allow owner (root) read/write, group read, deny others.

find /etc/nginx -type f -exec chmod 640 {} +

Note: Private keys (e.g., .key files) require even stricter permissions (400 or 600) and should be addressed separately or manually verified here.

Default Value

Default permissions are typically 755 for directories and 644 for files (world-readable).

Additional Information

Critical: If your NGINX setup relies on the worker process (nginx user) reading configuration files directly (uncommon for standard configs, but possible with certain includes or SSL certificates not handled by the master process), ensure the nginx user is in the group that owns the files, OR use chmod 644 if absolutely necessary. However, the Master Process (root) handles parsing, so 640/root:root is usually safe.

References

1. https://nginx.org/en/docs/ngx_core_module.html

CIS Controls

MITRE ATT&CK Mappings

Profile

• Level 1 - Webserver
• Level 1 - Proxy
• Level 1 - Loadbalancer