Cis Nginx V300 2 3 2CAUTION

Open-source AI-powered offensive security harness for automated penetration testing.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: cis-nginx-v300-2-3-2
description: "Ensure access to NGINX directories and files is restricted (Manual)"
category: cis-nginx
version: "3.0"
author: cyberstrike-official
tags: [cis, nginx, web-server, reverse-proxy, permissions-ownership, basic-configuration]
cis_id: "2.3.2"
cis_benchmark: "CIS NGINX Benchmark v3.0.0"
tech_stack: [nginx, linux, web-server]
cwe_ids: []
chains_with: []
prerequisites: []
severity_boost: {}
---

# CIS 2.3.2 — Ensure access to NGINX directories and files is restricted

## Profile Applicability

- Level 1 - Webserver
- Level 1 - Proxy
- Level 1 - Loadbalancer

## Description

The NGINX configuration directory (`/etc/nginx` or equivalent) and its contents should have restrictive permissions to enforce the principle of least privilege.

- **Directories** should be accessible only by the `root` user and the `root` group (and potentially read/execute by the group), but not by others.
- **Files** should be readable/writable by `root` and readable by the group, but inaccessible to others.

## Rationale

Restrictive file permissions prevent unauthorized users on the system from viewing sensitive configuration details, such as backend IP addresses, routing logic, or loaded module paths. By removing "world" access (permissions for "other"), we ensure that only administrators (via `sudo`) can interact with the web server configuration. This is a fundamental defense against information disclosure.

## Impact

Setting permissions to `640` (files) and `750` (directories) prevents non-privileged users from listing the configuration directory or reading configuration files.

## Audit Procedure

**1. Identify Configuration Directory:**

Run `nginx -V` and identify the `--conf-path` to determine the configuration root (e.g., `/etc/nginx`).

**2. Audit Directory Permissions:**

Run the following command to find directories with loose permissions:

```bash
find /etc/nginx -type d -exec stat -Lc "%n %a" {} +
```

**Evaluation:**

Verify that the output shows permissions of `750` (`drwxr-x---`) or more restrictive (e.g., `700`).

- **Standard:** `755` (`drwxr-xr-x`) allows world read/execute.
- **Hardened Target:** `750` or `700`.

**3. Audit File Permissions:**

Run the following command to find files with loose permissions:

```bash
find /etc/nginx -type f -exec stat -Lc "%n %a" {} +
```

**Evaluation:**

Verify that the output shows permissions of `640` (`-rw-r-----`) or more restrictive (e.g., `600`).

- **Standard:** `644` (`-rw-r--r--`) allows world read.
- **Hardened Target:** `640` or `600`.

## Remediation

To restrict access to the NGINX configuration directory and files, execute the following commands:

**1. Restrict Directories (750):**

Allow owner (`root`) full access, group read/execute, deny others.

```bash
find /etc/nginx -type d -exec chmod 750 {} +
```

**2. Restrict Files (640):**

Allow owner (`root`) read/write, group read, deny others.

```bash
find /etc/nginx -type f -exec chmod 640 {} +
```

**Note:** Private keys (e.g., `.key` files) require even stricter permissions (`400` or `600`) and should be addressed separately or manually verified here.

## Default Value

Default permissions are typically `755` for directories and `644` for files (world-readable).

## Additional Information

**Critical:** If your NGINX setup relies on the worker process (`nginx` user) reading configuration files directly (uncommon for standard configs, but possible with certain includes or SSL certificates not handled by the master process), ensure the `nginx` user is in the group that owns the files, **OR** use `chmod 644` if absolutely necessary. However, the Master Process (`root`) handles parsing, so `640`/`root:root` is usually safe.

## References

1. https://nginx.org/en/docs/ngx_core_module.html

## CIS Controls

| Controls Version | Control                                               | IG 1 | IG 2 | IG 3 |
| ---------------- | ----------------------------------------------------- | ---- | ---- | ---- |
| v8               | 3.3 Configure Data Access Control Lists               | Y    | Y    | Y    |
| v7               | 14.6 Protect Information through Access Control Lists | Y    | Y    | Y    |

## MITRE ATT&CK Mappings

| Tactic      | Technique                                           |
| ----------- | --------------------------------------------------- |
| Persistence | T1222 - File and Directory Permissions Modification |

## Profile

- Level 1 - Webserver
- Level 1 - Proxy
- Level 1 - Loadbalancer

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (6)

packages/app/public/apple-touch-icon-v3.png

packages/app/public/apple-touch-icon.png

packages/app/public/favicon-96x96-v3.png

packages/app/public/favicon-96x96.png

packages/app/public/favicon-v3.ico

Allow owner (`root`) full access, group read/execute, deny others.

Gates applied: no_behavioural_pass.

[![ModelsAtlas audit: Cis Nginx V300 2 3 2](https://modelsatlas.com/skills/cyberstrikeus/cis-nginx-v300-2-3-2/badge.svg)](https://modelsatlas.com/skills/cyberstrikeus/cis-nginx-v300-2-3-2/)

Not your listing, or something out of date? Claim or update your listing.