4506-nginx-pid-secured—Ensure the NGINX Process ID (PID) File Is Secure¶

Rule ID¶

• 4506-nginx-pid-secured

Category¶

• nginx

Level¶

• warn

Supported Versions¶

• Linux

Description¶

• The NGINX PID file stores the master process ID of the NGINX process. This file must not be subject to unauthorized modification.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• The PID file should be owned by root:root. It should be readable by everyone but writable only by root (permissions 644). This prevents unauthorized modification of the PID file, which could lead to a denial of service.

Risk Items¶

• NGINX security

Audit Method¶

• Execute the following command to verify:

ls -l /var/run/nginx.pid
# The result should be:
-rw-r--r--. 1 root root 6 Nov 12 01:06 /var/run/nginx.pid

Remediation¶

• Execute the following commands:

#> chown root:root /var/run/nginx.pid
#> chown 644 /var/run/nginx.pid

Impact¶

• None

Default Value¶

• By default, the PID file is owned by the root user.

References¶

• nginx-user

CIS Controls¶

• None