4510-nginx-accesslog-Ensure NGINX Access Logging is Enabled¶

Rule ID¶

• 4510-nginx-accesslog

Category¶

• nginx

Level¶

• info

Compatible Versions¶

• Linux

Description¶

• Every core site should have the access_log directive. It is enabled by default.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• Access logging allows incident responders and auditors to investigate system access when an incident occurs.

Risk Item¶

• nginx security

Audit Method¶

• Execute the following command to verify:

grep -ir access_log /etc/nginx
# Output should be
access_log /var/log/nginx/host.access.log main;
# If the output is as follows, disable it and add a log path instead
access_log off;

Remediation¶

• Edit the file /etc/nginx/nginx.conf. Example:

access_log /var/log/nginx/host.access.log main;

Impact¶

• None

Default Value¶

• By default, access logging is enabled.

References¶

• None

CIS Controls¶

• None