← Back to VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide

V-240058

CAT II (Medium)

HAProxy must limit access to the statistics feature.

Rule ID

SV-240058r879587_rule

STIG

VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide

Version

V1R2

CCIs

CCI-000381

Discussion

A web server can provide many features, services, and processes. Some of these may be deemed unnecessary or too unsecure to be accessible on a production DoD system. HAProxy provide a statistics page, which will display web browser statistics from any web browser if HAProxy has not been configured to connect the server statistics to a UNIX socket.

Check Content

At the command prompt, execute the following command:

grep 'stats socket' /etc/haproxy/haproxy.cfg

If the command does not return the line below, this is a finding.

stats socket /var/run/haproxy.sock mode 600 level admin

Fix Text

Uninstall or deactivate features, services, and processes not needed by the web server for operation.