V-240085

Discussion

An attacker has at least two reasons to stop a web server. The first is to cause a DoS, and the second is to put in place changes the attacker made to the web server configuration. To prohibit an attacker from stopping the HAProxy process must be owned by "root".

Check Content

At the command prompt, execute the following command:

ps aux -U root | grep '[h]aproxy'

If the command does not return a line, this is a finding.