V-240072

Discussion

Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after an absolute period of time, the user is forced to re-authenticate guaranteeing the session is still in use. Enabling an absolute timeout for sessions closes sessions that are still active. Examples would be a runaway process accessing the web server or an attacker using a hijacked session to slowly probe the web server. HAProxy provides a 'tune.ssl.lifetime' parameter, which will set an absolute timeout on SSL sessions.

Check Content

At the command prompt, execute the following command:

grep 'tune.ssl.lifetime' /etc/haproxy/haproxy.cfg

If the command returns any value, this is a finding.