V-240062

Discussion

Data used to authenticate, especially passwords, needs to be protected at all times, and encryption is the standard method for protecting authentication data during transmission. Even when data is passed through a load balancer, data used to authenticate users must be sent via SSL/TLS.

Check Content

At the command line execute the following command:

cat /etc/haproxy/conf.d/20-vcac.cfg | awk '$0 ~ /bind.*:80/ || $0 ~ /redirect.*ssl_fc/ {print}'

If the command does not return the two lines below, this is a finding.

bind 0.0.0.0:80
redirect scheme https if !{ ssl_fc }