STIGhubSTIGhub
STIGsRMF ControlsCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • RMF Controls
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 5 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide

Version

V1R2

Release Date

Sep 12, 2023

SCAP Benchmark ID

VMW_vRealize_Automation_7-x_HA_Proxy_STIG

Total Checks

55

Tags

other
CAT I: 5CAT II: 50CAT III: 0

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (55)

V-240039MEDIUMHAProxy must limit the amount of time that an http request can be received.V-240040MEDIUMHAProxy must enable cookie-based persistence in a backend.V-240041MEDIUMHAProxy must be configured with FIPS 140-2 compliant ciphers for https connections.V-240042MEDIUMHAProxy must be configured to use TLS for https connections.V-240043MEDIUMHAProxy must be configured to use syslog.V-240044MEDIUMHAProxy must generate log records for system startup and shutdown.V-240045MEDIUMHAProxy must log what type of events occurred.V-240046MEDIUMHAProxy must log when events occurred.V-240047MEDIUMHAProxy must log where events occurred.V-240048MEDIUMHAProxy must log the source of events.V-240049MEDIUMHAProxy must log the outcome of events.V-240050MEDIUMHAProxy must log the session ID from the request headers.V-240051MEDIUMHAProxy must use a logging mechanism that is configured to alert the ISSO and SA in the event of a processing failure.V-240052MEDIUMHAProxy log files must not be accessible to unauthorized users.V-240053MEDIUMHAProxy log files must be protected from unauthorized modification.V-240054MEDIUMHAProxy log files must be protected from unauthorized deletion.V-240055MEDIUMHAProxy log files must be backed up onto a different system or media.V-240056MEDIUMHAProxy files must be verified for their integrity (checksums) before being added to the build systems.V-240057MEDIUMHAProxy expansion modules must be verified for their integrity (checksums) before being added to the build systems.V-240058MEDIUMHAProxy must limit access to the statistics feature.V-240059HIGHHAProxy must not contain any documentation, sample code, example applications, and tutorials.V-240060MEDIUMHAProxy must be run in a chroot jail.V-240061MEDIUMHAProxy frontend servers must be bound to a specific port.V-240062MEDIUMHAProxy must use SSL/TLS protocols in order to secure passwords during transmission from the client.V-240063MEDIUMHAProxy must perform RFC 5280-compliant certification path validation if PKI is being used.V-240064MEDIUMHAProxys private key must have access restricted.V-240065MEDIUMHAProxy must be configured to use only FIPS 140-2 approved ciphers.V-240066HIGHHAProxy must prohibit anonymous users from editing system files.V-240067MEDIUMThe HAProxy baseline must be documented and maintained.V-240068MEDIUMHAProxy must be configured to validate the configuration files during start and restart events.V-240069MEDIUMHAProxy must limit the amount of time that half-open connections are kept alive.V-240070MEDIUMHAProxy must provide default error files.V-240071MEDIUMHAProxy must not be started with the debug switch.V-240072MEDIUMHAProxy must set an absolute timeout on sessions.V-240073MEDIUMHAProxy must set an inactive timeout on sessions.V-240074HIGHHAProxy must redirect all http traffic to use https.V-240075MEDIUMHAProxy must restrict inbound connections from nonsecure zones.V-240076MEDIUMHAProxy must be configured to use syslog.V-240077MEDIUMHAProxy must not impede the ability to write specified log record content to an audit log server.V-240078MEDIUMHAProxy must be configurable to integrate with an organizations security infrastructure.V-240079MEDIUMHAProxy must use the httplog option.V-240080MEDIUMHAProxy libraries, and configuration files must only be accessible to privileged users.V-240081MEDIUMHAProxy psql-local frontend must be bound to port 5433.V-240082MEDIUMHAProxy vcac frontend must be bound to ports 80 and 443.V-240083MEDIUMHAProxy vro frontend must be bound to the correct port 8283.V-240084MEDIUMHAProxy must be configured with FIPS 140-2 compliant ciphers for https connections.V-240085MEDIUMHAProxy must be protected from being stopped by a non-privileged user.V-240086MEDIUMHAProxy must be configured to use SSL/TLS.V-240087MEDIUMHAProxy session IDs must be sent to the client using SSL/TLS.V-240088HIGHHAProxy must set the no-sslv3 value on all client ports.V-240089MEDIUMHAProxy must remove all export ciphers.V-240090MEDIUMHAProxy must maintain the confidentiality and integrity of information during reception.V-240091MEDIUMHAProxy must have the latest approved security-relevant software updates installed.V-240092MEDIUMHAProxy must set the maxconn value.V-258451HIGHThe version of vRealize Automation 7.x HA Proxy running on the system must be a supported version.