What changed in VMW vRealize Automation 7.x HA Proxy STIG V1R2V1R2 changes

VMW vRealize Automation 7.x HA Proxy STIG V1R2 (2023-10-25) replaced V1R1 (2018-09-28): 55 checks added, 54 removed. It has 55 checks, against 54 in V1R1.

V1R2 checklistV1R1 checklist Compare V1R1 and V1R2 in STIG Compare

  • 55 added
  • 54 removed
  • 0 updated

Added in V1R2 (55)

  • V-240039CAT IIHAProxy must limit the amount of time that an http request can be received.
  • V-240040CAT IIHAProxy must enable cookie-based persistence in a backend.
  • V-240041CAT IIHAProxy must be configured with FIPS 140-2 compliant ciphers for https connections.
  • V-240042CAT IIHAProxy must be configured to use TLS for https connections.
  • V-240043CAT IIHAProxy must be configured to use syslog.
  • V-240044CAT IIHAProxy must generate log records for system startup and shutdown.
  • V-240045CAT IIHAProxy must log what type of events occurred.
  • V-240046CAT IIHAProxy must log when events occurred.
  • V-240047CAT IIHAProxy must log where events occurred.
  • V-240048CAT IIHAProxy must log the source of events.
  • V-240049CAT IIHAProxy must log the outcome of events.
  • V-240050CAT IIHAProxy must log the session ID from the request headers.
  • V-240051CAT IIHAProxy must use a logging mechanism that is configured to alert the ISSO and SA in the event of a processing failure.
  • V-240052CAT IIHAProxy log files must not be accessible to unauthorized users.
  • V-240053CAT IIHAProxy log files must be protected from unauthorized modification.
  • V-240054CAT IIHAProxy log files must be protected from unauthorized deletion.
  • V-240055CAT IIHAProxy log files must be backed up onto a different system or media.
  • V-240056CAT IIHAProxy files must be verified for their integrity (checksums) before being added to the build systems.
  • V-240057CAT IIHAProxy expansion modules must be verified for their integrity (checksums) before being added to the build systems.
  • V-240058CAT IIHAProxy must limit access to the statistics feature.
  • V-240059CAT IHAProxy must not contain any documentation, sample code, example applications, and tutorials.
  • V-240060CAT IIHAProxy must be run in a chroot jail.
  • V-240061CAT IIHAProxy frontend servers must be bound to a specific port.
  • V-240062CAT IIHAProxy must use SSL/TLS protocols in order to secure passwords during transmission from the client.
  • V-240063CAT IIHAProxy must perform RFC 5280-compliant certification path validation if PKI is being used.
  • V-240064CAT IIHAProxys private key must have access restricted.
  • V-240065CAT IIHAProxy must be configured to use only FIPS 140-2 approved ciphers.
  • V-240066CAT IHAProxy must prohibit anonymous users from editing system files.
  • V-240067CAT IIThe HAProxy baseline must be documented and maintained.
  • V-240068CAT IIHAProxy must be configured to validate the configuration files during start and restart events.
  • V-240069CAT IIHAProxy must limit the amount of time that half-open connections are kept alive.
  • V-240070CAT IIHAProxy must provide default error files.
  • V-240071CAT IIHAProxy must not be started with the debug switch.
  • V-240072CAT IIHAProxy must set an absolute timeout on sessions.
  • V-240073CAT IIHAProxy must set an inactive timeout on sessions.
  • V-240074CAT IHAProxy must redirect all http traffic to use https.
  • V-240075CAT IIHAProxy must restrict inbound connections from nonsecure zones.
  • V-240076CAT IIHAProxy must be configured to use syslog.
  • V-240077CAT IIHAProxy must not impede the ability to write specified log record content to an audit log server.
  • V-240078CAT IIHAProxy must be configurable to integrate with an organizations security infrastructure.
  • V-240079CAT IIHAProxy must use the httplog option.
  • V-240080CAT IIHAProxy libraries, and configuration files must only be accessible to privileged users.
  • V-240081CAT IIHAProxy psql-local frontend must be bound to port 5433.
  • V-240082CAT IIHAProxy vcac frontend must be bound to ports 80 and 443.
  • V-240083CAT IIHAProxy vro frontend must be bound to the correct port 8283.
  • V-240084CAT IIHAProxy must be configured with FIPS 140-2 compliant ciphers for https connections.
  • V-240085CAT IIHAProxy must be protected from being stopped by a non-privileged user.
  • V-240086CAT IIHAProxy must be configured to use SSL/TLS.
  • V-240087CAT IIHAProxy session IDs must be sent to the client using SSL/TLS.
  • V-240088CAT IHAProxy must set the no-sslv3 value on all client ports.
  • V-240089CAT IIHAProxy must remove all export ciphers.
  • V-240090CAT IIHAProxy must maintain the confidentiality and integrity of information during reception.
  • V-240091CAT IIHAProxy must have the latest approved security-relevant software updates installed.
  • V-240092CAT IIHAProxy must set the maxconn value.
  • V-258451CAT IThe version of vRealize Automation 7.x HA Proxy running on the system must be a supported version.

Removed since V1R1 (54)

  • V-89139CAT IIHAProxy must use a logging mechanism that is configured to alert the ISSO and SA in the event of a processing failure.
  • V-89141CAT IIHAProxy log files must not be accessible to unauthorized users.
  • V-89143CAT IIHAProxy log files must be protected from unauthorized modification.
  • V-89145CAT IIHAProxy log files must be protected from unauthorized deletion.
  • V-89147CAT IIHAProxy log files must be backed up onto a different system or media.
  • V-89149CAT IIHAProxy files must be verified for their integrity (checksums) before being added to the build systems.
  • V-89151CAT IIHAProxy expansion modules must be verified for their integrity (checksums) before being added to the build systems.
  • V-89153CAT IIHAProxy must limit access to the statistics feature.
  • V-89155CAT IHAProxy must not contain any documentation, sample code, example applications, and tutorials.
  • V-89157CAT IIHAProxy must be run in a chroot jail.
  • V-89159CAT IIHAProxy frontend servers must be bound to a specific port.
  • V-89161CAT IIHAProxy must use SSL/TLS protocols in order to secure passwords during transmission from the client.
  • V-89163CAT IIHAProxy must perform RFC 5280-compliant certification path validation if PKI is being used.
  • V-89165CAT IIHAProxys private key must have access restricted.
  • V-89167CAT IIHAProxy must be configured to use only FIPS 140-2 approved ciphers.
  • V-89169CAT IHAProxy must prohibit anonymous users from editing system files.
  • V-89171CAT IIThe HAProxy baseline must be documented and maintained.
  • V-89173CAT IIHAProxy must be configured to validate the configuration files during start and restart events.
  • V-89175CAT IIHAProxy must limit the amount of time that half-open connections are kept alive.
  • V-89177CAT IIHAProxy must provide default error files.
  • V-89179CAT IIHAProxy must not be started with the debug switch.
  • V-89181CAT IIHAProxy must set an absolute timeout on sessions.
  • V-89183CAT IIHAProxy must set an inactive timeout on sessions.
  • V-89185CAT IHAProxy must redirect all http traffic to use https.
  • V-89187CAT IIHAProxy must restrict inbound connections from nonsecure zones.
  • V-89189CAT IIHAProxy must be configured to use syslog.
  • V-89191CAT IIHAProxy must not impede the ability to write specified log record content to an audit log server.
  • V-89193CAT IIHAProxy must be configurable to integrate with an organizations security infrastructure.
  • V-89195CAT IIHAProxy must use the httplog option.
  • V-89197CAT IIHAProxy libraries, and configuration files must only be accessible to privileged users.
  • V-89199CAT IIHAProxy psql-local frontend must be bound to port 5433.
  • V-89201CAT IIHAProxy vcac frontend must be bound to ports 80 and 443.
  • V-89203CAT IIHAProxy vro frontend must be bound to the correct port 8283.
  • V-89205CAT IIHAProxy must be configured with FIPS 140-2 compliant ciphers for https connections.
  • V-89207CAT IIHAProxy must be protected from being stopped by a non-privileged user.
  • V-89209CAT IIHAProxy must be configured to use SSL/TLS.
  • V-89211CAT IHAProxy must set the no-sslv3 value on all client ports.
  • V-89213CAT IIHAProxy must remove all export ciphers.
  • V-89215CAT IIHAProxy must have the latest approved security-relevant software updates installed.
  • V-89217CAT IIHAProxy must set the maxconn value.
  • V-90297CAT IIHAProxy must limit the amount of time that an http request can be received.
  • V-90299CAT IIHAProxy must enable cookie-based persistence in a backend.
  • V-90301CAT IIHAProxy must be configured with FIPS 140-2 compliant ciphers for https connections.
  • V-90303CAT IIHAProxy must be configured to use TLS for https connections.
  • V-90305CAT IIHAProxy must be configured to use syslog.
  • V-90307CAT IIHAProxy must generate log records for system startup and shutdown.
  • V-90309CAT IIHAProxy must log what type of events occurred.
  • V-90311CAT IIHAProxy must log when events occurred.
  • V-90313CAT IIHAProxy must log where events occurred.
  • V-90315CAT IIHAProxy must log the source of events.
  • V-90317CAT IIHAProxy must log the outcome of events.
  • V-90319CAT IIHAProxy must log the session ID from the request headers.
  • V-90321CAT IIHAProxy session IDs must be sent to the client using SSL/TLS.
  • V-90323CAT IIHAProxy must maintain the confidentiality and integrity of information during reception.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R2 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.