VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide

The VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide (V1 R2) has 55 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

55STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R2

CurrentPublished Wed Oct 25 2023 What changed in V1R2

HAProxy must be run in a chroot jail.

VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide

Assessment Title

Rule Text

HAProxy must be run in a chroot jail.

Description

Discussion Text

Chroot is an operation that changes the apparent root directory for the current running process and their children. A program that is run in such a modified environment cannot access files and commands outside that environmental directory tree. This modified environment is called a chroot jail.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-240060

Rule

SV-240060r879587_rule

Severity

medium

Rule Version

VRAU-HA-000175

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

At the command prompt, execute the following command:

grep 'chroot' /etc/haproxy/haproxy.cfg

If the value "/var/lib/haproxy" is not listed, this is a finding.

Implementation Procedure

Fix Text

Navigate to and open /etc/haproxy/haproxy.cfg

Navigate to and configure the globals section with the following value:

'chroot /var/lib/haproxy'

STIG check 22 of 55 in the VMW vRealize Automation 7.x HA Proxy STIG checklist

← Previous · V-240059HAProxy must not contain any documentation, sample code, example applications, and tutorials.Next · V-240061 →HAProxy frontend servers must be bound to a specific port.