VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide

The VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide (V1 R2) has 55 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

55STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R2

CurrentPublished Wed Oct 25 2023 What changed in V1R2

HAProxy psql-local frontend must be bound to port 5433.

VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide

Assessment Title

Rule Text

HAProxy psql-local frontend must be bound to port 5433.

Description

Discussion Text

Web servers provide numerous processes, features, and functionalities that utilize TCP/IP ports. Some of these processes may be deemed unnecessary or too unsecure to run on a production system.

The HAProxy load balancer in the vRA appliance listens to port 5433 on behalf of the PostgreSQL service.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-240081

Rule

SV-240081r879756_rule

Severity

medium

Rule Version

VRAU-HA-000395

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

At the command prompt, execute the following command:
 
grep 'bind' /etc/haproxy/conf.d/10-psql.cfg
 
If the value for bind is not set to 5433, this is a finding.

Implementation Procedure

Fix Text

Navigate to and open /etc/haproxy/conf.d/10-psql.cfg

Navigate to and configure the "frontend psql-local" section with the following value:  

bind 127.0.0.1:5433

STIG check 43 of 55 in the VMW vRealize Automation 7.x HA Proxy STIG checklist

← Previous · V-240080HAProxy libraries, and configuration files must only be accessible to privileged users.Next · V-240082 →HAProxy vcac frontend must be bound to ports 80 and 443.