VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide

The VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide (V1 R2) has 55 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

55STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R2

CurrentPublished Wed Oct 25 2023 What changed in V1R2

HAProxy vcac frontend must be bound to ports 80 and 443.

VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide

Assessment Title

Rule Text

HAProxy vcac frontend must be bound to ports 80 and 443.

Description

Discussion Text

Web servers provide numerous processes, features, and functionalities that utilize TCP/IP ports. Some of these processes may be deemed unnecessary or too unsecure to run on a production system.

The HAProxy load balancer in the vRA appliance listens to ports 80 and 443 on behalf of the vcac service.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-240082

Rule

SV-240082r879756_rule

Severity

medium

Rule Version

VRAU-HA-000400

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

At the command prompt, execute the following command:
 
grep 'bind' /etc/haproxy/conf.d/20-vcac.cfg
 
If two lines are not returned, this is a finding. 

If the values for bind are not set to "80" and to "443", this is a finding.

Implementation Procedure

Fix Text

Navigate to and open /etc/haproxy/conf.d/20-vcac.cfg

Navigate to and configure the "frontend https-in" section with the following two values:  

bind 0.0.0.0:80
bind 0.0.0.0:443 ssl crt /etc/apache2/server.pem ciphers FIPS:+3DES:!aNULL no-sslv3

STIG check 44 of 55 in the VMW vRealize Automation 7.x HA Proxy STIG checklist

← Previous · V-240081HAProxy psql-local frontend must be bound to port 5433.Next · V-240083 →HAProxy vro frontend must be bound to the correct port 8283.