VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide

The VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide (V1 R2) has 55 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

55STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R2

CurrentPublished Wed Oct 25 2023 What changed in V1R2

HAProxy must set the maxconn value.

VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide

Assessment Title

Rule Text

HAProxy must set the maxconn value.

Description

Discussion Text

Limiting the total number of connections that a server is allowed to open prevents an attacker from overloading a web server. Overloading the server will prevent it from managing other tasks besides serving web requests.

This setting works together with per-client limits to mitigate against DDoS attacks.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-240092

Rule

SV-240092r879887_rule

Severity

medium

Rule Version

VRAU-HA-000490

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

At the command line execute the following command:
 
grep maxconn /etc/haproxy/haproxy.cfg
 
If the "maxconn" value is not set to "32768", this is a finding.

Implementation Procedure

Fix Text

Navigate to and open /etc/haproxy/haproxy.cfg

Navigate to the "globals" section and add the following line:

maxconn 32768

STIG check 54 of 55 in the VMW vRealize Automation 7.x HA Proxy STIG checklist

← Previous · V-240091HAProxy must have the latest approved security-relevant software updates installed.Next · V-258451 →The version of vRealize Automation 7.x HA Proxy running on the system must be a supported version.