VMware vSphere 6.7 RhttpProxy Security Technical Implementation Guide

The VMware vSphere 6.7 RhttpProxy Security Technical Implementation Guide (V1 R3) has 10 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

10STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R3

CurrentPublished Wed Jul 26 2023

The rhttpproxy must drop connections to disconnected clients.

VMware vSphere 6.7 RhttpProxy Security Technical Implementation Guide

Assessment Title

Rule Text

The rhttpproxy must drop connections to disconnected clients.

Description

Discussion Text

The rhttpproxy client connections that are established but no longer connected can consume resources that might otherwise be required by active connections. It is a best practice to terminate connections that are no longer connected to an active client.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-240716

Rule

SV-240716r879511_rule

Severity

medium

Rule Version

VCRP-67-000001

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

At the command prompt, execute the following command:

# xmllint --xpath '/config/vmacore/tcpKeepAlive/clientSocket/idleTimeSec' /etc/vmware-rhttpproxy/config.xml

Expected result:

<idleTimeSec>900</idleTimeSec>

If the output does not match the expected result, this is a finding.

Implementation Procedure

Fix Text

Navigate to and open /etc/vmware-rhttpproxy/config.xml.

Locate the <config>/<vmacore>/<tcpKeepAlive>/<clientSocket> block and configure <idleTimeSec> as follows:

<idleTimeSec>900</idleTimeSec>

Restart the service for changes to take effect.

# vmon-cli --restart rhttpproxy

STIG check 1 of 10 in the VMware vSphere 6.7 RhttpProxy STIG checklist

Next · V-240717 →The rhttpproxy must set a limit on established connections.