Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
HAProxy files must be verified for their integrity (checksums) before being added to the build systems.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-89149 | VRAU-HA-000115 | SV-99799r1_rule | Medium |
| Description |
|---|
| Being able to verify that a patch, upgrade, certificate, etc., being added to the web server is unchanged from the producer of the file is essential for file validation and non-repudiation of the information. The HAProxy web server files on vRA must be part of a documented build process. Checksums of the production files must be available to verify their integrity. |
| STIG | Date |
|---|---|
| VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide | 2018-10-12 |
Details
| Check Text ( C-88841r1_chk ) |
|---|
| Interview the ISSO. Determine whether web server files are verified/validated before being implemented into the production environment. If the web server files are not verified or validated before being implemented into the production environment, this is a finding. |
| Fix Text (F-95891r1_fix) |
|---|
| Ensure web server files are verified or validated before being implemented the production environment. |