HAProxy must prohibit anonymous users from editing system files.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-89169	VRAU-HA-000225	SV-99819r1_rule		High

Description
Allowing anonymous users the capability to change the web server or the hosted application will not generate proper log information that can then be used for forensic reporting in the case of a security issue. Allowing anonymous users to make changes will also grant change capabilities to anybody without forcing a user to authenticate before the changes can be made.

STIG	Date
VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide	2018-10-12

Details

Check Text ( C-88861r1_chk )
At the command prompt, execute the following command: ls -alR /etc/haproxy /var/lib/haproxy /usr/sbin/haproxy | grep -E '^-' | awk '{print $1}' | cut -c9 | grep w If the command returns any value, this is a finding.

Fix Text (F-95911r1_fix)
Navigate to and remove anonymous permissions for any listed files.