The HAProxy baseline must be documented and maintained.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-89171	VRAU-HA-000275	SV-99821r1_rule		Medium

Description
Without maintenance of a baseline of current HAProxy software, monitoring for changes cannot be complete and unauthorized changes to the software can go undetected. Changes to HAProxy could be the result of intentional or unintentional actions.

STIG	Date
VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide	2018-10-12

Details

Check Text ( C-88863r1_chk )
Have the appliance administrator and/or ISSO provide the HAProxy software baseline procedures, implementation evidence, and a list of files and directories included in the baseline procedure for completeness. If baseline procedures do not exist, not implemented reliably, or are not complete, this is a finding.

Fix Text (F-95913r1_fix)
Develop, document, and implement baseline procedures that include all HAProxy software files and directories. Update the baseline after new installations, upgrades, or maintenance activities that include changes to the software baseline.