HAProxy must limit the amount of time that half-open connections are kept alive.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-89175	VRAU-HA-000300	SV-99825r1_rule		Medium

Description
A web server can limit the ability of the web server being used in a DoS attack through several methods. The methods employed will depend upon the hosted applications and their resource needs for proper operation. An example setting that could be used to limit the ability of the web server being used in a DoS attack is to limit the amount of time that a half-open connection is kept alive.

STIG	Date
VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide	2018-10-12

Details

Check Text ( C-88867r1_chk )
At the command prompt, execute the following command: grep 'timeout client-fin' /etc/haproxy/haproxy.cfg If the return value for "timeout client-fin" list is not set to "30s", this is a finding.

Fix Text (F-95917r1_fix)
Navigate to and open /etc/haproxy/haproxy.cfg Configure the haproxy.cfg file with the following value in the defaults section: 'timeout client-fin 30s'.