UCF STIG Viewer Logo

HAProxy must set an absolute timeout on sessions.


Finding ID Version Rule ID IA Controls Severity
V-89181 VRAU-HA-000325 SV-99831r1_rule Medium
Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after an absolute period of time, the user is forced to re-authenticate guaranteeing the session is still in use. Enabling an absolute timeout for sessions closes sessions that are still active. Examples would be a runaway process accessing the web server or an attacker using a hijacked session to slowly probe the web server. HAProxy provides a 'tune.ssl.lifetime' parameter, which will set an absolute timeout on SSL sessions.
VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide 2018-10-12


Check Text ( C-88873r1_chk )
At the command prompt, execute the following command:

grep 'tune.ssl.lifetime' /etc/haproxy/haproxy.cfg

If the command returns any value, this is a finding.
Fix Text (F-95923r1_fix)
Navigate to and open /etc/haproxy/haproxy.cfg

Navigate to the "globals" section

Add the value 'tune.ssl.lifetime 20m'