HAProxy must set an absolute timeout on sessions.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-89181	VRAU-HA-000325	SV-99831r1_rule		Medium

Description
Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after an absolute period of time, the user is forced to re-authenticate guaranteeing the session is still in use. Enabling an absolute timeout for sessions closes sessions that are still active. Examples would be a runaway process accessing the web server or an attacker using a hijacked session to slowly probe the web server. HAProxy provides a 'tune.ssl.lifetime' parameter, which will set an absolute timeout on SSL sessions.

Description

Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after an absolute period of time, the user is forced to re-authenticate guaranteeing the session is still in use. Enabling an absolute timeout for sessions closes sessions that are still active. Examples would be a runaway process accessing the web server or an attacker using a hijacked session to slowly probe the web server. HAProxy provides a 'tune.ssl.lifetime' parameter, which will set an absolute timeout on SSL sessions.

STIG	Date
VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide	2018-10-12

Details

Check Text ( C-88873r1_chk )
At the command prompt, execute the following command: grep 'tune.ssl.lifetime' /etc/haproxy/haproxy.cfg If the command returns any value, this is a finding.

Fix Text (F-95923r1_fix)
Navigate to and open /etc/haproxy/haproxy.cfg Navigate to the "globals" section Add the value 'tune.ssl.lifetime 20m'