HAProxy must be protected from being stopped by a non-privileged user.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-89207	VRAU-HA-000425	SV-99857r1_rule		Medium

Description
An attacker has at least two reasons to stop a web server. The first is to cause a DoS, and the second is to put in place changes the attacker made to the web server configuration. To prohibit an attacker from stopping the HAProxy process must be owned by "root".

STIG	Date
VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide	2018-10-12

Details

Check Text ( C-88899r1_chk )
At the command prompt, execute the following command: ps aux -U root | grep '[h]aproxy' If the command does not return a line, this is a finding.

Fix Text (F-95949r1_fix)
Restart the HAProxy service as "root".