UCF STIG Viewer Logo

HAProxy must be protected from being stopped by a non-privileged user.


Finding ID Version Rule ID IA Controls Severity
V-89207 VRAU-HA-000425 SV-99857r1_rule Medium
An attacker has at least two reasons to stop a web server. The first is to cause a DoS, and the second is to put in place changes the attacker made to the web server configuration. To prohibit an attacker from stopping the HAProxy process must be owned by "root".
VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide 2018-10-12


Check Text ( C-88899r1_chk )
At the command prompt, execute the following command:

ps aux -U root | grep '[h]aproxy'

If the command does not return a line, this is a finding.
Fix Text (F-95949r1_fix)
Restart the HAProxy service as "root".