Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
HAProxy must set the maxconn value.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-89217 | VRAU-HA-000490 | SV-99867r1_rule | Medium |
| Description |
|---|
| Limiting the total number of connections that a server is allowed to open prevents an attacker from overloading a web server. Overloading the server will prevent it from managing other tasks besides serving web requests. This setting works together with per-client limits to mitigate against DDoS attacks. |
| STIG | Date |
|---|---|
| VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide | 2018-10-12 |
Details
| Check Text ( C-88909r1_chk ) |
|---|
| At the command line execute the following command: grep maxconn /etc/haproxy/haproxy.cfg If the "maxconn" value is not set to "32768", this is a finding. |
| Fix Text (F-95959r1_fix) |
|---|
| Navigate to and open /etc/haproxy/haproxy.cfg Navigate to the "globals" section and add the following line: maxconn 32768 |