HAProxy must limit the amount of time that an http request can be received.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-90297	VRAU-HA-000005	SV-100947r1_rule		Medium

Description
Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a web site, facilitating a denial of service attack. Mitigating this kind of attack will include limiting the parameter values associated with keepalive, (i.e., a parameter used to limit the amount of time a connection may be inactive). HAProxy provides an http-request timeout parameter that set the maximum allowed time to wait for a complete HTTP request. Setting this parameter will mitigate slowloris DoS attacks. Slowloris tries to keep many connections to the target web server open and hold them open as long as possible. It accomplishes this by opening connections to the target web server and sending a partial request. Periodically, it will send subsequent HTTP headers, adding to—but never completing—the request.

Description

Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a web site, facilitating a denial of service attack. Mitigating this kind of attack will include limiting the parameter values associated with keepalive, (i.e., a parameter used to limit the amount of time a connection may be inactive). HAProxy provides an http-request timeout parameter that set the maximum allowed time to wait for a complete HTTP request. Setting this parameter will mitigate slowloris DoS attacks. Slowloris tries to keep many connections to the target web server open and hold them open as long as possible. It accomplishes this by opening connections to the target web server and sending a partial request. Periodically, it will send subsequent HTTP headers, adding to—but never completing—the request.

STIG	Date
VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide	2018-10-12

Details

Check Text ( C-89989r1_chk )
At the command prompt, execute the following command: grep 'timeout http-request' /etc/haproxy/haproxy.cfg If the value of ''timeout http-request" is not set to "5000", is commented out, or is missing, this is a finding.

Fix Text (F-97039r1_fix)
Navigate to and open /etc/haproxy/haproxy.cfg Configure the haproxy.cfg file with the following value in the global section: 'timeout http-request 5000'