HAProxy must enable cookie-based persistence in a backend.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-90299	VRAU-HA-000010	SV-100949r1_rule		Medium

Description
Session management is the practice of protecting the bulk of the user authorization and identity information. As a load balancer, HAProxy must participate in session management in order to set the session management cookie. Additionally, HAProxy must also ensure that the backend server which started the session with the client is forwarded subsequent requests from the client.

STIG	Date
VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide	2018-10-12

Details

Check Text ( C-89991r1_chk )
Navigate to and open the following files: /etc/haproxy/conf.d/20-vcac.cfg /etc/haproxy/conf.d/30-vro-config.cfg Verify that each backend is configured with the following: cookie JSESSIONID prefix If "cookie" is not set for each backend, this is a finding.

Fix Text (F-97041r1_fix)
Navigate to and open the following files: /etc/haproxy/conf.d/20-vcac.cfg /etc/haproxy/conf.d/30-vro-config.cfg Configure each backend with the following value: 'cookie JSESSIONID prefix'