Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
HAProxy must enable cookie-based persistence in a backend.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-90299 | VRAU-HA-000010 | SV-100949r1_rule | Medium |
| Description |
|---|
| Session management is the practice of protecting the bulk of the user authorization and identity information. As a load balancer, HAProxy must participate in session management in order to set the session management cookie. Additionally, HAProxy must also ensure that the backend server which started the session with the client is forwarded subsequent requests from the client. |
| STIG | Date |
|---|---|
| VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide | 2018-10-12 |
Details
| Check Text ( C-89991r1_chk ) |
|---|
| Navigate to and open the following files: /etc/haproxy/conf.d/20-vcac.cfg /etc/haproxy/conf.d/30-vro-config.cfg Verify that each backend is configured with the following: cookie JSESSIONID prefix If "cookie" is not set for each backend, this is a finding. |
| Fix Text (F-97041r1_fix) |
|---|
| Navigate to and open the following files: /etc/haproxy/conf.d/20-vcac.cfg /etc/haproxy/conf.d/30-vro-config.cfg Configure each backend with the following value: 'cookie JSESSIONID prefix' |