HAProxy must not impede the ability to write specified log record content to an audit log server.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-240077	VRAU-HA-000365	SV-240077r879731_rule		Medium

Description
Writing events to a centralized management audit system offers many benefits to the enterprise over having dispersed logs. Centralized management of audit records and logs provides for efficiency in maintenance and management of records, enterprise analysis of events, and backup and archiving of event records enterprise-wide. The web server and related components are required to be capable of writing logs to centralized audit log servers.

Description

Writing events to a centralized management audit system offers many benefits to the enterprise over having dispersed logs. Centralized management of audit records and logs provides for efficiency in maintenance and management of records, enterprise analysis of events, and backup and archiving of event records enterprise-wide. The web server and related components are required to be capable of writing logs to centralized audit log servers.

STIG	Date
VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide	2023-09-12

Details

Check Text ( C-43310r665398_chk )
Navigate to and open /etc/haproxy/haproxy.cfg Navigate to the "globals" section. Verify that the "globals" section contains the "log" keyword, and that the "log" option contains the local0 syslog facility as its parameter. If properly configured, the "globals" section will contain the following: global log 127.0.0.1 local0 If the local0 syslog facility is not configured, this is a finding. Navigate to the "defaults" section. Verify that the "defaults" section contains the "log" keyword with the global value. Verify that an option keyword has been configured with the "httplog" value. If properly configured, the "defaults" section will contain the following: defaults log global option httplog Navigate to and open the following files: /etc/haproxy/conf.d/30-vro-config.cfg /etc/haproxy/conf.d/20-vcac.cfg Navigate to the each frontend section. Verify that the "log" keyword has not been set for each frontend. If the "log" keyword is present in a frontend, this is a finding. Navigate to and open /etc/rsyslog.d/vcac.conf. Review the configured syslog facilities and determine the location of the log file for the local0 syslog facility. If the local0 syslog facility does not refer to a valid log file, this is a finding. Navigate to and open the local0 syslog log file. Verify that HAProxy is logging start and stop events to the log file. If the log file is not recording HAProxy start and stop events, this is a finding.

Check Text ( C-43310r665398_chk )

Navigate to and open /etc/haproxy/haproxy.cfg

Navigate to the "globals" section.

Verify that the "globals" section contains the "log" keyword, and that the "log" option contains the local0 syslog facility as its parameter.

If properly configured, the "globals" section will contain the following:

global
log 127.0.0.1 local0

If the local0 syslog facility is not configured, this is a finding.

Navigate to the "defaults" section.

Verify that the "defaults" section contains the "log" keyword with the global value.

Verify that an option keyword has been configured with the "httplog" value.

If properly configured, the "defaults" section will contain the following:

defaults
log global
option httplog

Navigate to and open the following files:

/etc/haproxy/conf.d/30-vro-config.cfg
/etc/haproxy/conf.d/20-vcac.cfg

Navigate to the each frontend section.

Verify that the "log" keyword has not been set for each frontend.

If the "log" keyword is present in a frontend, this is a finding.

Navigate to and open /etc/rsyslog.d/vcac.conf.

Review the configured syslog facilities and determine the location of the log file for the local0 syslog facility.

If the local0 syslog facility does not refer to a valid log file, this is a finding.

Navigate to and open the local0 syslog log file.

Verify that HAProxy is logging start and stop events to the log file.

If the log file is not recording HAProxy start and stop events, this is a finding.

Fix Text (F-43269r665399_fix)
Navigate to and open /etc/rsyslog.d/vcac.conf. Configure the local0 syslog facility to write to an appropriate log file. Navigate to and open /etc/haproxy/haproxy.cfg. Configure the globals section with the following: log 127.0.0.1 local0 Configure the defaults section with both of the following: log global option httplog