← Back to VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide

V-240040

CAT II (Medium)

HAProxy must enable cookie-based persistence in a backend.

Rule ID

SV-240040r879511_rule

STIG

VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide

Version

V1R2

CCIs

CCI-000054

Discussion

Session management is the practice of protecting the bulk of the user authorization and identity information. As a load balancer, HAProxy must participate in session management in order to set the session management cookie. Additionally, HAProxy must also ensure that the backend server which started the session with the client is forwarded subsequent requests from the client.

Check Content

Navigate to and open the following files:

/etc/haproxy/conf.d/20-vcac.cfg
/etc/haproxy/conf.d/30-vro-config.cfg

Verify that each backend is configured with the following:

cookie JSESSIONID prefix

If "cookie" is not set for each backend, this is a finding.

Fix Text

Navigate to and open the following files:

/etc/haproxy/conf.d/20-vcac.cfg
/etc/haproxy/conf.d/30-vro-config.cfg

Configure each backend with the following value:

'cookie JSESSIONID prefix'