STIGQter: STIG Summary: VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Sep 2018:

HAProxy must be configured to use only FIPS 140-2 approved ciphers.

DISA Rule

SV-99817r1_rule

Vulnerability Number

V-89167

Group Title

SRG-APP-000179-WSR-000111

Rule Version

VRAU-HA-000210

Severity

CAT II

CCI(s)

• CCI-000803 - The information system implements mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

10

Fix Recommendation

Navigate to and open the following files:

/etc/haproxy/conf.d/30-vro-config.cfg
/etc/haproxy/conf.d/20-vcac.cfg

Navigate to the frontend section in each file.

Configure the bind keyword file with this cipher list:

'FIPS: +3DES:!aNULL'

Check Contents

At the command prompt, execute the following command:

grep -E 'bind.*ssl' /etc/haproxy/conf.d/30-vro-config.cfg /etc/haproxy/conf.d/20-vcac.cfg

If the return value for SSL cipher list is not set to "FIPS: +3DES:!aNULL", this is a finding.

Vulnerability Number

V-89167

Documentable

False

Rule Version

VRAU-HA-000210

Severity Override Guidance

At the command prompt, execute the following command:

grep -E 'bind.*ssl' /etc/haproxy/conf.d/30-vro-config.cfg /etc/haproxy/conf.d/20-vcac.cfg

If the return value for SSL cipher list is not set to "FIPS: +3DES:!aNULL", this is a finding.

Check Content Reference

M

Target Key

3455

Comments