HAProxy must limit the amount of time that an http request can be received.

From VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide

Associated with: CCI-000054

SV-100947r1_rule HAProxy must limit the amount of time that an http request can be received.

Vulnerability discussion

Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a web site, facilitating a denial of service attack. Mitigating this kind of attack will include limiting the parameter values associated with keepalive, (i.e., a parameter used to limit the amount of time a connection may be inactive).HAProxy provides an http-request timeout parameter that set the maximum allowed time to wait for a complete HTTP request. Setting this parameter will mitigate slowloris DoS attacks. Slowloris tries to keep many connections to the target web server open and hold them open as long as possible. It accomplishes this by opening connections to the target web server and sending a partial request. Periodically, it will send subsequent HTTP headers, adding to—but never completing—the request.

Check content

At the command prompt, execute the following command: grep 'timeout http-request' /etc/haproxy/haproxy.cfg If the value of ''timeout http-request" is not set to "5000", is commented out, or is missing, this is a finding.

Fix text

Navigate to and open /etc/haproxy/haproxy.cfg Configure the haproxy.cfg file with the following value in the global section: 'timeout http-request 5000'

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.