HAProxy must set the maxconn value.

From VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide

Associated with: CCI-000366

SV-99867r1_rule HAProxy must set the maxconn value.

Vulnerability discussion

Limiting the total number of connections that a server is allowed to open prevents an attacker from overloading a web server. Overloading the server will prevent it from managing other tasks besides serving web requests.This setting works together with per-client limits to mitigate against DDoS attacks.

Check content

At the command line execute the following command: grep maxconn /etc/haproxy/haproxy.cfg If the "maxconn" value is not set to "32768", this is a finding.

Fix text

Navigate to and open /etc/haproxy/haproxy.cfg Navigate to the "globals" section and add the following line: maxconn 32768

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.