VCRP-67-000001 - The rhttpproxy must drop connections to disconnected clients.

Information

The rhttpproxy client connections that are established but no longer connected can consume resources that might otherwise be required by active connections. It is a best practice to terminate connections that are no longer connected to an active client.

Solution

Navigate to and open /etc/vmware-rhttpproxy/config.xml.

Locate the <config>/<vmacore>/<tcpKeepAlive>/<clientSocket> block and configure <idleTimeSec> as follows:

<idleTimeSec>900</idleTimeSec>

Restart the service for changes to take effect.

# vmon-cli --restart rhttpproxy

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_Y23M07_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-10, CAT|II, CCI|CCI-000054, Rule-ID|SV-240716r879511_rule, STIG-ID|VCRP-67-000001, Vuln-ID|V-240716

Plugin: Unix

Control ID: 708e688495a34b0921fef7428240693573e6c3a1f079c24c32ab4be21306b02f