Process management and security ca-base

Assigns a default directory to fetch SSL CA certificates and CRLs from when a relative path is used with "ca-file" or "crl-file" directives. Absolute locations specified in "ca-file" and "crl-file" prevail and ignore "ca-base". chroot Changes current directory to and performs a chroot() there before dropping privileges. This increases the security level in case an unknown vulnerability would be exploited, since it would make it very hard for the attacker to exploit the system. This only works when the process is started with superuser privileges. It is important to ensure that is both empty and unwritable to anyone. cpu-map <"all"|"odd"|"even"|process_num> ... On Linux 2.6 and above, it is possible to bind a process to a specific CPU set. This means that the process will never run on other CPUs. The "cpu-map" directive specifies CPU sets for process sets. The first argument is the process number to bind. This process must have a number between 1 and 32 or 64, depending on the machine's word size, and any process IDs above nbproc are ignored. It is possible to specify all processes at once using "all", only odd numbers using "odd" or even numbers using "even", just like with the "bind-process" directive. The second and forthcoming arguments are CPU sets. Each CPU set is either a unique number between 0 and 31 or 63 or a range with two such numbers delimited by a dash ('-'). Multiple CPU numbers or ranges may be specified, and the processes will be allowed to bind to all of them. Obviously, multiple "cpu-map" directives may be specified. Each "cpu-map" directive will replace the previous ones when they overlap. crt-base Assigns a default directory to fetch SSL certificates from when a relative path is used with "crtfile" directives. Absolute locations specified after "crtfile" prevail and ignore "crt-base". daemon Makes the process fork into background. This is the recommended mode of operation. It is equivalent to the command line "-D" argument. It can be disabled by the command line "-db" argument. deviceatlas-json-file Sets the path of the DeviceAtlas JSON data file to be loaded by the API. The path must be a valid JSON data file and accessible by Haproxy process. deviceatlas-log-level Sets the level of informations returned by the API. This directive is optional and set to 0 by default if not set. deviceatlas-separator Sets the character separator for the API properties results. This directive is optional and set to | by default if not set. deviceatlas-properties-cookie Sets the client cookie's name used for the detection if the DeviceAtlas Client-side component was used during the request. This directive is optional and set to DAPROPS by default if not set. external-check Allows the use of an external agent to perform health checks. This is disabled by default as a security precaution. See "option external-check". gid Changes the process' group ID to . It is recommended that the group ID is dedicated to HAProxy or to a small set of similar daemons. HAProxy must be started with a user belonging to this group, or with superuser privileges. Note that if haproxy is started from a user having supplementary groups, it will only be able to drop these groups if started with superuser privileges. See also "group" and "uid". group Similar to "gid" but uses the GID of group name from /etc/group. See also "gid" and "user". log
[len ] [format ] [max level [min level]] Adds a global syslog server. Up to two global servers can be defined. They will receive logs for startups and exits, as well as all logs from proxies configured with "log global".

can be one of:

  - An IPv4 address optionally followed by a colon and a UDP port. If
    no port is specified, 514 is used by default (the standard syslog
    port).

  - An IPv6 address followed by a colon and optionally a UDP port. If
    no port is specified, 514 is used by default (the standard syslog
    port).

  - A filesystem path to a UNIX domain socket, keeping in mind
    considerations for chroot (be sure the path is accessible inside
    the chroot) and uid/gid (be sure the path is appropriately
    writeable).

  You may want to reference some environment variables in the address
  parameter, see section 2.3 about environment variables.

is an optional maximum line length. Log lines larger than this value will be truncated before being sent. The reason is that syslog servers act differently on log line length. All servers support the default value of 1024, but some servers simply drop larger lines while others do log them. If a server supports long lines, it may make sense to set this value here in order to avoid truncating long lines. Similarly, if a server drops long lines, it is preferable to truncate them before sending them. Accepted values are 80 to 65535 inclusive. The default value of 1024 is generally fine for all standard usages. Some specific cases of long captures or JSON-formated logs may require larger values.

is the log format used when generating syslog messages. It may be one of the following :

rfc3164 The RFC3164 syslog message format. This is the default. (https://tools.ietf.org/html/rfc3164)

rfc5424 The RFC5424 syslog message format. (https://tools.ietf.org/html/rfc5424)

must be one of the 24 standard syslog facilities :

    kern   user   mail   daemon auth   syslog lpr    news
    uucp   cron   auth2  ftp    ntp    audit  alert  cron2
    local0 local1 local2 local3 local4 local5 local6 local7

An optional level can be specified to filter outgoing messages. By default, all messages are sent. If a maximum level is specified, only messages with a severity at least as important as this level will be sent. An optional minimum level can be specified. If it is set, logs emitted with a more severe level than this one will be capped to this level. This is used to avoid sending "emerg" messages on all terminals on some default syslog configurations. Eight levels are known :

    emerg  alert  crit   err    warning notice info  debug

log-send-hostname [] Sets the hostname field in the syslog header. If optional "string" parameter is set the header is set to the string contents, otherwise uses the hostname of the system. Generally used if one is not relaying logs through an intermediate syslog server or for simply customizing the hostname printed in the logs. log-tag Sets the tag field in the syslog header to this string. It defaults to the program name as launched from the command line, which usually is "haproxy". Sometimes it can be useful to differentiate between multiple processes running on the same host. See also the per-proxy "log-tag" directive. lua-load This global directive loads and executes a Lua file. This directive can be used multiple times. nbproc Creates processes when going daemon. This requires the "daemon" mode. By default, only one process is created, which is the recommended mode of operation. For systems limited to small sets of file descriptors per process, it may be needed to fork multiple daemons. USING MULTIPLE PROCESSES IS HARDER TO DEBUG AND IS REALLY DISCOURAGED. See also "daemon". pidfile Writes pids of all daemons into file . This option is equivalent to the "-p" command line argument. The file must be accessible to the user starting the process. See also "daemon". presetenv Sets environment variable to value . If the variable exists, it is NOT overwritten. The changes immediately take effect so that the next line in the configuration file sees the new value. See also "setenv", "resetenv", and "unsetenv". resetenv [ ...] Removes all environment variables except the ones specified in argument. It allows to use a clean controlled environment before setting new values with setenv or unsetenv. Please note that some internal functions may make use of some environment variables, such as time manipulation functions, but also OpenSSL or even external checks. This must be used with extreme care and only after complete validation. The changes immediately take effect so that the next line in the configuration file sees the new environment. See also "setenv", "presetenv", and "unsetenv". stats bind-process [ all | odd | even | [-] ] ... Limits the stats socket to a certain set of processes numbers. By default the stats socket is bound to all processes, causing a warning to be emitted when nbproc is greater than 1 because there is no way to select the target process when connecting. However, by using this setting, it becomes possible to pin the stats socket to a specific set of processes, typically the first one. The warning will automatically be disabled when this setting is used, whatever the number of processes used. The maximum process ID depends on the machine's word size (32 or 64). A better option consists in using the "process" setting of the "stats socket" line to force the process on each line. server-state-base Specifies the directory prefix to be prepended in front of all servers state file names which do not start with a '/'. See also "server-state-file", "load-server-state-from-file" and "server-state-file-name". server-state-file Specifies the path to the file containing state of servers. If the path starts with a slash ('/'), it is considered absolute, otherwise it is considered relative to the directory specified using "server-state-base" (if set) or to the current directory. Before reloading HAProxy, it is possible to save the servers' current state using the stats command "show servers state". The output of this command must be written in the file pointed by . When starting up, before handling traffic, HAProxy will read, load and apply state for each server found in the file and available in its current running configuration. See also "server-state-base" and "show servers state", "load-server-state-from-file" and "server-state-file-name" setenv Sets environment variable to value . If the variable exists, it is overwritten. The changes immediately take effect so that the next line in the configuration file sees the new value. See also "presetenv", "resetenv", and "unsetenv". ssl-default-bind-ciphers This setting is only available when support for OpenSSL was built in. It sets the default string describing the list of cipher algorithms ("cipher suite") that are negotiated during the SSL/TLS handshake for all "bind" lines which do not explicitly define theirs. The format of the string is defined in "man 1 ciphers" from OpenSSL man pages, and can be for instance a string such as "AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH" (without quotes). Please check the "bind" keyword for more information. ssl-default-bind-options [

All parameters supported by "bind" lines are supported, for instance to restrict access to some users or their access rights. Please consult section 5.1 for more information. stats timeout The default timeout on the stats socket is set to 10 seconds. It is possible to change this value with "stats timeout". The value must be passed in milliseconds, or be suffixed by a time unit among { us, ms, s, m, h, d }. stats maxconn By default, the stats socket is limited to 10 concurrent connections. It is possible to change this value with "stats maxconn". uid Changes the process' user ID to . It is recommended that the user ID is dedicated to HAProxy or to a small set of similar daemons. HAProxy must be started with superuser privileges in order to be able to switch to another one. See also "gid" and "user". ulimit-n Sets the maximum number of per-process file-descriptors to . By default, it is automatically computed, so it is recommended not to use this option. unix-bind [ prefix ] [ mode ] [ user ] [ uid ] [ group ] [ gid ] Fixes common settings to UNIX listening sockets declared in "bind" statements. This is mainly used to simplify declaration of those UNIX sockets and reduce the risk of errors, since those settings are most commonly required but are also process-specific. The setting can be used to force all socket path to be relative to that directory. This might be needed to access another component's chroot. Note that those paths are resolved before haproxy chroots itself, so they are absolute. The , , , and all have the same meaning as their homonyms used by the "bind" statement. If both are specified, the "bind" statement has priority, meaning that the "unix-bind" settings may be seen as process-wide default settings. unsetenv [ ...] Removes environment variables specified in arguments. This can be useful to hide some sensitive information that are occasionally inherited from the user's environment during some operations. Variables which did not exist are silently ignored so that after the operation, it is certain that none of these variables remain. The changes immediately take effect so that the next line in the configuration file will not see these variables. See also "setenv", "presetenv", and "resetenv". user Similar to "uid" but uses the UID of user name from /etc/passwd. See also "uid" and "group". node Only letters, digits, hyphen and underscore are allowed, like in DNS names.

This statement is useful in HA configurations where two or more processes or servers share the same IP address. By setting a different node-name on all nodes, it becomes easy to immediately spot what server is handling the traffic. description Add a text that describes the instance.

Please note that it is required to escape certain characters (# for example) and this text is inserted into a html page so you should avoid using "<" and ">" characters. 51degrees-data-file The path of the 51Degrees data file to provide device detection services. The file should be unzipped and accessible by HAProxy with relevavnt permissions.

Please note that this option is only available when haproxy has been compiled with USE_51DEGREES. 51degrees-property-name-list [ ...] A list of 51Degrees property names to be load from the dataset. A full list of names is available on the 51Degrees website: https://51degrees.com/resources/property-dictionary

Please note that this option is only available when haproxy has been compiled with USE_51DEGREES. 51degrees-property-separator A char that will be appended to every property value in a response header containing 51Degrees results. If not set that will be set as ','.

Please note that this option is only available when haproxy has been compiled with USE_51DEGREES. 51degrees-cache-size Sets the size of the 51Degrees converter cache to entries. This is an LRU cache which reminds previous device detections and their results. By default, this cache is disabled.

Please note that this option is only available when haproxy has been compiled with USE_51DEGREES. wurfl-data-file The path of the WURFL data file to provide device detection services. The file should be accessible by HAProxy with relevant permissions.

Please note that this option is only available when haproxy has been compiled with USE_WURFL=1. wurfl-information-list []* A space-delimited list of WURFL capabilities, virtual capabilities, property names we plan to use in injected headers. A full list of capability and virtual capability names is available on the Scientiamobile website :

https://www.scientiamobile.com/wurflCapability

Valid WURFL properties are:

  • wurfl_id Contains the device ID of the matched device.

  • wurfl_root_id Contains the device root ID of the matched

                            device.
    
  • wurfl_isdevroot Tells if the matched device is a root device.

                            Possible values are "TRUE" or "FALSE".
    
  • wurfl_useragent The original useragent coming with this

                            particular web request.
    
  • wurfl_api_version Contains a string representing the currently

                            used Libwurfl API version.
    
  • wurfl_engine_target Contains a string representing the currently

                            set WURFL Engine Target. Possible values are
                            "HIGH_ACCURACY", "HIGH_PERFORMANCE", "INVALID".
    
  • wurfl_info A string containing information on the parsed

                            wurfl.xml and its full path.
    
  • wurfl_last_load_time Contains the UNIX timestamp of the last time

                            WURFL has been loaded successfully.
    
  • wurfl_normalized_useragent The normalized useragent.

  • wurfl_useragent_priority The user agent priority used by WURFL.

Please note that this option is only available when haproxy has been compiled with USE_WURFL=1. wurfl-information-list-separator A char that will be used to separate values in a response header containing WURFL results. If not set that a comma (',') will be used by default.

Please note that this option is only available when haproxy has been compiled with USE_WURFL=1. wurfl-patch-file [] A list of WURFL patch file paths. Note that patches are loaded during startup thus before the chroot.

Please note that this option is only available when haproxy has been compiled with USE_WURFL=1. wurfl-engine-mode { accuracy | performance } Sets the WURFL engine target. You can choose between 'accuracy' or 'performance' targets. In performance mode, desktop web browser detection is done programmatically without referencing the WURFL data. As a result, most desktop web browsers are returned as generic_web_browser WURFL ID for performance. If either performance or accuracy are not defined, performance mode is enabled by default.

Please note that this option is only available when haproxy has been compiled with USE_WURFL=1. wurfl-cache-size [,] Sets the WURFL caching strategy. Here is the Useragent cache size, and

is the internal device cache size. There are three possibilities here :

  • "0" : no cache is used.
  • : the Single LRU cache is used, the size is expressed in elements.
  • , : the Double LRU cache is used, both sizes are in elements. This is
          the highest performing option.
    

Please note that this option is only available when haproxy has been compiled with USE_WURFL=1. wurfl-useragent-priority { plain | sideloaded_browser } Tells WURFL if it should prioritize use of the plain user agent ('plain') over the default sideloaded browser user agent ('sideloaded_browser').

Please note that this option is only available when haproxy has been compiled with USE_WURFL=1.

results matching ""

    No results matching ""