Fortify 360 Server Installation and Configuration Guide...The Fortify 360 documentation set contains installation, user, and deployment guides for various 360 components, including

Fortify® 360 Server Installation and Configuration Guide

Fortify 360, Version 2.6 May 2010

Copyright© 2010 Fortify® Software, Inc.June 14, 2010 12:21 pmAll Rights Reserved. Printed in the United States of America.

Fortify Software, Inc.2215 Bridgepointe PkwySuite 400San Mateo, CA 94404

Fortify Software, Inc. (“Fortify”) and its licensors retain all ownership rights to this document (the “Document”). Use of the Document is governed by applicable copyright law. Fortify may revise this Document from time to time without notice.

THIS DOCUMENT IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL FORTIFY BE LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY ERROR IN THIS DOCUMENT, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS, PROFITS, USE OR DATA. FORTIFY RESERVES THE RIGHT TO MODIFY OR REMOVE ANY OF THE FEATURES OR COMPONENTS DESCRIBED IN THIS DOCUMENT FROM THE FINAL PRODUCT, WITHOUT NOTICE.

Fortify is a registered trademark of Fortify Software, Inc.Brand and product names in this Document are trademarks of their respective owners.Part number: 1‐151‐2010‐05‐26‐1

Fortify 360 Server Installation & Configuration Guide iii

Contents

Contacting Fortify Software. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii

Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viiiCorporate Headquarters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viiiWeb Site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii

About the Fortify 360 Documentation Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii

Overview of Fortify 360 Server Installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

How to Use this Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

The Central Role of Fortify 360 Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Overview of the Fortify 360 Server Installation Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

Preparing to Install Fortify 360 Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

Preparing the Application Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3Preparing the Fortify 360 Server Database. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4Preparing the Optional LDAP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4Preparing the Optional Bugzilla System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4Preparing the Optional E‐mail Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4Preparing Fortify Analysis Agents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

Securely Deploying Fortify 360 Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Overview of Secure Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Securing Access to Facilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Securing the Application Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Use HTTPS and SSL Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Securing Passwords and User Roles. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Managing Computer Services and Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Installing Fortify 360 Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Overview of Fortify 360 Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Overview of Fortify 360 Server Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Migrating from Version 2.6.0 to 2.6.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Downloading and Unpacking Installation Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Selecting the Correct JDK Version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Overview of Selecting a JDK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8Using 360configuration.jar to Select a JDK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Configuring Rulepack Update URL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Configuring Tomcat 6 Server Memory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Overview of Configuring Tomcat 6 Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10Configuring Tomcat 6 Memory in Windows Computers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10Configuring Tomcat 6 Memory in Unix‐based Computers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Fortify 360 Server Installation & Configuration Guide iv

Configuring Application Server pragma no‐cache. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Overview of pragma no‐cache Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12Configuring pragma no‐cache in Apache Tomcat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12Configuring pragma no‐cache in Other Application Servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Enabling Fortify RTA Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

After Completing Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Configuring a New Fortify 360 Server Database. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

How to Use This Chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

If You Are Upgrading from an Earlier Version of Fortify 360 Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Overview of Creating a Fortify 360 Server Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Before Creating a Fortify 360 Server Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Database Instance and Privileges Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Database‐specific Configuration Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Fortify 360 Server Database Character Set Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15Obtaining the Correct Database Driver Class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16Configuring IBM DB2 Databases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17Configuring Microsoft SQL Server Databases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17Configuring MySQL Databases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18Configuring Oracle Databases. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Running Fortify 360 Server Database Creation Scripts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Overview of Fortify 360 Server Database Creation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18If You are Upgrading from an Earlier Version of Fortify 360 Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18Running the Create Tables Script . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19Permanently Deleting an Existing Fortify 360 Server Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Configuring Fortify 360 Server Database Connectivity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Seeding the Fortify 360 Server Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Overview of Database Seeding as Part Of Installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21Overview of Post‐installation Seeding. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21After Seeding a Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21Using 360configuration.jar to Seed a New Fortify 360 Server Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22Using the 360configuration.jar Command Line to Upload Post‐installation Resource Bundles . . . . . . 23

Upgrading an Existing Fortify 360 Server Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

How to Use This Chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

If You Are Installing Fortify 360 Server For the First Time. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Overview of Upgrading a Fortify 360 Server Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Before Upgrading Your Fortify 360 Server Database. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Before Beginning Database Migration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25If You Are Migrating Custom Process Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25Reviewing Database Configuration and Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25Specifying MySQL Server Upgrade Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Fortify 360 Server Installation & Configuration Guide v

Running Fortify 360 Server Database Upgrade Scripts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Before Running a Database Upgrade Script . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26Choosing a Database Upgrade Script . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26Locating and Running the Database Migration Script . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Configuring Connectivity to the Upgraded Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Re‐seeding an Upgraded Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Troubleshooting Database Migration Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Logging In and Administering User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Starting and Logging In to Fortify 360 Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Starting Fortify 360 Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28Logging In to Fortify 360 Server for the First Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Overview of Fortify 360 Server User Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Understanding Administrator Accounts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29Understanding Security Lead, Manager, and Developer Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Creating and Configuring User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Configuring Fortify 360 Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Starting the Fortify 360 Server Configuration Utility. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Overview of Configuration Utility Panels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Configuring Bugzilla Integration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Configuring User Account Timeout and Lockout Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Configuring a Proxy for Rulepack Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Configuring E‐mail Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Configuring Single Sign‐on. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Configuring LDAP User Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Overview of Fortify 360 Server User Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Fortify 360 Server Simplifies LDAP Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36Overview of Database‐only Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36Overview of Fortify 360 Server LDAP Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Preparing to Configure LDAP Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Download the JXplorer LDAP Browser . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37Create an LDAP Account for use by Fortify 360 Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37Avoid Conflicts Between Account Names. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37Gather and Record Required Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Using 360Configuration.jar to Specify LDAP Server Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Accessing the 360Configuration.jar LDAP Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38Overview of 360Configuration.jar LDAP Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Registering LDAP Entities with Fortify 360 Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Managing LDAP User Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

How RDNs are Constructed. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Fortify 360 Server Installation & Configuration Guide vi

How Fortify 360 Server Determines a User’s Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42Mapping Fortify 360 Server Roles to LDAP Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Migrating Fortify Manager 5.2 Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Overview of Two‐pass Projects Migration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Preparing for Migration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Install Fortify 360 Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44Upgrade to Fortify Manager 5.2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44Begin with version 3.5 or Later FPRs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44Copy Project Templates to Fortify 360 Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44Categorize Fortify 360 Server Project Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44Inventory Project Elements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45Acquire a Fortify 360 Server Administrator Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45Modifying Default Server Port Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

Unpacking and Copying the Migration Utility. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

Migration Utility Command‐line Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Running the Migration Utility in GUI Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Overview of GUI Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47Migrating Fortify Manager Project Elements (GUI Mode) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47Migrating Fortify Manager Projects (GUI Mode) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

Running the Migration Utility in Console Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Overview of Console Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49Creating Lists of Fortify Manager Entity IDs and Names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49Migrating Fortify Manager Project Elements (Console Mode). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50Migrating Fortify Manager Projects (Console Mode). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Configuring Migrated SSA Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Resetting Migrated Projects Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Migrating Fortify 360 Server 1.x Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

Overview of Two‐pass Applications Migration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

Preparing for Migration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

Install Fortify 360 Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53Categorize Fortify 360 Server Project Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54List Numeric Application IDs (Console Mode Only). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54Acquire a Fortify 360 Server Administrator‐level Account. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54Modify Default Server Port Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

Unpacking and Copying the Migration Utility. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Migration Utility Command‐line Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Running the Migration Utility in GUI Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

Overview of GUI Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56Migrating Fortify Server 1.x Users (GUI Mode) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56Migrating Fortify Server 1.x Applications (GUI Mode) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

Running the Migration Utility in Console Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Fortify 360 Server Installation & Configuration Guide vii

Overview of Console Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58Creating Lists of Fortify 360 Server 1.x Entity IDs and Names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58Migrating Fortify 360 Server 1.x Users (Console Mode) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59Migrating Fortify 360 Server 1.x Applications (Console Mode). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

Configuring Migrated SSA Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

Resetting Migrated Applications Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

Using the fortifyclient Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

Overview of the fortifyclient Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

Understanding fortifyclient Access Tokens . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

Running the fortifyclient Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

Specifying a Properly Formed Fortify 360 Server URL. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63Listing fortifyclient Options and Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63Using fortifyclient to Acquire an Upload Access Token . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63Listing fortifyclient Access Tokens . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64Using fortifyclient to List Project Versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64Using fortifyclient to Upload an FPR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65Using fortifyclient to Download an FPR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65Using fortifyclient to Import a Content Bundle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

Archiving and Restoring Runtime Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

Overview of Archiving and Restoring Runtime Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67Listing Runtime Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67Archiving Runtime Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67Listing Runtime Archives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68Restoring Runtime Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

Running Fortify 360 Server in WebSphere 7.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

Overview of Running Fortify 360 Server in WebSphere 7.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

Downloading a Fortify X.509 DER Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

Overview of Downloading a DER Certificate. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69Using Firefox 3 to Download a X.509 DER Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69Using Internet Explorer 8 to Export a X.509 DER Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

Downloading SUN‐standard xercesImpl.jar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

Overview of Downloading Xerces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70Downloading SUN‐standard xercesImpl.jar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

Configuring f360.war to Run Under WebSphere 7.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

Adding theX.509 Certificate to WebSphere 7.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

Fortify 360 Server Installation & Configuration Guide viii

PrefaceThis guide describes how to install and configure Fortify® 360 Server and the external components required by a Fortify 360 Server installation.

Contacting Fortify SoftwareIf you have questions or comments about any part of this guide, contact Fortify Software at:

Technical Support650.358.5679

[email protected]

Corporate Headquarters2215 Bridgepointe Pkwy.

Suite 400

San Mateo, CA 94404

650.358.5600

[email protected]

Web Sitehttp://www.fortify.com

About the Fortify 360 Documentation SetThe Fortify 360 documentation set contains installation, user, and deployment guides for various 360 components, including Fortify 360 Server, as well as other documentation pertaining to the use of Fortify 360.

Updated versions of the documentation and release notes that describe new features and known issues are also available on the Fortify Customer Portal.

Fortify 360 Server Installation & Configuration Guide 1

Overview of Fortify 360 Server InstallationThis document contains information and procedures that enable you to completely configure and deploy Fortify 360 Server.

How to Use this GuideThis guide enables you to install then configure Fortify 360 Server for turn‐over to users.

“The Central Role of Fortify 360 Server” on page 1 provides an overview of how Fortify 360 Server interoperates with a variety of required and optional external components.

“Preparing to Install Fortify 360 Server” on page 3 provides an overview of the types of information required to configure required and optional external components to interoperate with Fortify 360 Server.

This guide’s remaining chapters contain the concepts and tasks you will use to install and configure either versions of Fortify 360 Server and the external components that are part of that Fortify 360 Server installation.

This document italicizes the first use of terms that have special meaning in Fortify 360 Server. Refer to this document’s Glossary for definitions of those terms.

The Central Role of Fortify 360 ServerFortify 360 Server provides centralized management of Fortify 360 Server Projects across the complete Secure Development Lifecycle (SDL).

To provide that centralized management, Fortify 360 Server interoperates with the following external components:

• A required third‐party application server

• A required third‐party database

• An optional third‐party LDAP authentication server

• An optional Bugzilla bug‐tracking system

• An optional SMTP e‐mail server

• One or more optional Fortify analysis agents and tools

• The Fortify rulepack server


Overview of the Fortify 360 Server Installation Environment

Figure 1 illustrates the relationship of Fortify 360 installation to the required and optional components listed above.

Figure 1: Relationship of Fortify 360 Server to required and optional components.

Table 1 lists the components contained in Figure 1 and describes the supplementary components.

Table 1: Roles of required and optional Fortify 360 Server installation entities

ID Description

S1 Fortify 360 Server.Fortify delivers Fortify 360 Server as a Web ARchive (WAR) file run by a Web application server (A1).

D1 Required third‐party Fortify 360 Server database.Stores user and artifact data.Before putting the Fortify 360 Server into production, you must install a supported third‐party database.

A1 Application server.Fortify 360 Server (S1) is delivered as a Web ARchive (WAR) file, and is run by a Web application server.

C1

360 Server Database

D1

LDAP Server

A2

F2

Bugzilla Server

A3

E-mail Server

A4

C2

F1

Wide-area Network / Internet

Fortify 360 Server 2.0S1 – Fortify 360 Server, PRODUCTION Version

Required third-party server and database supportA1 – Application Server, required to run 360 Server 2.5D1 – Third-party 360 Server database, required by 360 Server 2.5

Optional third-party componentsA2 – LDAP authentication serverA3 – Bugzilla bug-tracking serverA4 – SMTP E-mail server

C3

Fort

Fortify 360 Analysis ClientsC1 – Fortify 360 Source Code Analyzer (SCA)C2 – Fortify 360 Program Trace Analyzer (PTA)C3 – Fortify 360 Real-time Analyzer (RTA)

Fortify download and Rulepack Update serversF1 – Fortify installation program download serverF2 – Fortify Rulepack Update server

360 Server Version 2.5Overview of installation Components

Application Server

S1A1

C4 Fortify 360 ToolsC4 – Fortify 360 Audit Workbench (AWB)


Preparing to Install Fortify 360 ServerInstallation of Fortify 360 Server requires not only configuring Fortify 360 Server to interoperate with the external components shown in Figure 1, but also configuring the external components to interoperate with Fortify 360 Server.

The sections that follow introduce the configuration requirements of the external installation components.

Preparing the Application ServerBefore you can successfully install, configure, and run Fortify 360 Server you must first have, and be capable of administering, a supported third‐party application server.

Secure deployment considerations are particularly important with regard to application server configuration, operation, and communications. For more information about secure deployment considerations for the third‐party application server running Fortify 360 Server, see “Securing the Application Server” on page 5.

This includes configuring application server memory to support Fortify 360 Server. See “Configuring Tomcat 6 Server Memory” on page 10 for information about configuring application server memory.

A2 Optional third‐party LDAP authentication server.Fortify 360 Server can be configured to use optional LDAP authentication.

A3 Optional Bugzilla bug‐tracking server.Fortify 360 Server can be configured to enable bugs to be submitted to a Bugzilla bug‐tracking system directly from Collaboration Module.

A4 Optional third‐party e‐mail server.Fortify 360 Server can be configured to use an external SMTP e‐mail server to send alerts to Project collaborators.

C1 Optional Fortify Source Code Analyzer (SCA) analysis agent.Fortify SCA scans source code and identifies issues.

C2 Optional Fortify Tracer (PTA) analysis agent.Fortify PTA performs pre‐deployment analysis of instrumented code running in a pre‐production environment.

C3 Optional Fortify Real‐Time Analyzer 2.5 (RTA) analysis agent.Fortify RTA performs analysis of instrumented code running in a production environment.

C4 Audit Workbench (AWB) source code auditing tool.Although technically optional, most Fortify 360 installations will use AWB to audit issues and categorize vulnerabilities.

F1 Fortify download server, used to acquire installation programs.

F2 Fortify Rulepack Update server, hosted by Fortify and used to acquire and update Fortify Secure Coding Rulepacks.

Table 1: Roles of required and optional Fortify 360 Server installation entities (Continued)

ID Description


Preparing the Fortify 360 Server DatabaseTo run Fortify 360 Server, you must install a supported third‐party database.

Before beginning installation of Fortify 360 Server:

• Review the list of supported third‐party databases in the Fortify 360 Server System Requirements datasheet.

• Review the information under “Securing Access to Facilities” on page 5.

• Familiarize yourself with the information contained in Configuring a New Fortify 360 Server Database.

Preparing the Optional LDAP ServerThe Fortify 360 Server supports optional LDAP authentication.

Before beginning installation of Fortify 360 Server:

• Review the list of supported LDAP servers in the Fortify 360 Server System Requirements datasheet.

• Review the information under “Securing Access to Facilities” on page 5.

• Familiarize yourself with the information contained in Configuring LDAP User Authentication, particularly “Preparing to Configure LDAP Authentication” on page 37.

Preparing the Optional Bugzilla SystemFortify 360 Server can be configured to enable bugs to be submitted directly from the Collaboration Module.

Configuration of Fortify 360 Server Bugzilla integration will require the following information:

• The URL of the Bugzilla server

• The user name and password of the Bugzilla account created for use by Fortify 360 Server

For more information about configuring Fortify 360 Server Bugzilla integration, see “Configuring Bugzilla Integration” on page 33.

Preparing the Optional E‐mail ServerFortify 360 Server can transmit e‐mail alerts to members of the secure development team.

Configuration of Fortify 360 Server e‐mail integration will require the following information:

• The name of the SMTP e‐mail server

• The SMTP server port (by default, port 25)

• The From e‐mail address of the ‐mail account created for use by Fortify 360 Server

• The user name and password of the Bugzilla account created for use by Fortify 360 Server

For more information about configuring Fortify 360 Server Bugzilla integration, see “Configuring Bugzilla Integration” on page 33.

Preparing Fortify Analysis AgentsFortify 360 Server provides a centralized management and analysis facility for data gathered and processed by Fortify analysis products and tools (SCA, PTA, RTA, and AWB).

Before beginning installation of Fortify 360 Server, familiarize yourself with the installation and configuration requirements for each Fortify client product that will be part of your overall Fortify 360 installation.


Securely Deploying Fortify 360 ServerThis chapter contains the following topics:

• Overview of Secure Deployment

• Securing Access to Facilities

• Securing the Application Server

• Use HTTPS and SSL Communications

• Securing Passwords and User Roles

• Managing Computer Services and Accounts

Overview of Secure DeploymentThe Fortify 360 family of products perform sophisticated analysis of an enterprise’s source code. That analysis results in concise summaries about the security vulnerabilities of that source code.

In the same way that security precautions should be applied to the analyzed source code, you should secure access to the Fortify 360 analysis products that access that source code. Moreover, the concentrated summarization of security vulnerabilities provided by the Fortify 360 family of products may mandate an even higher level of secure deployment.

This chapter summarizes some of the ways to securely deploy Fortify 360.

Securing Access to FacilitiesFortify 360 Server stores and renders source code of programs it has analyzed, and any issues discovered in those programs, as unencrypted HTML.

Because program source code and any detected vulnerabilities it contains offer various opportunities for mishandling or abuse, Fortify recommends that administrators deploy Fortify 360 Server in a secure operations facility.

You should also secure the underlying Fortify 360 Server file system and restrict access to the Fortify 360 Server installation directory.

Securing the Application ServerYou must ensure the operational security of the Web server running Fortify 360 Server. At a minimum, the application server should be configured to use HTTPS in conjunction with an SSL certificate issued by a trusted certificate authority.

Note that this is not a comprehensive list. You should also take any additional steps necessary to secure the Apache server in your operating environment.

Use HTTPS and SSL CommunicationsFortify strongly recommends that Fortify 360 Server and Fortify Client Products, be configured to use HTTPS and SSL for all communications.

When using SSL, Fortify does not support deploying 360 Server to a container that uses self‐signed certificates.


Securing Passwords and User RolesFortify 360 Server requires the administrator to change the admin account’s default password immediately after logging in to Fortify 360 Server for the first time.

The administrator should immediately then create a new Administrator account and delete the default admin account. For more information about logging into and deleting the default admin account, see “Logging In to Fortify 360 Server for the First Time” on page 28.

Fortify 360 Server account security features include:

• The ability for administrators to suspend accounts that have become temporarily inactive

• The automatic lock‐out of accounts on the basis of failed login attempts

For more information about Fortify 360 Server account management, see the Fortify 360 Server Use Guide.

If you are using LDAP to authenticate Fortify 360 Server users, configure your LDAP server to use secure LDAPS communications. For more information about configuring Fortify 360 Server to use LDAP authentication, see “Overview of Fortify 360 Server User Authentication” on page 36.

Managing Computer Services and AccountsWhen you install Fortify 360 Server, configure it as a service running under a least‐privileged user account.

Also, because Fortify 360 Server temporarily stores files that are uploaded from a user account to the computer’s file system, always install and run an updated anti‐virus software on the machine on which Fortify 360 Server is running.


Installing Fortify 360 ServerThis section contains the following topics:

• Overview of Fortify 360 Server

• Overview of Fortify 360 Server Installation

• Migrating from Version 2.6.0 to 2.6.1

• Downloading and Unpacking Installation Files

• Selecting the Correct JDK Version

• Configuring Rulepack Update URL

• Configuring Tomcat 6 Server Memory

• Configuring Application Server pragma no‐cache

• Enabling Fortify RTA Communications

• After Completing Installation

Overview of Fortify 360 ServerFortify 360 Server:

• Is packaged as a Web ARchive (WAR) file

• Runs under a separate third‐party application server

• Requires a supported third‐party database

• Includes a GUI configuration tool that you will use to configure Fortify 360 Server to interoperate with supplemental entities such as a required third‐party database and Fortify Real‐Time Analyzer 2.5, as well as optional email servers, Bugzilla bug‐tracking systems, and LDAP authentication servers

For Fortify 360 Server system requirements, see the Fortify 360 Server System Requirements datasheet.

Overview of Fortify 360 Server InstallationThis document provides the information you need to install Fortify 360 Server, or upgrade an earlier version of Fortify 360 Server to Fortify 360 Server.

Use the information in this chapter, along with your Fortify Customer Portal account, to download your Fortify license file, the installation package and associated resource bundles used to seed the third‐party database required to run Fortify 360 Server.

This chapter also describes how to perform initial configuration of the Java Runtime Environment (JRE) you will use to run Fortify 360 Server.

Finally, this chapter includes a new version 2.5 installation task, “Enabling Fortify RTA Communications” on page 12, that you will need to perform if you intend to use your Fortify 360 Server to provide Federation Controller services to one or more instances of Fortify RTA running in Federated mode. For information about Fortify RTA, see the Fortify RTA User’s Guide and the Fortify RTA 2.6 Installation and Configuration Guide.

Configuring a New Fortify 360 Server Database describes how to create, upgrade, and seed the Fortify 360 Server database.

Finally, Logging In and Administering User Accounts describes how to put the configured Fortify 360 Server WAR file in your application server’s application directory, start Fortify 360 Server, and connect and log in to Fortify 360 Server for the first time.


Migrating from Version 2.6.0 to 2.6.1If you are updating from version 2.6.0 to 2.6.1 complete to the following:

1. Stop the application server hosting the 360 Server WAR file as appropriate.

2. Use the 360Cconfiguration.jar command line utility to configure the new 2.6.1 360 Server WAR file and redeploy this WAR file to the application server.

You do not need to run the database migration scripts or reseed the database.

3. Restart the application server as necessary.

Downloading and Unpacking Installation FilesPerform the procedure in this section to acquire the Fortify 360 Server installation files and place the files in your application server’s applications directory.

In order to complete the procedure in this section, your Fortify representative must first provide you with access to the Fortify Customer Portal. Your Fortify Customer Portal account enables you to download the Fortify 360 Server installation resources.

To download and unpack the Fortify 360 Server installation files:

1. In https://customerportal.fortify.com, acquire and the following three installation resources from your Fortify Customer Portal account:

• Your Fortify license key file, fortify.license.

• The Fortify 360 Server installation package Fortify-360-2.6.0-Server-WAR.zip

• The Process Templates resource bundle ProcessTemplateSeedBundle.zip and the Reports resource bundle ReportSeedBundle.zip.

Do not unpack ProcessTemplateSeedBundle.zip or ReportSeeBundle.zip. You will use the unpacked resource bundles to seed the third‐party database required by Fortify 360 Server.

• If you will not have network access during installation, you can also use your Fortify Customer Portal to download Secure Coding Rulepacks, then use the Rulepack Update tool to update your Secure Coding Rulepacks.

2. In your application server’s root directory, unpack Fortify-360-2.5.0-Server-WAR.zip.

Unpacking Fortify-360-2.5.0-Server-WAR.zip creates the Fortify-360-Server-WAR directory structure. Fortify-360-Server-WAR contains all the resources and tools you need to configure Fortify 360 Server and migrate projects from Fortify Manager 5 and 360 Server 1.x.

3. Copy ProcessTemplateSeedBundle.zip and fortify.license into Fortify-360-Server-WAR.

Although you are not required to copy these resource files reside into Fortify-360-Server-WAR, the remaining procedures in this document assume that those resources have been saved in that location.

Selecting the Correct JDK VersionThis section contains the following topics:

• Overview of Selecting a JDK

• Using 360configuration.jar to Select a JDK

Overview of Selecting a JDKYou must configure Fortify 360 Server to use the Java Development Kit (JDK) that is compatible with the application server you will use to run Fortify 360 Server.

Table 2: lists the JDKs supported by Fortify 360 Server.


Using 360configuration.jar to Select a JDKPerform the procedure in this section to select the JDK used by Fortify 360 Server.

To use 360configuration.jar to select the JDK used by Fortify 360 Server:

1. Start the Fortify 360 Server configuration tool. In the application server sub‐directory where you unpacked Fortify-360-Server-WAR, double‐click 360Configuration.jar

Respond to the prompts for the location of your Fortify license key file fortify.license, and the Fortify 360 Server WAR file f360.war.

By default, 360Configuration.jar displays the Core panel.

2. In the Core panel, in the Application Server JDK Version list, choose the JDK you will use to run Fortify 360 Server.

Use the table in “Overview of Selecting a JDK” on page 8 to determine which JDK to select.

3. Click Save & Exit to save the JDK setting and exit 360Configuration.jar.

Configuring Rulepack Update URLBy default, the Rulepack Update URL specifies the location of the Fortify Rulepack update host as:

https://update.fortify.com

Do not modify the default value of Rulepack Update URL unless directed to by your Fortify customer support representative.

For information about configuring Fortify 360 Server to use a proxy server when updating Rulepacks, see “Configuring a Proxy for Rulepack Updates” on page 34.

Table 2: JDKs supported by Fortify 360 Server

Application Server Compatible JDK

Apache Tomcat 6 · Sun JDK 1.5· Sun JDK 1.6

Oracle Weblogic 11g (10.3) Sun JDK 1.6

IBM WebSphere 7 IBM JDK 1.6


Configuring Tomcat 6 Server MemoryThis section contains the following topics:

• Overview of Configuring Tomcat 6 Memory

• Configuring Tomcat 6 Memory in Windows Computers

• Configuring Tomcat 6 Memory in Unix‐based Computers

Overview of Configuring Tomcat 6 MemoryBefore running Fortify 360 Server under Apache Tomcat 6, you must use the system variable CATALINA_OPTS to specify Tomcat server memory settings.

Specifying Tomcat 6 memory settings enables Fortify 360 Server to utilize several frameworks that perform dynamic subclassing of a given application’s core classes. That dynamic subclassing requires an increased number of class definitions in the java runtime's permanent memory heap.

Configuring Tomcat 6 memory does not impair server runtime performance or the behavior of the runtime environment.

Configuring Tomcat 6 Memory in Windows ComputersThis section contains the following topics:

• Configuring Tomcat Memory from the Windows Command Line

• Configuring Tomcat Memory in a Windows Computer

Configuring Tomcat Memory from the Windows Command Line

If you are running Fortify 360 Server in a Windows computer, and starting the Tomcat 6 server from the Windows command line, before starting the Tomcat server use the following command line specify the Tomcat 6 memory settings (without line break):

CATALINA_OPTS=-Xms256M -Xmx768M -XX:MaxPermSize=256M -Djava.awt.headless=true

Configuring Tomcat Memory in a Windows Computer

If you are running Fortify 360 Server in a Windows computer, and you are running Tomcat 6 as a Windows service, you can use the Apache Tomcat Properties dialog box to specify the Fortify 360 Server memory settings. Windows will then apply the memory settings whenever it starts the Tomcat 6 service (for example after a power‐failure reboot).

The procedure in this section assumes that:

• You are qualified to configure a Tomcat 6 application server running in a Windows computer, including the use of Windows Computer Management tools.

• You have configured your Tomcat_6 server to run as a Windows service.

For information about configuring Tomcat 6, see the Tomcat documentation.

To use the Windows Services tool to configure Tomcat 6 memory settings:

1. Log in to Windows with an Administrator‐level account.

You must login to Windows as an administrator to access and modify the Tomcat 6 configuration.

2. In Windows, display the Apache Tomcat Properties dialog box. Perform one of the following:

• If you ran a Windows installation program to install Tomcat_6, in Start locate then choose Configure Tomcat.

• If you ran a Windows installation program to install Tomcat_6, in the Windows system tray double‐click the Apache Tomcat icon.


• If you did not run a Windows installation program to install Tomcat_6, in the Windows Computer Management tool, right‐click the entry for the Tomcat_6 service then choose Properties.

Windows displays the Apache Tomcat Properties dialog box.

3. Configure the Tomcat 6 service’s memory settings.

a. In the Apache Tomcat Properties dialog box, select the Java tab.

Windows displays the Java configuration options dialog box for the Tomcat 6 server.

b. In the Java Options text entry area, paste the following four lines (including line breaks):

-Xms256M -Xmx768M -XX:MaxPermSize=256M -Djava.awt.headless=true

c. Click OK to save the changes.

d. Restart the Tomcat 6 service to apply the new memory settings.

Configuring Tomcat 6 Memory in Unix‐based ComputersBefore starting Tomcat, specify the CATALINA_OPTS environment variable as follows:

CATALINA_OPTS=-Xms256M -Xmx768M -XX:MaxPermSize=256M -Djava.awt.headless=true

The exact format of the this specification will vary depending on the shell used to specify the settings.


Configuring Application Server pragma no‐cacheThis section contains the following topics:

• Overview of pragma no‐cache Settings

• Configuring pragma no‐cache in Apache Tomcat

• Configuring pragma no‐cache in Other Application Servers

Overview of pragma no‐cache SettingsMicrosoft Internet Explorer does not always handle the pragma no‐cache response header properly. If all of the following three conditions apply to your installation of Fortify 360 Server, then you must configure your application server’s use of the pragma no-cache parameter:

• You support users who use Microsoft Internet Explorer to access Fortify 360 Server

• You have configured your application server to use SSL to communicate with Fortify 360 Server

• Your application server adds the pragma no-cache metatag to the header of an HTML page

If all three of these conditions are true in your installation of Fortify 360 Server, then you must configure your application server so that it does not transmit the pragma no-cache metatag.

Configuring pragma no‐cache in Apache TomcatIf you are using Apache Tomcat 6 to run Fortify 360 Server, use the information in the following Web page to configure your server’s pragma no-cache settings:

http://www.mail‐archive.com/tomcat‐[email protected]/msg151294.html

Configuring pragma no‐cache in Other Application ServersDepending on the type of supported application server you are using to Fortify 360 Server, the location of the configuration file that contains the pragma no-cache setting varies.

For information about the location of the pragma no-cache setting in your applications server, see your server’s documentation.

Enabling Fortify RTA CommunicationsPerform the procedure in this section to enable Fortify 360 Server to communicate with Fortify Real‐Time Analyzer 2.5 (Fortify RTA).

Fortify 360 Server includes a new Runtime tab. The Runtime tab enables to provide Federation Controller features used to configure, monitor, and manage instances of Fortify Real‐Time Analyzer 2.5 running in Federated mode.

By default, Fortify Real‐Time Analyzer 2.5 does not enable communications with Fortify RTA, or enable the Runtime tab.

To use 360configuration.jar to enable communications with Fortify RTA:

1. Start the Fortify 360 Server configuration tool. In the application server sub‐directory where you unpacked Fortify-360-Server-WAR, double‐click 360Configuration.jar

Respond to the prompts for the location of your Fortify license key file fortify.license, and the Fortify 360 Server WAR file f360.war.


2. Enable Fortify RTA communications.

a. In 360Configuration.jar, select the Runtime tab.

http://www.mail-archive.com/[email protected]/msg151294.html


b. In the Runtime tab, select Enable RTA.

Do not change any other Runtime settings unless directed to by Fortify Support.

3. Click Save & Exit to save the JDK setting and exit 360Configuration.jar.

After Completing InstallationAfter installing Fortify 360 Server, continue to Configuring a New Fortify 360 Server Database.


Configuring a New Fortify 360 Server DatabaseThis section contains the following topics:

• How to Use This Chapter

• Overview of Creating a Fortify 360 Server Database

• Before Creating a Fortify 360 Server Database

• Database‐specific Configuration Requirements

• Running Fortify 360 Server Database Creation Scripts

• Configuring Fortify 360 Server Database Connectivity

• Seeding the Fortify 360 Server Database

How to Use This ChapterIf you are configuring and deploying a new instance of Fortify 360 Server, you must install, initialize, and configure a supported third‐party database.

This chapter contains information and procedures that describe how to create a database for use with Fortify 360 Server.

If You Are Upgrading from an Earlier Version of Fortify 360 ServerIf you are upgrading from an earlier version of Fortify 360 Server to Fortify 360 Server, do not create or seed a new database.

Instead, use the information and procedures in Upgrading an Existing Fortify 360 Server Database to upgrade your Fortify 360 Server version 2.0 or 2.1 database for use with Fortify 360 Server.

Overview of Creating a Fortify 360 Server DatabaseFor a new Fortify 360 Server installation, the installation package includes scripts you must use to create and initialize a third‐party Fortify 360 Server database.

After creating and initializing the Fortify 360 Server database, you must then use the 360configuration.jar configuration utility to configure connectivity to the upgraded database, and to seed the upgraded database.

Before Creating a Fortify 360 Server DatabaseThe procedures in this chapter assume that:

• You are qualified to perform database administration tasks.

• You have used the information in Installing Fortify 360 Server to install and configure Fortify 360 Server.


Database Instance and Privileges RequirementsIf you are creating a new Fortify 360 Server database (or upgrading an existing Fortify 360 Server 2.0 or 2.1 database), you must have sufficient privileges to:

1. Create a new Fortify 360 Server database in a dedicated instance, or backup then update your existing Fortify 360 Server dedicated database instance.

2. Bind a Fortify 360 Server user account to the dedicated database instance.

3. Assign the Fortify 360 Server user account the read‐write privileges necessary to create, initialize, and manage the Fortify 360 Server database. At a minimum these are:

• A database account that enables the Web application to connect to the database.

• Privileges for that account that enable the create-tables.sql script (or if upgrading, the migration25.sql script) to create, alter, or drop the database’s tables, views, indexes, and stored procedures contained in them.

For Oracle databases, in addition to the preceding items, add the privileges necessary to enable sequences.

• For runtime use, privileges for the Fortify 360 Server database user account that permit SELECT, UPDATE, and INSERT, DELETE operations in all Fortify 360 Server database tables, and to run the stored procedures contained in the Fortify 360 Server database.

Database‐specific Configuration RequirementsThis section contains the following topics:

• Fortify 360 Server Database Character Set Support

• Obtaining the Correct Database Driver Class

• Fortify 360 Server Database Character Set Support

• Configuring IBM DB2 Databases

• Configuring Microsoft SQL Server Databases

• Configuring MySQL Databases

• Configuring Oracle Databases

Fortify 360 Server Database Character Set SupportThe following table lists the supported character sets for each type of third‐party databases supported by Fortify 360 Server.

For a list of each third‐party database’s supported versions, see the Fortify 360 Server System Requirements datasheet.

Table 3: List of supported Fortify 360 Server database encodings

Supported Database Supported Char. Sets

IBM DB2 UDB 9.5 IBM‐1252, UTF8

Microsoft SQL Server, 2005 or 2008 Unicode, SQL_Latin1_General_CP1_CI_AS

MySQL 5.0.30 and lower, 5.1.39 and above

UTF8, Latin1

Oracle 10g, 11g AL32UTF8


Obtaining the Correct Database Driver Class

Fortify 360 Server does not include the JDBC drivers required to interface with any of the supported third‐party databases.

The database administrator is therefore responsible for obtaining the JDBC JAR required to support the type and version of third‐party database used in conjunction with Fortify 360 Server.

Table 4: lists the database driver classes supported by Fortify 360 Server, and provides information about configuring or obtaining the class JAR files.

Table 4: List of supported database driver classes

Database vendor Supported version and JDBC driver information

IBM DB2, 9.5 IBM DB2 JDBC Driver v9.5 FP4 3.53.95.File names:· db2jcc.jar,· db2jcc4.jar.See this IBM Web site page for download and installation instructions:http://www‐01.ibm.com/support/docview.wss?uid=swg24023213&nbsp

Microsoft SQL Server2005 and 2008

Microsoft SQL Server JDBC Driver 2.0 Type 4.File names:· sqljdbc.jar· sqljdbc4.jarSee this Microsoft Web site page for download and installation instructions:http://www.microsoft.com/downloads/details.aspx?FamilyID=99b21b65‐e98f‐4a61‐b811‐19912601fdc9&displaylang=enOpen source JDBC 3.0 Type 4 driver for Microsoft SQL Server 1.2.2.File name: jtds-1.2.2.jar.http://sourceforge.net/project/showfiles.php?group_id=33291

MySQL MySQL Connector/J 3.1.File name: mysql-connector-java-3.1.14-bin.jar.See this MySQL Web site page for download and installation instructions:http://dev.mysql.com/downloads/connector/j/3.1.html

Oracle 10g Oracle Database 10g Release 2 (10.2.0.4) JDBC Drivers.File name: ojdbc14.jar.Works with JDK versions 1.5 and 1.6.See this Oracle Web site page for download and installation instructions:http://www.oracle.com/technology/software/tech/java/sqlj_jdbc/htdocs/jdbc_10201.html

http://www-01.ibm.com/support/docview.wss?uid=swg24023213&nbsp

http://www-01.ibm.com/support/docview.wss?uid=swg24023213&nbsp

http://www.microsoft.com/downloads/details.aspx?FamilyID=99b21b65-e98f-4a61-b811-19912601fdc9&displaylang=en

http://www.microsoft.com/downloads/details.aspx?FamilyID=99b21b65-e98f-4a61-b811-19912601fdc9&displaylang=en

http://sourceforge.net/project/showfiles.php?group_id=33291

http://sourceforge.net/project/showfiles.php?group_id=33291

http://dev.mysql.com/downloads/connector/j/3.1.html

http://dev.mysql.com/downloads/connector/j/3.1.html

http://www.oracle.com/technology/software/tech/java/sqlj_jdbc/htdocs/jdbc_10201.html



Configuring IBM DB2 DatabasesTo use IBM DB2 as the Fortify 360 Server database, you must:

• Set the page size to 32K.

• Increase the number of secondary log files so that the total number of primary and secondary log files equals 256.

• Change the size of each log file to 4096, then verify that there is enough disk for the increased number of larger log files.

• In the DB2 Control Center, (Tools, Configuration Assistant, Configure, DB2 Registry), specify the registry variables DB2_EVALUNCOMMITTED, DB2_SKIPDELETED and DB2_SKIPINSERTED equal to ON.

• In the database’s JDBC connection specifier, disable progressiveStreaming (also known as dynamic data format). For example:

jdbc:db2://<SERVER_IP>:50000/<DB_NAME>:progressiveStreaming=2;

In the preceding example, progressiveStreaming=2 disables progressive streaming.

Fortify does not support internationalization of DB2 databases. For more information about DB2 character set support, see “Fortify 360 Server Database Character Set Support” on page 15.

Configuring Microsoft SQL Server DatabasesTo use Microsoft SQL Server as the Fortify 360 Server database, you must:

• Create an SQL Server database account for use by Fortify 360 Server

Fortify 360 Server does not support SQL Server access via domain or pass‐through authentication accounts

• Enable READ_COMMITTED_SNAPSHOT

Perform the following procedure to configure READ_COMMITTED_SNAPSHOT

To enable Microsoft SQL Server READ_COMMITTED_SNAPSHOT:

1. Verify that there are no other open connections to the database.

This ensures that the following steps can be completed successfully.

2. In the SQL Server database administration tool, perform the following command:

ALTER Database [360Server2.5_database_name] SET READ_COMMITTED_SNAPSHOT ON

3. In sys.databases, verify that READ_COMMITTED_SNAPSHOT equals 1.

Fortify 360 Server does not support Windows authentication for SQL Server databases.

Oracle 11g Oracle Database 11g Release 1 JDBC Drivers.File name: ojdbc6.jar.Works with JDK version 1.6.See this Oracle Web site page for download and installation instructions:http://www.oracle.com/technology/software/tech/java/sqlj_jdbc/htdocs/jdbc_111060.html

Table 4: List of supported database driver classes (Continued)

Database vendor Supported version and JDBC driver information




Configuring MySQL Databases

To use MySQL as the Fortify 360 Server database, you must Use version 5.0.45 or greater. (More specifically, Fortify 360 Server MySQL version 5.1.34 is known to be incompatible with Fortify 360 Server.) For information about supported versions of MySQL, see the Fortify 360 version 2.5 System Requirements datasheet.

You must also edit the MySQL options file.

To configure the MySQL options file:

1. Locate the MySQL options file.

• In Windows computers, the default options file is my.ini.

• In Unix‐based computers, the default options file is my.cnf.

2. In the MySQL options file, in both the [mysqld] and [mysqldump] sections, configure max_allowed_packet=1G.

3. In the [mysqld] section, specify innodb_log_file_size=512M.

4. In the [mysqld] section, specify query_cache_type so that it does not equal 0.

5. In the [mysqld] section, specify default-storage-engine=INNODB.

Configuring Oracle DatabasesIf you use Oracle 10.2.0.1.0 as the Fortify 360 Server database, you may experience an exception of the type No more data to read from socket.

To ensure this exception does not occur, perform the following procedure:

1. In $ORACLE_HOME/network/admin/tnsnames.ora, Fortify recommends that (SERVER = DEDICATED).

2. After updating tnsnames.ora, in Windows Services restart the database’s active listener to apply the change.

Running Fortify 360 Server Database Creation ScriptsThis section contains the following topics:

• Overview of Fortify 360 Server Database Creation

• If You are Upgrading from an Earlier Version of Fortify 360 Server

• Running the Create Tables Script

• Permanently Deleting an Existing Fortify 360 Server Database

Overview of Fortify 360 Server Database CreationFortify 360 Server uses a version‐specific database structure.

The Fortify 360 Server installation directory structure contains database initialization scripts for all supported third‐party database types. You must run these scripts to create and initialize the database tables required by Fortify 360 Server.

If You are Upgrading from an Earlier Version of Fortify 360 ServerIf you are upgrading from an earlier version of Fortify 360 Server to Fortify 360 Server, do not create a new Fortify 360 Server database.

Instead, Use the information in Upgrading an Existing Fortify 360 Server Database to upgrade your existing Fortify 360 Server database for use with Fortify 360 Server.


Running the Create Tables Script

Before performing the following procedure, review the information contained in the following sections:

• “Database Instance and Privileges Requirements” on page 15

• “Database‐specific Configuration Requirements” on page 15

To run the Fortify 360 Server database creation and initialization scripts:

1. In Fortify-360-Server-WAR/sql, locate the sub‐directory for the third‐party database you will use with Fortify 360 Server. There is a sub‐directory for each type of supported database, as follows:

• db2

• mysql

• oracle

• sqlserver

2. Copy the scripts from the sub‐directory that matches your Fortify 360 Server database type to the database server or other location where you will run the scripts.

3. In the database client program, log in to the database account created for use by Fortify 360 Server.

4. Run the following script to create and then initialize the Fortify 360 Server database tables:

create-tables.sql

If you are upgrading an existing installation of Fortify 360 Server to Fortify 360 Server, and you wish to retain the data in the existing Fortify 360 Server database, do not run the create-tables.sql script: Doing so will overwrite your existing Fortify 360 Server database, resulting in permanent data loss.

Instead, use the information and procedures in Upgrading an Existing Fortify 360 Server Database to upgrade your existing Fortify 360 Server database for use with Fortify 360 Server.

Permanently Deleting an Existing Fortify 360 Server DatabaseThe procedure in “Running Fortify 360 Server Database Creation Scripts” on page 18 describes how to locate the sub‐directory for the third‐party database you will use with Fortify 360 Server.

Each sub‐directory also contains a script — drop-tables.sql — that you can use to permanently delete an existing Fortify 360 Server database schema as well as all data contained in the database.

Configuring Fortify 360 Server Database ConnectivityAfter using the procedure under “Running Fortify 360 Server Database Creation Scripts” on page 18 to initialize the Fortify 360 Server database, you must use the 360configuration.jar configuration utility to configure the connection from Fortify 360 Server to the database.

Before performing the following procedure, be sure that you have:

• Obtained the necessary database driver class as described in “Obtaining the Correct Database Driver Class” on page 16

• Initialized the Fortify 360 Server database, as described in “Running Fortify 360 Server Database Creation Scripts” on page 18.

To use 360configuration.jar to configure database connectivity:

1. Start the Fortify 360 Server configuration tool and display the Database panel.

a. In the application server sub‐directory where you unpacked Fortify-360-Server-WAR, double‐click 360Configuration.jar

b. Respond to the prompts for the location of your Fortify license key file fortify.license, and the Fortify 360 Server WAR file f360.war.



c. Click the Database tab.

360Configuration.jar displays the Database Setup panel.

2. If you are configuring the Fortify 360 Server database for the first time, click Add JDBC Driver, then specify the location of the JDBC driver.

360Configuration.jar uses the JDBC Driver to populate the DB Driver Class list.

For more information about database driver requirements, see “Obtaining the Correct Database Driver Class” on page 16.

3. In the Database Setup panel, specify the URL username, and password for the Fortify 360 Server database.

Click Test JDBC to test the settings.

4. Perform one of the following:

• Continue to “Seeding the Fortify 360 Server Database” to seed the new Fortify 360 Server database instance.

If this is a new Fortify 360 Server database, you must seed the database before starting Fortify 360 Server.

• Click Save & Exit to save the connectivity settings and exit 360Configuration.jar.


Seeding the Fortify 360 Server DatabaseThis section contains the following topics:

• Overview of Database Seeding as Part Of Installation

• Overview of Post‐installation Seeding

• After Seeding a Database

• Using 360configuration.jar to Seed a New Fortify 360 Server Database

• Using the 360configuration.jar Command Line to Upload Post‐installation Resource Bundles

Overview of Database Seeding as Part Of InstallationThe procedure in this section directs you to seed a newly created Fortify 360 Server database.

When you log in to Fortify 360 Server for the first time, Fortify 360 Server requires a minimal set of data to process that initial login and provide basic Fortify 360 Server functionality. Seeding creates those minimal data sets in a newly created third‐party database.

Fortify 360 Server requires the use of two default seeding bundles:

• ProcessTemplateSeedBundle.zip provides default admin user account, Project Template, and Process Template data

• ReportSeedBundle.zip provides the default set of Fortify 360 Server reports.

These are the two seeding bundles you downloaded in the procedure in “Downloading and Unpacking Installation Files” on page 8.

Overview of Post‐installation SeedingIf you use the default bundles to seed a new database, reseeding the database with those bundles has no effect. If you use a different, non‐default seeding bundle, that bundle will add new types of seeding data to a previously seeded database.

For example, the optional PCI Basic Bundle PCIBasicSeedBundle.zip adds a Payment Card Industry process template and an associated report to the default set of Fortify 360 Server process templates and reports.

For information about using the 360configuration.jar command line to seed a Fortify 360 Server database, see “Using the 360configuration.jar Command Line to Upload Post‐installation Resource Bundles” on page 23.

After Seeding a DatabaseSeeding the Fortify 360 Server database ensures a consistent post‐installation configuration. This includes the creation of the default admin user account, as well as other required information such as project templates, process templates, report definitions, and other default data entities required to make Fortify 360 Server operational.

After initial installation and seeding, you can use the Fortify 360 Server user interface to modify any user‐configurable data entities created by the seeding process.


Using 360configuration.jar to Seed a New Fortify 360 Server Database

Perform the procedure in this section to seed a new Fortify 360 Server database instance.

Before You Begin

The procedure in this section assumes that you have:

• Performed the procedure in “Running Fortify 360 Server Database Creation Scripts” on page 18 to create the new Fortify 360 Server database instance.

• Performed the procedure in “Configuring Fortify 360 Server Database Connectivity” on page 19 to configure and test the Fortify 360 Server database connection.

• Copied ProcessTemplateSeedBundle.zip and ReportSeedBundle.zip into the Fortify-360-Server-WAR directory, as described in “Downloading and Unpacking Installation Files” on page 8.

To use 360configuration.jar to seed a new Fortify 360 Server database:

1. Start the Fortify 360 Server configuration tool and display the Database panel.

a. In the application server sub‐directory where you unpacked Fortify-360-Server-WAR, double‐click 360Configuration.jar

b. Respond to the prompts for the location of your Fortify license key file fortify.license, and the Fortify 360 Server WAR file f360.war.


c. Click the Database tab.

360Configuration.jar displays the Database panel.

2. Seed the Fortify 360 Server database with the default set of Process Templates. In the Database panel:

a. Click Seed Process Templates.

360configuration.jar displays the Locate Process Template configuration file dialog box.

b. in the Locate Process Template configuration file dialog box, select ProcessTemplateSeedBundle.zip then click Open.

360configuration.jar seeds the database with the contents of the Process Templates resource bundle.

3. Seed the Fortify 360 Server database with the default set of reports. In the Database panel:

a. Click Seed Reports.

360configuration.jar displays the Locate Report configuration file dialog box.

b. in the Locate Report configuration file dialog box, select ReportSeedBundle.zip then click Open.

360configuration.jar seeds the database with the contents of the reports resource bundle.

4. Click Save & Exit to exit 360Configuration.jar.


Using the 360configuration.jar Command Line to Upload Post‐installation Resource Bundles

For instances of Fortify 360 Server running on computers that do not support a GUI, you can run the 360configuration.jar in command‐line mode.

Command line modes enables you to can add post‐installation resource bundles to instances of Fortify 360 Server that connect to the server database.

Running 360configuration.jar from a command‐line:

• Enables you to add post‐installation resource bundles, such as the PCI Compliance resource bundle, to a previously configured and seeded Fortify 360 Server database.

• Does not enable you to specify database connectivity or other options performed with the 360configuration.jar GUI.

To use the 360configuration.jar command line to add a post-installation resource bundle to a previously configured Fortify 360 Server database, in <install_dir>, type:

java -jar 360configuration.jar -seedOnly -war f360.war -bundle SeedBundleName.zip.

In the preceding example, SeedBundleName.zip specifies the full pathname to a Fortify 360 Server resource bundle.


Upgrading an Existing Fortify 360 Server DatabaseThis section contains the following topics:

• How to Use This Chapter

• Overview of Upgrading a Fortify 360 Server Database

• Before Upgrading Your Fortify 360 Server Database

• Running Fortify 360 Server Database Upgrade Scripts

• Configuring Connectivity to the Upgraded Database

• Re‐seeding an Upgraded Database

• Troubleshooting Database Migration Problems

How to Use This ChapterThis chapter contains information and procedures that describe how to upgrade your existing Fortify Server database for use with Fortify 360 Server.

If You Are Installing Fortify 360 Server For the First TimeIf you do not have an existing Fortify Server database, use the information in “Configuring a New Fortify 360 Server Database” to create a database for use with Fortify 360 Server.

Overview of Upgrading a Fortify 360 Server DatabaseIf you have an existing Fortify 360 Server database, the Fortify 360 Server installation package includes scripts you can use to upgrade that existing database for use with Fortify 360 Server.

Note: Contact Fortify support before you try to migrate a Fortify 360 Server 2.0 or 2.1 that includes customized Process Templates.

Once you have backed up your database, run the upgrade script for your database type to add the new database structures required by Fortify 360 Server.

After upgrading the database, you must then use the 360configuration.jar configuration utility to configure connectivity to the upgraded database, and to re‐seed the upgraded database with the version 2.5 seeding bundles.

Before Upgrading Your Fortify 360 Server DatabaseThis section contains the following topics:

• Before Beginning Database Migration

• If You Are Migrating Custom Process Templates

• Reviewing Database Configuration and Resources

• Specifying MySQL Server Upgrade Settings


Before Beginning Database Migration

The procedures in this chapter assume that:

• You are qualified to perform database administration tasks, including database backup.

• (Fortify 360 2.0 and 2.1) Your existing installation of Fortify 360 Server does not include customized Process Templates.

If your existing installation of Fortify 360 Server includes customized template, see “If You Are Migrating Custom Process Templates” in the next section.

If You Are Migrating Custom Process TemplatesVariations between customized Fortify 360 Server 2.1 Process Templates mean that a single script or process cannot reliably migrate all customized template design elements.

If your existing installation of Fortify 360 Server 2.0 or 2.1 includes custom Process Templates, contact Fortify support for assistance migrating version 2.1 Process Templates before beginning the database migration process.

Reviewing Database Configuration and ResourcesThe Fortify 360 Server database migration process creates larger transactions than those created during regular usage.

For 360 Sever databases that have been successfully run in production environments, migration of your database for use with Fortify 360 Server generally will not require changes to your database configuration or resources.

For large databases, review and if necessary increase the database resources and settings required to accommodate the larger transactions that will occur when running the Fortify 360 Server database migration script.

Specifying MySQL Server Upgrade SettingsIf you are upgrading a MySQL database, Fortify recommends that you add the following to your MySQL configuration:

innodb_buffer_pool_size=512M

For more information about configuring MySQL for use with Fortify 360 Server, see Configuring MySQL Databases.

Running Fortify 360 Server Database Upgrade ScriptsThis section contains the following topics:

• Before Running a Database Upgrade Script

• Choosing a Database Upgrade Script

• Locating and Running the Database Migration Script


Before Running a Database Upgrade Script

Before performing the following procedure:

• Use your database client tool to back up your existing Fortify 360 Server database.

• Acquire the database account information you used to create your existing Fortify 360 Server database.

• Review the information in “Database Instance and Privileges Requirements” on page 15.

The Fortify 360 Server database upgrade scripts require the same database privileges as the database creation scripts.

Choosing a Database Upgrade ScriptFortify provides the following database update scripts:

• migration20to26sql: supports migration from 2.0 to 2.6

• migration21to26.sql: supports migration from 2.1 to 2.6

• migration25to26.sql: supports migration from 25 to 26

Locating and Running the Database Migration ScriptIf you are upgrading from an earlier version of Fortify 360 Server to Fortify 360 Server, use the procedure in this section to update your Fortify 360 Server 2.0 or 2.1 for use with Fortify 360 Server.

To upgrade your existing Fortify 360 Server database for use with Fortify 360 Server:

1. In the Fortify-360-Server-WAR/sql, locate the sub‐directory for the third‐party database you use with Fortify 360 Server. There is a sub‐directory for each type of supported database, as follows:

• db2

• mysql

• oracle

• sqlserver

2. Copy the database migration script from the sub‐directory that matches your Fortify 360 Server database type to the database server or other location where you will run the scripts.

3. In the database client program, log in to the database account created for use by Fortify 360 Server.

You must use the same database account you created for use by 360 Server 2.0. For more information about creating a database account for use by Fortify 360 Server, see “Database Instance and Privileges Requirements” on page 15.

4. Run the following script to update the Fortify 360 Server database:

migration25.sql

Keep a record of the output. If there is an unexpected error message, contact Fortify Support.

5. Continue to the next section to configure the database connectivity settings in the Fortify 360 Server WAR file.


Configuring Connectivity to the Upgraded DatabaseWhen you installed Fortify 360 Server version 2.0 or 2.1, you used the 360configuration.jar command‐line utility to specify the connection parameters Fortify 360 Server 2.0 or 2.1 file would use to interoperate with the third‐party database.

When upgrading to Fortify 360 Server, you must also use the 360configuration.jar command‐line utility to specify the database connection parameters to the Fortify 360 Server WAR file.

For information about using 360configuration.jar to configure Fortify 360 Server database connectivity, see “Configuring Fortify 360 Server Database Connectivity” on page 19.

Re‐seeding an Upgraded DatabaseAfter upgrading your existing Fortify 360 Server database for use with Fortify 360 Server, you must use the 360configuration.jar utility to seed the upgraded database with version 2.5 seeding bundles.

At a minimum, this means re‐seeding the Fortify 360 Server database with the ProcessTemplateSeedBundle.zip and ReportSeedBundle.zip seed bundles.

Additionally, if you added the optional PCI Basic Bundle PCIBasicSeedBundle.zip to your version 2.0 or 2.1 database, you must re‐seed with the Fortify 360 Server version of the PCI Basic Bundle.

For information about seeding a Fortify 360 Server database, see “Seeding the Fortify 360 Server Database” on page 21.

Troubleshooting Database Migration ProblemsIn the 360configuration.jar utility, when you click Save & Exit the utility validates whether or not the database upgrade has been properly completed.

If 360configuration.jar detects an error in the upgraded database, the utility displays messages of the form Database Validation Failed, or you have unmigrated process templates.

The following illustrates the general form of a seeding error message.

If you receive a database validation message:

• Review the information in “If You Are Migrating Custom Process Templates” on page 25.

• In <install_dir>/logs/, use a text editor to inspect 360configuration.log for the cause of the validation error.

If you can use the information in 360configuration.log to correct the error, re‐seed the database with the version 2.5 seeding bundles.

If you cannot use the information in 360configuration.log to correct the error, contact Fortify Support for assistance.

Table 5: General form of a 370configuration.log

ERROR yyyy-mm-dd hh:mm:ss,nnn[com.fortify.manager.DAL.impl.GlobalSeedManagerImpl] - Process template [templateName]is not migrated. Please seed the new seed bundle with this template, or update the template through process template designer.


Logging In and Administering User AccountsThis chapter contains the following topics:

• Starting and Logging In to Fortify 360 Server

• Overview of Fortify 360 Server User Administration

• Creating and Configuring User Accounts

Starting and Logging In to Fortify 360 ServerThis section contains the following topics:

• Starting Fortify 360 Server

• Logging In to Fortify 360 Server for the First Time

Starting Fortify 360 ServerAfter creating and initializing the Fortify 360 Server database and configuring the application server, perform the following procedure to start a new or upgraded instance of Fortify 360 Server for the first time.

To start Fortify 360 Server for the first time:

1. Use your application server’s controls to load and start Fortify 360 Server.

Most application servers include utilities for loading and starting applications without affecting the operation of other applications.

2. In a Web browser's Address area:

• If Fortify 360 Server is configured to use insecure HTTP communications (not recommended), type http://[host_IP]:[port]/f360/

• If Fortify 360 Server is configured to use secure HTTPS communications, type https://[host_IP]:[port]/f360/

In the preceding examples, [port] equals the port number used by your application server. For example, 8080.

Fortify 360 Server starts and the login dialog displays.

Logging In to Fortify 360 Server for the First TimePerform the following procedure to perform the initial login to a new installation of Fortify 360 Server.

To log in to a new instance of Fortify 360 Server for the first time:

1. If you have upgraded from a previous version of Fortify 360 Server 1.x or 2.0, clear your Web browser’s cache.

This ensures that your Web browser will load the most current version of the Fortify 360 Server User’s Guide user interface.

2. Log in to the default Administrator account admin with the password admin.

3. Change the default password.

In Fortify 360 Server, passwords must be at least 8 characters long and must contain at least one:

• Upper case letter

• Lower case letter

• Non‐alphanumeric character


One of the first tasks you should perform after logging in to Fortify 360 Server is to create a non‐default administrator account, then delete the default admin account. For more information about managing Fortify 360 Server user accounts and roles, continue to “Overview of Fortify 360 Server User Administration” in the next section.

Overview of Fortify 360 Server User AdministrationThis section contains the following topics:

• Understanding Administrator Accounts

• Understanding Security Lead, Manager, and Developer Accounts

Understanding Administrator AccountsAdministrator accounts have complete access to all Fortify 360 Server user and Project Version data. More importantly, an Administrator‐level account is the only account role that can:

• Create new user accounts

• Edit or delete other users accounts

As described in “Logging In to Fortify 360 Server for the First Time” on page 28, the first task the primary Fortify 360 Server administrator must perform after logging in to Fortify 360 Server for the first time is to create at least one non‐default Administrator account, then delete the default admin account.

After creating a non‐default Administrator account, use that account to create Fortify 360 Server Security Lead, Manager, and Developer user accounts.

Understanding Security Lead, Manager, and Developer AccountsIn addition to the Administrator‐level account used to administer Fortify 360 Server user accounts, Fortify 360 Server supports the following three levels of user role, in order of descending level of authority.

• Security Leads

• Managers

• Developers

Security Leads have access to all administrative operations except user account creation and editing. The Security Lead creates Project Versions, and edits all aspects of Project Versions they have either created or to which they been assigned.

Managers have read‐only access to most administrative data, and create and edit all data for Project Versions to which they have been assigned.

Developers have read‐only access to some administrative data, and create and edit a subset of data for the Project Versions to which they have been assigned.

All Fortify 360 Server user account types can edit their own account information.


Creating and Configuring User AccountsThe Users window also provides tools you can use to edit, delete, or suspend all user accounts except the last Admin‐level account. Fortify 360 Server will automatically disable the suspend feature for the last remaining Admin‐level account.

To create a user account:

1. Login to Fortify 360 Server as an Administrator, then click Administration to open the Users window.

2. Click Add to create a new user account.

Use the table under Understanding Security Lead, Manager, and Developer Accounts as a guide to assigning the new account a role.

After you have completed all required fields, Fortify 360 Server enables the Save button.

3. Click Save.

The new account information displays.

To learn how to configure Fortify 360 Server user account timeout and lockout settings, see “Configuring User Account Timeout and Lockout Settings” on page 33.

For more information about user account privileges, see the Fortify 360 Server User Guide.


Configuring Fortify 360 ServerThis chapter contains the following topics:

• Starting the Fortify 360 Server Configuration Utility

• Overview of Configuration Utility Panels

• Configuring Bugzilla Integration

• Configuring E‐mail Setup

Starting the Fortify 360 Server Configuration UtilityFortify 360 Server includes a GUI configuration utility, 360configuration.jar.

To start 360configuration.jar, you will need your Fortify license key file fortify.license.

To start the Fortify 360 Server configuration utility:

1. Start the Fortify 360 Server configuration utility.

a. In the Fortify-360-Server-WAR directory created when you unpacked the Fortify 360 Server archive file, double‐click 360Configuration.jar.

The configuration utility displays the Locate license file for Fortify 360 Server dialog box.

b. In the Locate license file dialog box, browse to the location of fortify.license.

The configuration utility displays the Locate WAR file of Fortify 360 Server dialog box.

c. In the Locate WAR file dialog box, browse to f360.war.

By default, the configuration utility displays the Core panel.

2. Continue to the next section to learn more about each of the configuration utility’s panels.

Overview of Configuration Utility PanelsTo learn more about each of the Fortify 360 Server configuration utility's panels, see Table 6:.

Table 6: Fortify 360 Server Configuration Utility tabs

Configuration utility tab Description

Database Setup Use to specify the location and credentials of the Fortify 360 Server third‐party database.To learn how to configure Fortify 360 Server database settings, see Configuring a New Fortify 360 Server Database.

Bugzilla Integration Use to integrate Fortify 360 Server with your enterprise’s Bugzilla bug‐tracking system.To learn how to configure Bugzilla integration, see “Configuring Bugzilla Integration” on page 33.

CAS Setup Use to configure Fortify 360 Server to interoperate with a Central Authentication Server settings.Not supported in initial release of Fortify 360 Server.


Core Use to select or configure:· The JDK used to run Fortify 360 Server· Fortify 360 Server password timeout and Rulepack proxy settings.To learn how to select the JDK used to run Fortify 360 Server, see “Selecting the Correct JDK Version” on page 8.To learn how to configure Fortify 360 Server user account timeout and lockout settings, see “Configuring User Account Timeout and Lockout Settings” on page 33.To learn how to configure a proxy server for Fortify 360 Server Rulepack updates, see “Configuring a Proxy for Rulepack Updates” on page 34.

Email Setup Use to configure the email server settings used by Fortify 360 Server to send email alerts to users.To learn how to configure Fortify 360 Server email settings, see “Configuring E‐mail Setup” on page 34.

JMS Notification Use to configure Fortify 360 Server operation parameters.Use the default values unless directed to change them by Fortify.

Job Configuration Use to configure Fortify 360 Server’s Quartz job scheduler.Use the default values unless directed to change them by Fortify.

LDAP Use to configure Fortify 360 Server to interoperate with an LDAP authentication server.To learn how to configure Fortify 360 Server LDAP settings, see Configuring LDAP User Authentication.

RTA Use to enable or disable Fortify Real‐Time Analyzer 2.5 communications with Fortify 360 Server.To learn how to configure Fortify 360 Server communications RTA, see “Enabling Fortify RTA Communications” on page 12.

SSO Use to configure Fortify 360 Server to interoperate with a Single Sign‐on server.To learn how to configure Fortify 360 Server SSO, see “Configuring Single Sign‐on” on page 35”.

Scheduler Service Use to configure Fortify 360 Server’s snapshot scheduler.Use the default values unless directed to change them by Fortify.

Web Services Use to configure Fortify 360 Server Web parameters.Use the default values unless directed to change them by Fortify.

Table 6: Fortify 360 Server Configuration Utility tabs

Configuration utility tab Description


Configuring Bugzilla IntegrationFortify 360 Server allows the project team to submit a bug from the Fortify 360 Server Collaboration Module to the team’s Bugzilla bug‐tracking system.

Before performing this procedure, create a Bugzilla account for use by the Fortify 360 Server Project Version.

To configure Bugzilla Integration:

1. In the Fortify 360 Server configuration utility, click Bugzilla Integration.

The Fortify 360 Server configuration utility displays the Bugzilla Integration panel.

2. Use the Bugzilla Integration panel to enable and configure Bugzilla integration.

3. Click Save & Exit to save the configuration.

Configuring User Account Timeout and Lockout SettingsBy default, Fortify 360 Server uses the following settings for user account settings.

To specify Fortify 360 Server user account timeout and lockout settings:

1. In the Fortify 360 Server configuration utility, click Core.

The Fortify 360 Server configuration utility displays the Core panel.

2. Configure the Fortify 360 Server user account lockout and time settings.

Use the information in Table 7: as a guide to configuring the settings.


Table 7: Fortify 360 Server user account timeout and lockout settings

User account parameter Default value and description

Inactive Session Timeout (minutes) Default: 30 minutes.Number of minutes of user inactivity before Fortify 360 Server automatically logs a user account off.

Login Attempts before Lockout Default: 3 attempts.Number of times an incorrectly specified login can be attempted before Fortify 360 Server locks the user’s connection out.If Fortify 360 Server locks out a connection, that connection is prevented from attempting a new login for the number of minutes specified by Lockout time, described later in this table.

Days before password reset Default: 30 days.Number of days before a user must change his or her Fortify 360 Server account password.

Lockout time Default: 30 minutes.If a user attempt to log in to Fortify 360 Server fails the number times specified by Login Attempts before Lockout, described earlier in this table, Fortify 360 Server locks that connection out for the number of minutes specified by Lockout time.


Configuring a Proxy for Rulepack UpdatesBy default, Fortify 360 Server downloads the current versions of Fortify Secure Coding Rulepacks you subscribe to from the Fortify Rulepacks server at https://update.fortify.com. Do not modify the default value of Rulepack Update URL unless directed to by your Fortify customer support representative.

For installations that do not permit downloads directly from an external network source, you can configure Fortify 360 Server to download Rulepacks from a Proxy server.

To complete the procedure in this section you will need:

• A current subscription to one or more Fortify Secure Coding Rulepacks

• The URL, port number, and username for the proxy server you will use to perform Rulepack updates

To configure a Proxy for Rulepack updates:

1. In the Fortify 360 Server configuration utility, click Core.

The Fortify 360 Server configuration utility displays the Core panel.

2. Configure the settings for your Rulepack proxy server.

• In the Proxy for Rulepack Update, Proxy Port, and Proxy Username text entry areas, type the network name or IP address, the associated port number, and a valid username for your Rulepack proxy server.

• Leave the Locale for Rulepacks text entry area blank: Fortify 360 Server does not support localized Rulepacks.


Configuring E‐mail SetupFortify 360 Server can email Alerts information to the project team.

Before performing this procedure, create an SMTP e‐mail account for use by the Fortify 360 Server Project Version.

To configure Bugzilla Integration:

1. In the Fortify 360 Server configuration utility, click Email Setup.

The Fortify 360 Server configuration utility displays the E‐Mail Setup panel.

2. In the EMail Setup panel, enable and configure email integration.



Configuring Single Sign‐onFortify 360 Server supports Single‐sign on (SSO). SSO enables a user to log in once to gain access to multiple, separate systems.

The procedure in this section assumes that you have the knowledge required to:

• Configure your Web server to interoperate with your SSO server

• Configure Fortify 360 Server to use LDAP authentication

To configure Single Sign‐on:

1. Configure the Web server that runs Fortify 360 Server to server as a proxy to Fortify 360 Server.

2. Configure Fortify 360 Server to use LDAP authentication.

For information about configuring Fortify 360 Server to use LDAP authentication, see Configuring LDAP User Authentication.

3. In the Fortify 360 Server configuration utility, click SSO.

The Fortify 360 Server configuration utility displays the SSO panel.

4. In the SSO panel, enable and configure single‐sign on.

a. Select Enable SSO Integration.

b. In the HTTP Header for Username text entry area, type the HTTP header used for single‐sign on log ins.

c. Click Save & Exit to save the configuration.

5. Configure the single‐sign on agent to ignore Web services authentication requests.

The single sign‐on server does not authenticate Web services requests of the form:

/<app_context>/fm-ws/*.


Configuring LDAP User AuthenticationThis chapter contains the following topics:

• Overview of Fortify 360 Server User Authentication

• Preparing to Configure LDAP Authentication

• Using 360Configuration.jar to Specify LDAP Server Options

• Registering LDAP Entities with Fortify 360 Server

• Managing LDAP User Roles

Overview of Fortify 360 Server User AuthenticationThis section contains the following topics:

• Fortify 360 Server Simplifies LDAP Configuration

• Overview of Database‐only Authentication

• Overview of Fortify 360 Server LDAP Authentication

Fortify 360 Server Simplifies LDAP ConfigurationThis chapter describes how to configure Fortify 360 Server to interoperate with an LDAPv3, UTF8, Active Directory authentication server.

Fortify 360 Server now uses a runnable JAR, 360Configuration.jar, that provides a GUI means of configuring Fortify 360 Server LDAP.

Overview of Database‐only AuthenticationBy default, when a user logs in to the Fortify 360 Server user interface or uses a Fortify client to upload project results files, Fortify 360 Server uses its database to authenticate that user. After authenticating a user, Fortify 360 Server binds the authenticated user to his or her assigned Fortify 360 Server User role (Administrator, Security Lead, Developer, Auditor).

The default database‐only authentication method can be augmented by using LDAP to authenticate users.

However, database‐only authentication imposes a separate administrative process for creating and managing Fortify 360 Server user accounts and roles.That separate administrative process is why most administrators prefer to augment Fortify 360 Server’s default database‐only authentication with LDAP. LDAP authentication enables a single administrative process to create and manage user authentication for multiple network entities, including Fortify 360 Server.

Overview of Fortify 360 Server LDAP AuthenticationFortify 360 Server can be configured to augment its native database‐only user authentication with LDAP user authentication. The use of LDAP enables an LDAP administrator to centrally manage user authentication across multiple network entities, including Fortify 360 Server.


Preparing to Configure LDAP AuthenticationReview the following sections before configuring Fortify 360 Server to use LDAP authentication:

• Download the JXplorer LDAP Browser

• Create an LDAP Account for use by Fortify 360 Server

• Avoid Conflicts Between Account Names

• Gather and Record Required Information

Download the JXplorer LDAP BrowserIf you are not familiar with the LDAP schema used by your LDAP server, you can use the third‐party tool JXplorer to view and modify LDAP authentication directories.

JXplorer can be downloaded for free under a standard OSI‐style open source license from:

http://www.jxplorer.org/

Create an LDAP Account for use by Fortify 360 ServerIf your LDAP server does not permit anonymous binding, create a read‐only LDAP account for use by Fortify 360 Server. Fortify 360 Server requires an account with permissions necessary to read user attributes and authenticate users.

Even if your LDAP server does support anonymous binding, you may prefer to create an LDAP read‐only account for use by Fortify 360 Server.

Never use a user’s account name to provide Fortify 360 Server access to an LDAP server.

Avoid Conflicts Between Account NamesIf the LDAP directory contains the default Fortify 360 Server default account admin, a conflict occurs that could result in both accounts being disabled.

If an existing Fortify 360 Server account name has the same as an account name defined to the LDAP server, Fortify 360 Server’s account settings and attributes take precedence over those stored on the authentication server.

Gather and Record Required InformationBefore configuring Fortify 360 Server to use LDAP, review the following sections and record any information you will need to successfully complete the configuration process:

• Overview of 360Configuration.jar LDAP Options

• Managing LDAP User Roles

Using 360Configuration.jar to Specify LDAP Server OptionsThis section contains the following topics:

• Accessing the 360Configuration.jar LDAP Panel

• Overview of 360Configuration.jar LDAP Options

http://www.jxplorer.org


Accessing the 360Configuration.jar LDAP Panel

The Fortify 360 Server includes a new GUI configuration tool. The tool includes an LDAP configuration panel.

The 360Configuration.jar LDAP panel:

• Supplants the need to edit text files or run text‐based command line utilities

• Allow multiple LDAP entities to be assigned to Fortify 360 Server Project Versions at a single time

To access the Fortify 360 Server LDAP configuration panel:

1. For Fortify 360 Server, in the application server sub‐directory where you unpacked Fortify-360-Server-WAR, double‐click 360Configuration.jar

Fortify-360-Server-WAR prompts for the location of the Fortify 360 Server WAR file.

2. Use the 360Configuration.jar dialog boxes to specify the location of Fortify-360-Server-WAR and your Fortify license file fortify.license.

360Configuration.jar displays the CAS Setup tab.

3. Click the LDAP tab.

360Configuration.jar displays the LDAP panel.

4. Use the information in Overview of 360Configuration.jar LDAP Options, in the following section, to specify LDAP options.


Overview of 360Configuration.jar LDAP Options

The 360Configuration.jar LDAP panel contains a total of 19 LDAP configuration options. The options are logically grouped as follows:

The following table lists the LDAP configuration options in the order they are presented by the 360Configuration.jar LDAP panel.

Table 8: 360Configuration.jar LDAP options

# 360configuration.jar option Description

01 Server URL Specify the URL of the LDAP authentication server.If using unsecured LDAP, use the form:• ldap://<hostname> if using the default port, 389 • ldap://<hostname>:<port> if non‐default portIf using secured LDAPS, use the form:• ldaps://<hostname> if using the default port, 636• ldaps://<hostname>:<port> if non‐default portLDAPS ensures that user credentials are encrypted before being transmitted.

02 Bind User DN The full distinguished name (DN) of the account Fortify 360 Server uses to connect to the authentication server.The general form of a connection account specifier is cn=<accountName>,ou=users,dc=<domainName>,dc=com, where accountName specifies the minimum privilege, read‐only authentication server account you created for exclusive use by Fortify 360 Server. Never use a user’s account name a production environment.If using Active Directory, you can specify the connection account a the account’s email address, of the form<DOMAINNAME>\<username>

03 Bind User Password The password for the Bind User DN account, described in the preceding table row.

04 Base DN Specify the Base Distinguished Name (DN) for LDAP directory structure searches.For example, you would construct the Base DN for companyName.com as dc=companyName,dc=com.All DN values are case sensitive, cannot contain extra spaces, and must exactly match LDAP server entries.

05 Relative Search DNs Specify an optional Relative Distinguished Name (RDN).An RDN defines the starting point from the Base DN, described in the preceding table row, for LDAP directory searches.

In general, Fortify recommends searching from the base DN. However, if your LDAP directory is so large that searching for Fortify 360 Server users takes longer than desired, use an RDN to limit the number of LDAP entries searched.


For example, to search within the base DN companyName.doc and all entries under that base DN, specify:• cn=users,dc=companyName,dc=com or•cn=users,ou=divisionName,dc=companyName,dc=comto recursively search all entries under that path.

06 Object Class Attribute Specifies the class of the object.For example, objectClass.

07 Distinguished Name (DN) attribute

Specifies the full distinguished name of the object.For example, dn.

08 User Class Specifies the object class that identifies an LDAP

object type as a user.Active Directory default equals organizationalPerson.

09 User username attribute Specifies the attribute of a user object that specifies a username.Active Directory default equals sAMAccountName.

10 User first name attribute Specifies the attribute of a user object that specifies a user’s first name.Active Directory default equals givenName.

11 User last name attribute Specifies the attribute of a user object that specifies a user’s last name.Active Directory default equals sn

12 User email attribute Specifies the attribute of a user object that specifies a user’s email address.Active Directory default equals mail.

13 Group class Specifies the object class that identifies an LDAP

object type as a group.

14 Group name attribute Active Directory default equals member.

15 Group member attribute Specifies the attribute that contains the members of the Group.Active Directory default equals group.

16 Organizational Unit Class Specifies the object class that indefinites an LDAP object as being an organizational unit.Active Directory default equals container.

Table 8: 360Configuration.jar LDAP options (Continued)



Registering LDAP Entities with Fortify 360 ServerFortify 360 Server Administrator‐level accounts can add LDAP organizational units, groups, and users to Fortify 360 Server’s list of users.

To register an LDAP organizational unit, group, or user with Fortify 360 Server:

1. After logging in to Fortify 360 Server as an Administrator, in the Administration tab click LDAP.

2. Click the Add button.

Fortify 360 Server displays the Register LDAP Entity panel.

17 Organizational unit name attribute

Specifies the group attribute on that specifies the organizational unit name.Active Directory default equals cn.

Table 8: 360Configuration.jar LDAP options (Continued)



3. In the Register LDAP Entity panel:

a. Choose the type of LDAP Entity (Organizational Unit, Group, or User) to register.

b. Type the Name of the entity, then click the Search icon to validate that the entry exists in the LDAP server.

To review how to specify the LDAP server, see “Using 360Configuration.jar to Specify LDAP Server Options” on page 37.

a. In the Roles area, select the Fortify 360 Server roles for the selected LDAP entity.

b. Click Save.

Fortify 360 Server adds the entity to its list of users.

Managing LDAP User RolesThe following sections describe how to use LDAP relative distinguished names (RDNs) to determine user roles:

• How RDNs are Constructed

• How Fortify 360 Server Determines a User’s Group

• Mapping Fortify 360 Server Roles to LDAP Groups

How RDNs are ConstructedAn RDN further qualifies a base DN. For example:

If a given LDAP directory’s base DN equals "dc=domainName, dc=com",

and the full DN equals "cn=group1,ou=users,dc=domainName,dc=com",

then the Relative Distinguished Name (RDN) equals "cn=group1,ou=users".

How Fortify 360 Server Determines a User’s GroupTo recognize that the user is a member of a particular group, Fortify 360 Server requires The CN to refer to a group object in the LDAP directory

When a user logs in, Fortify 360 Server looks up the user in the LDAP directory. Fortify 360 Server determines the user’s group by the common name (CN) specified in the group membership attribute. If the user belongs to more than one group and those groups are mapped to different roles, Fortify 360 Server assigns the user all roles.

Fortify 360 Server does not support nested groups (a group that contains other groups). For example if a user is a member of group A and group A is a member of group B, Fortify 360 Server only recognizes that the user is a member of group A.

Mapping Fortify 360 Server Roles to LDAP GroupsThis section explains how to adjust your basic LDAP configuration to properly authorize users.

In most environments, the LDAP directory contains some number of users who do not need access to Fortify 360 Server. Additionally, certain groups of users may require different access privileges.

Before you configure LDAP user authorization you must decide which LDAP groups will correspond to which Fortify 360 Server roles (Administrator, Manager, Developer, Auditor).

Fortify recommends that you create new LDAP groups that map directly to the different Fortify 360 Server roles. For example, a FORTIFY_ADMINS group and a FORTIFY_DEVELOPERS group.


Migrating Fortify Manager 5.2 ProjectsThis chapter contains the following topics:

• Overview of Two‐pass Projects Migration

• Preparing for Migration

• Unpacking and Copying the Migration Utility

• Running the Migration Utility in GUI Mode

• Running the Migration Utility in Console Mode

• Configuring Migrated SSA Projects

• Resetting Migrated Projects Information

Overview of Two‐pass Projects MigrationFortify 360 Server projects contain new categories of meta‐data that have no direct counterparts in Fortify Manager 5.2 Projects. Fortify Manager Projects settings and data must therefore be mapped to one or more of the new Fortify 360 Server 2.0 and later meta‐data elements.

To help you perform the necessary mapping, the Fortify 360 Server installation package includes a Migration Utility. The Migration Utility supports either GUI or command‐line (“console”) modes of operation.

Regardless of mode, the Migration Utility guides you through a two‐pass migration process that completely migrates one or more Fortify Manager Projects and Project data to Fortify 360 Server Projects and Project meta‐data.

The first of the two passes migrates Fortify Manager 5.2 Project Groups, Users, and Custom and Organizational Tags.

The second of the two passes migrates Fortify Manager 5.2 Projects; you can use Fortify Manager 5.2 Project Groups to migrate multiple Projects in a single pass.

Before running the migration utility in either mode, you must prepare for Migration.

Preparing for MigrationThis section contains the following topics:

• Install Fortify 360 Server

• Upgrade to Fortify Manager 5.2

• Begin with version 3.5 or Later FPRs

• Copy Project Templates to Fortify 360 Server

• Categorize Fortify 360 Server Project Types

• Inventory Project Elements

• Acquire a Fortify 360 Server Administrator Account

• Modifying Default Server Port Assignments


Install Fortify 360 Server

You must install and configure Fortify 360 Server 2.0 and later and a supported third‐party database before migrating Fortify Manager Projects or Project data.

Upgrade to Fortify Manager 5.2The Migration Utility requires that Fortify Manager be version 5.2.

Begin with version 3.5 or Later FPRsThe Fortify 360 Server Migration Utility supports version 3.5 and later FPRs.

FPRs that are not at least version 3.5 cannot be migrated.

Copy Project Templates to Fortify 360 ServerFortify 360 Server manages Project Templates as a global pool of templates, rather than on a per‐project basis. Fortify 360 Server’s new way of managing Project Templates has implications for Fortify Manager 5.2 Projects that you intend to migrate to Fortify 360 Server as Basic Remediation Projects.

If you migrate a Fortify Manager 5.2 Project to Fortify 360 Server as a Basic Remediation Project, the migration tool requires you to choose a Fortify 360 Server Project Template. For this reason, before running the Migration Utility export the necessary Project Templates from Fortify Manager 5.2, then import those Project Templates into Fortify 360 Server.

Categorize Fortify 360 Server Project TypesFortify 360 Server supports two types of Projects.

• Basic Remediation Projects resemble Fortify Manager 5.2 5.x projects, although Fortify 360 Server Basic Remediation Projects support several new features not available in Fortify Manager 5.2.

• SSA Projects are completely new in Fortify 360 Server. The most significant difference between an SSA Project and a Basic Remediation Projects is that SSA Projects support Process Templates.

With regard to migrating of Fortify Manager 5.2 Projects:

• Basic Remediation Projects are finished at the time of migration. Finishing a Basic Remediation project means that the Project Template specified for the project version can no longer be changed.

• SSA Projects can be finished after migration. For more information about finishing migrated SSA Projects, see “Configuring Migrated SSA Projects” on page 52.

For more information about Fortify 360 Server Projects and Project Attributes, see the 360 Server User Guide.


Inventory Project Elements

Before running the Migration Utility, you must decide how best to migrate Fortify Manager Project data to Fortify 360 Server Project Attributes.

Table 9: lists and describes the decisions you must make before running the Migration Utility.

Acquire a Fortify 360 Server Administrator AccountThe Migration Utility requires a Fortify 360 Server Administrator‐level account to perform migration.

You can use either an existing Fortify 360 Server Administrator‐level account, or create an account for use by the Migration Utility. Whichever sort of Administrator‐level account you decide to use, you will need the account name and password to run the Migration Utility.

Table 9: List of pre‐migration decisions

# Migration decision Description

1 Inventory Manager Project Groups

Categorize Manager Project Groups as those that:• Identify projects for a single code base• Perform some other functionMigrate Project Groups that identify single codes bases as Fortify 360 Server Projects.

2 Inventory Manager Custom Organizational Tags

Identify which, if any, Manager Project Tags can be deleted before migrating.The remaining Fortify Manager tags can be migrated as Fortify 360 Server Project Attributes.

3 Inventory available 360 Server Project Attributes

Identify which Fortify Manager Custom Tags and Organizational Tags will map to existing Project Attributes.

4 List numeric Project IDs(Console mode only)

If you are running the Migration Utility on a system that does not support GUI mode, you must run the Migration Utility in console mode.Console mode recognizes only numeric Fortify Manager 5.2 Project identifiers, rather than text‐based Project names.For information about using the fm5migration utility to list the numeric identifiers of your Fortify Manager 5.2 Projects, see “Running the Migration Utility in Console Mode” on page 49.


Modifying Default Server Port Assignments

If you attempt to run Fortify 360 Server, and you receive a port conflict error message, perform the following procedure to modify the default Fortify 360 Server port assignment.

To modify Fortify 360 Server Tomcat server port assignments.

1. Stop Fortify 360 Server.

2. In <install_dir>/Core/tomcat/conf, open server.xml in a text editor.

3. Change the following two attributes from their default values:

• <Server port="ssss" shutdown…>, where ssss is the current server port number (default installation value = 8105).

• <Connector port="cccc" protocol=…>, where cccc is the current connector port number (default installation value = 8080).

4. Use the new server port assignment when connecting to Fortify 360 Server.

For example, type http://localhost:ssss/f360/, where ssss is the non‐default server port number you specified in the preceding step.

Unpacking and Copying the Migration UtilityPerform the procedure in this section to unpack the Migration Utility script file in the installation directory of Fortify Manager 5.2.

To unpack and copy the Migration Utility in the installation directory of Fortify Manager 5.2:

1. Locate the Migration Utility for Fortify 360 Server:

a. In the top‐level folder of your application server, unpack the Fortify 360 Server installation package Fortify-360-2.5.0-Server-WAR.zip.

Unpacking the installation package creates the Fortify 360 Server directory structure Fortify-360-Server-WAR.

b. In the Fortify-360-Server-WAR directory, locate the Migration Utility archive, migrate360.zip.

2. Copy migrate360.zip to the Fortify Manager 5.2 installation directory.

The Migration Utility must be unpacked in the Fortify Manager 5.2 installation directory.

3. in the Fortify Manager 5.2 installation directory, unpack migrate360.zip in the Fortify Manager installation directory to create <Manager_Install_Dir>/migration/.


Migration Utility Command‐line ParametersThe Migration Utility recognizes three command line parameters.

Table 10: lists and describes the operation of the parameters.

Running the Migration Utility in GUI ModeThis section contains the following topics:

• Overview of GUI Mode

• Migrating Fortify Manager Project Elements (GUI Mode)

• Migrating Fortify Manager Projects (GUI Mode)

Overview of GUI ModeWhen run on computers that support a graphical user interface (GUI), the Migration Utility defaults to GUI mode. Perform the procedures in this section to run the Migration Utility in GUI mode.

In computers that do not support a GUI, you must run the Migration Utility in console mode. For information about console mode, see “Running the Migration Utility in Console Mode” on page 49.

Migrating Fortify Manager Project Elements (GUI Mode)After reviewing the information under “Preparing for Migration” on page 43, perform the following procedure to complete this initial pass of the two‐pass migration process. (For information about the two‐pass migration process, see “Overview of Two‐pass Projects Migration” on page 43).

To migrate Fortify Manager Project Groups and Project data elements in GUI mode:

1. Start Fortify 360 Server and the Fortify 360 Server database.

The Migration Utility uses a Fortify 360 Server administrator‐level account to write migrated data into the database.

2. Start the Migration Utility and log in.

a. In <Manager_Install_Dir>/migration/bin, run fm5migration (In Windows computers, fm5migration.bat).

b. In the login dialog box, type the URL of the Fortify 360 Server web services, and the username and password of a Fortify 360 Server administrator‐level account.

Table 10: List of Migration Utility command‐line parameters

Parameter Description

-gui If the migration utility does not automatically start in GUI mode in computers that support a GUI, use the -gui parameter to force GUI operation.

-console In computers that support a GUI, use the -console parameter to force the migration utility to start in command‐line mode.

-genidfiles Use the -genidfiles parameter to create text files that contain Fortify Manager project identifiers, project group identifiers, and user identifiers.For more information about the -genidfiles parameter, see “Creating Lists of Fortify Manager Entity IDs and Names” on page 49.


After connecting to Fortify 360 Server, the Migration Utility displays the Select Manager Project Groups panel.

3. In the Select Manager Project Groups panel, perform one of the following:

• To migrate Fortify Manager Project Groups as Fortify 360 Server Project Attributes, select one or more Fortify Manager 5.2 Project Groups to migrate to Fortify 360 Server, then click Next.

• To migrate Fortify Manager Project Groups as Fortify 360 Server Projects, click Next without selecting any Fortify Manager 5.2 Project Groups.

• To complete the second pass of an uncompleted migration, press Escape, then proceed to “Migrating Fortify Manager Projects (GUI Mode)” on page 48.

The Migration Utility displays the Select Manager Users panel.

4. In the Select Manager Users panel, choose one or more Fortify Manager user accounts to migrate, then click Next.

The Migration Utility displays the Select the Custom Tags and Organizational Tags panel.

5. In the Select the Custom Tags and Organizational Tags panel, choose one or more tags to migrate, then click Migrate.

The Migration Utility displays status messages in the utility’s message area.

6. Continue to the next section to perform the second part of the two‐pass migration process.

Migrating Fortify Manager Projects (GUI Mode)The following procedure is a continuation of the procedure under “Migrating Fortify Manager Project Elements (GUI Mode)” on page 47.

Before beginning this procedure, review the information under “Preparing for Migration” on page 43, perform the following procedure to complete the second pass of the two‐pass migration process.

To migrate Fortify Manager Projects (GUI mode):

1. Perform one of the following:

• Click Migrate Projects individually.

The Migration Utility displays the Select Manager Projects panel• Click Migrate Projects via Project Groups.

The Migration Utility displays Select Manager Project Groups panel.

2. In the Select Manager Projects or Select Manager Project Groups panel, choose one or more Fortify Manager Projects or Project Groups to migrate, then click Next.

The Migration Utility displays the Select 360 Project Attributes panel. Bold red type indicates items that must be selected before you can continue to the next panel.

3. Choose the target project type (Basic Remediation of Manager) and associated attributes. In the Select 360 Project Attributes panel:

a. Choose Basic Remediation or SSA Project.

Because migrating Basic Remediation Projects also finishes them, you must select all required attributes and Fortify 360 Server Project Templates at the time of migration. SSA Projects must be finished after migration. For more information about using Fortify 360 Server to finish migrated SSA Projects, see “Configuring Migrated SSA Projects” on page 52.

b. For the type of Fortify 360 Server Project you chose in the preceding step, select required and optional project attributes.

For a given project type, bold red type identifies items that must be selected before you can continue to the next panel. You must select values for these options to enable the Next button.

c. Click Next.


The Migration Utility displays the Migrate Project Scans panel.

4. In the Migrate Project Scans panel, choose the scans to migrate to Fortify 360 Server.

• Choose Migrate all Project Scans then click Next if you want to migrate all the FPRs contained in the selected Fortify Manager projects.

• Choose Migrate Project Scans after, select a date, then click Next to migrate only more recent scans. This enables you to reduce the number of superfluous FPRs contained in the selected projects.

• Choose Do Not Migrate any Project Scans then click Next if you want to reload scan data into the selected projects after they have been migrated to Fortify 360 Server.

The Migration Utility displays the Migrate Groups, Users, and Tags panel. The panel lists only the Project Groups, Users, and Tags for the Projects being migrated.

5. In the Migrate Groups, Users, and Tags panel, migrate the Project Groups, Users, and Tags associated with a Project being migrated.

• To Migrate Manager Project Groups as Fortify 360 Server Project Attributes, click Migrate Manager Project Groups.

• To automatically migrate users assigned to the selected projects, click Migrate Manager Users.

• To Migrate Manager Tags as Fortify 360 Server Project Attributes, click Migrate Custom and Organizational Tags.

The Group, User, and Tag options will not create duplicate Fortify 360 Server elements: If any element of a particular type already exists in Fortify 360 Server, the Migration Utility will not create multiple copies of it.

6. Click Migrate.


7. To migrate additional projects, repeat this procedure.

Running the Migration Utility in Console ModeThis section contains the following topics:

• Overview of Console Mode

• Creating Lists of Fortify Manager Entity IDs and Names

• Migrating Fortify Manager Project Elements (Console Mode)


Overview of Console ModeWhen run on computers that support a graphical user interface (GUI), the Migration Utility defaults to GUI mode. For information about GUI mode, see “Running the Migration Utility in GUI Mode” on page 47

In computers that do not support a GUI, you must run the Migration Utility in console (command line) mode. Perform the procedures in this section to run the Migration Utility in console mode.

Creating Lists of Fortify Manager Entity IDs and NamesWhen run in console mode, the Migration Utility accepts only numeric Fortify Manager entity identifiers (IDs) as input, not text‐based Fortify Manager project names. For large Fortify Manager 5.2 installations, the list of numeric project IDs produced by the Migration Utility may be too long to be conveniently managed directly from the command line.

To help you manage long lists of Fortify Manager 5.2 entity IDs when using console mode, use the -genidfiles command‐line parameter. The -genidfiles parameters creates text file lists of Project IDs and names, Project Group IDs and names, User IDs and names, and Custom Tag IDs and names.


After generating the list files, you can then edit the text file outside of the Migration Utility to create one or more customized lists. The next time the Migration Utility prompts for a comma‐separated list of numeric Project IDs, you can simply type the file name of a customized list rather than type a lengthy list of numeric IDs.

The following procedure illustrates the use of the -genidfiles parameter.

To generate text files containing Fortify Manager 5.2 Project IDs and names:

1. Open a command line in <Manager_Install_Dir>/migration/bin, then type:

fm5migration -genidfiles

(In Windows computers, type fm5migration.bat -genidfiles)

For each category for which data exists, the Migration Utility creates a text file in the same directory as the Migration Utility, then exits:

• customtag_ids.txt

• project_ids.txt

• projectgroup_ids.txt

• user_ids.txt

2. Open one of the generated files in a text editor.

Each text file contains a list of IDNumber EntityName pairs, one comma‐separated pair per line. The following illustrates the general form of the list.1,EntityName9,EntityName7,EntityName…14,EntityName

3. Use a text editor to create one or more customized lists. Each line in a customized list files must:

• Begin with a numeric Project ID

• Contain only one comma‐separated IDNumber IDName pair per line

Insert a number sign (#) as the first character on a line to exclude unwanted items.

Migrating Fortify Manager Project Elements (Console Mode) After reviewing the information under “Preparing for Migration” on page 43, perform the following procedure to complete this initial pass of the two‐pass migration process. (For information about the two‐pass migration process, see “Overview of Two‐pass Projects Migration” on page 43).

To migrate Fortify Manager Project Groups and Project data elements in Console mode:

1. Start Fortify 360 Server and the Fortify 360 Server database.

The Migration Utility uses a Fortify 360 Server administrator‐level account to write migrated data into the database.


a. In <Manager_Install_Dir>/migration/bin, run fm5migration (In Windows computers, fm5migration.bat).

b. In response to the login prompts, type the URL of the Fortify 360 Server web services, and the username and password of a Fortify 360 Server Administrator level account.

The Migration Utility must have access to the Administrator access to Fortify 360 Server to perform migration. After connecting to Fortify 360 Server, the Migration Utility displays the Select Manager Project Groups panel.

3. In response to the prompt to Enter the ids of the Project Groups, perform one of the following:

• Type a comma‐separated list of numeric Project Group IDs.


• Type the name of a text file containing a list of IDNumber IDName pairs.

For information about generating text files containing lists of IDNumber IDName pairs, see “Creating Lists of Fortify Manager Entity IDs and Names” on page 49.

4. In response to the prompts to Select Manager Users, Select the Custom Tags and Organizational Tags, perform one of the following:

• Type a comma‐separated list of numeric IDs.

• Type the name of a text file containing a list of IDNumber IDName pairs


Migrating Fortify Manager Projects (Console Mode)The following procedure is a continuation of the procedure under “Migrating Fortify Manager Project Elements (GUI Mode)” on page 47.

After reviewing the information under “Preparing for Migration” on page 43, perform the following procedure to complete the second pass of the two‐pass migration process.

To migrate Fortify Manager Projects (console mode):

1. When prompted by the Migration Utility, choose one of the following:

• Migrate Projects individually.

• Migrate Projects via Project Groups.

2. When prompted, perform one of the following:

• Type a comma‐separated list of numeric Project IDs or Project Group IDs.


3. When prompted for the target Fortify 360 Server Project version type, choose Basic Remediation or SSA Project.

Because migrating Basic Remediation Projects also finishes them, you must select all required attributes and Fortify 360 Server Project Templates at the time of migration. For more information about the role of Fortify Manager Project templates during migration of Basic Remediation Projects, see “Categorize Fortify 360 Server Project Types” on page 44.

SSA Projects can be finished after migration. For information about using Fortify 360 Server to finish migrated projects, see “Configuring Migrated SSA Projects” on page 52.

4. For the type of project you chose in the preceding step, select required and optional project attributes.

5. When prompted, choose the Project scans to migrate to Fortify 360 Server.

• Choose Migrate all Project Scans to migrate all the FPRs contained in the selected Fortify Manager projects.

• Choose Migrate Project Scans after, then type a date to migrate only more recent scans. This enables you to reduce the number of superfluous FPRs contained in the selected projects.

• Choose Do Not Migrate any Project Scans then click Next if you want to reload scan data into the selected projects after they have been migrated to Fortify 360 Server.

The Migration Utility displays the Migrate Groups, Users, and Tags panel.

6. In response to the prompts for Migrate Groups, Users, and Custom and Organizational Tags, perform one of the following:

• Type a comma‐separated list of numeric Project Group IDs, User IDs, and Custom Tag IDs.


The Group, User, and Tag options will not create duplicate Fortify 360 Server elements: If any element of a particular type already exists in Fortify 360 Server, the Migration Utility will not create multiple copies of it.


7. To migrate additional projects, repeat this procedure.

Configuring Migrated SSA ProjectsOne of the benefits of migrating Fortify Manager projects to Fortify 360 Server SSA Projects is that you can use Fortify 360 Server to add project attributes to the “unfinished” projects after migration.

To finish and unfinished SSA Project:

1. Login to Fortify 360 Server as an Administrator, Security Lead, or Manager.

2. Select an unfinished SSA Project.

3. Use the Project Edit function to select all required Fortify 360 Server Project attributes.

4. Select a Process Template for the Project.

If unsure what template to use, select a template that is more rigourous than is needed, then exempt any unwanted requirements and activities contained in the template.

5. After completely configuring the unfinished Project, click Finish.

See the Fortify 360 Server User Guide for more information about working with Fortify 360 Server Projects.

Resetting Migrated Projects InformationFor each use of the Migration Utility, the utility records which Fortify Manager 5.2 entities have been migrated.

To completely reset the Migration Utility’s history, delete the migrated entities from Fortify 360 Server, then in <Manager_Install_Dir>/migration/config/, delete migrated.properties.


Migrating Fortify 360 Server 1.x ApplicationsThis chapter contains the following topics:

• Overview of Two‐pass Applications Migration

• Preparing for Migration

• Unpacking and Copying the Migration Utility

• Running the Migration Utility in GUI Mode

• Running the Migration Utility in Console Mode


• Resetting Migrated Applications Information

Overview of Two‐pass Applications MigrationFortify 360 Server 2.0 and later projects contain new categories of meta‐data that have no direct counterparts in Fortify Server 1.x Applications. Fortify 360 Server 1.x Applications settings and data must therefore be mapped to one or more of the new Fortify 360 Server 2.0 and later meta‐data elements.

To help you perform the necessary mapping, the Fortify 360 Server installation package includes a Migration Utility. The Migration Utility supports either GUI or command‐line (“console”) modes of operation.

Regardless of mode, the Migration Utility guides you through a two‐pass migration process that completely migrates one or more Fortify 360 Server 1.x Applications and Application data to Fortify 360 Server Projects and Project meta‐data.

The first of the two passes migrates Fortify 360 Server 1.x Users. The second of the two passes migrates 360 Server 1.x Applications.

Before running the migration utility in either mode, you must prepare for Migration.

Preparing for MigrationThis section contains the following topics:

• Install Fortify 360 Server

• Categorize Fortify 360 Server Project Types

• List Numeric Application IDs (Console Mode Only)

• Modify Default Server Port Assignments

• Acquire a Fortify 360 Server Administrator‐level Account

Install Fortify 360 ServerYou must install and configure Fortify 360 Server and a supported third‐party database before migrating Fortify 360 Server 1.x Applications or Application data.


Categorize Fortify 360 Server Project Types

Fortify 360 Server supports two types of Projects.

• Basic Remediation Projects resemble 360 Server 1.x Applications, although Fortify 360 Server Basic Remediation Projects support several new features not available in 360 Server 1.x.

• SSA Projects are completely new in Fortify 360 Server. The most significant difference between an SSA Project and a Basic Remediation Projects is that SSA Projects support Process Templates.

With regard to migrating 360 Server 1.x Applications:

• Basic Remediation Projects are finished at the time of migration. Finishing a Basic Remediation project means that the Project Template specified for the project version can no longer be changed.

• SSA Projects can be finished after migration. For more information about finishing migrated SSA Projects, see “Configuring Migrated SSA Projects” on page 60.

For more information about Fortify 360 Server Projects and Project Attributes, see the 360 Server User Guide.

List Numeric Application IDs (Console Mode Only)If you are running the Migration Utility on a system that does not support GUI mode, you must run the Migration Utility in console mode.

Console mode recognizes only numeric 360 Server 1.x Application identifiers, rather than text‐based Application names.

For information about using the f360v1migration utility to list the numeric identifiers of your 360 Server 1.x Applications, see “Running the Migration Utility in Console Mode” on page 58.

Acquire a Fortify 360 Server Administrator‐level AccountThe Migration Utility requires a Fortify 360 Server Administrator‐level account to perform migration.

You can use either an existing Fortify 360 Server Administrator‐level account, or create an account for use by the Migration Utility. Whichever sort of Administrator‐level account you decide to use, you will need the account name and password to run the Migration Utility.

Modify Default Server Port AssignmentsIf you attempt to run Fortify 360 Server, and you receive a port conflict error message, the perform the following procedure to modify the default Fortify 360 Server port assignments.

To modify Fortify 360 Server Tomcat server port assignments.

1. In <install_dir>/Core/tomcat/conf, open server.xml in a text editor.

2. Change the following two attributes from their default values:

• <Server port="ssss" shutdown…>, where ssss is the current server port number (default installation value = 8105).

• <Connector port="cccc" protocol=…>, where cccc is the current connector port number (default installation value = 8080).

3. Use the new server port assignment when connecting to Fortify 360 Server.

For example, type http://localhost:ssss/f360/, where ssss is the non‐default server port number you specified in the preceding step.


Unpacking and Copying the Migration UtilityPerform the procedure in this section to unpack the Migration Utility script file in the installation directory of 360 Server 1.x.

To unpack and copy the Migration Utility in the installation directory of 360 Server 1.x:

1. To locate the Migration Utility for Fortify 360 Server:

a. In the top‐level folder of your application server, unpack the Fortify 360 Server installation package Fortify-360-2.6.1-Server-WAR.zip.

Unpacking the installation package creates the Fortify 360 Server directory structure Fortify-360-Server-WAR.

b. In the Fortify-360-Server-WAR directory, locate the Migration Utility archive, migrate360.zip.

2. Copy migrate360.zip to the 360 Server 1.x installation directory.

The Migration Utility must be unpacked in the 360 Server 1.x installation directory.

3. in the 360 Server 1.x installation directory, unpack migrate360.zip in the Fortify 360 Server 1.x installation directory to create <Server1x_Install_Dir>/migration/.

Migration Utility Command‐line ParametersThe Migration Utility recognizes three command line parameters.

Table 11: lists and describes the operation of the parameters.

Table 11: List of Migration Utility command‐line parameters

Parameter Description

-gui If the migration utility does not automatically start in GUI mode in computers that support a GUI, use the -gui parameter to force GUI operation.

-console In computers that support a GUI, use the -console parameter to force the migration utility to start in command‐line mode.

-genidfiles Use the -genidfiles parameter to create text files that contain Fortify 360 Server 1.x user identifiers and Application identifiers.For more information about the -genidfiles parameter, see “Creating Lists of Fortify 360 Server 1.x Entity IDs and Names” on page 58.


Running the Migration Utility in GUI ModeThis section contains the following topics:

• Overview of GUI Mode

• Migrating Fortify Server 1.x Users (GUI Mode)

• Migrating Fortify Server 1.x Applications (GUI Mode)

Overview of GUI ModeWhen run on computers that support a graphical user interface (GUI), the Migration Utility defaults to GUI mode. Perform the procedures in this section to run the Migration Utility in GUI mode.

In computers that do not support a GUI, you must run the Migration Utility in console mode. For information about console mode, see “Running the Migration Utility in Console Mode” on page 58.

Migrating Fortify Server 1.x Users (GUI Mode)After reviewing the information under “Preparing for Migration” on page 53, perform the following procedure to complete this initial pass of the two‐pass migration process. (For information about the two‐pass migration process, see “Overview of Two‐pass Applications Migration” on page 53).

To migrate Fortify 360 Server 1.x Applications and Application data elements in GUI mode:

1. Start Fortify 360 Server and the Fortify 360 Server database, and the 360 Server 1.x database.

The Migration Utility reads data from the 360 Server 1.x database, then uses the Fortify 360 Server web services interface to migrate it into the Fortify 360 Server database.


a. In <Server1x_Install_Dir>/migration/bin, run f360v1migration (In Windows computers, f360v1migration.bat).

b. In the login dialog box, type the URL of the Fortify 360 Server web services, and the username and password of a Fortify 360 Server administrator‐level account.

The Migration Utility displays the Migrate Users panel.

3. In the Migrate Users panel, choose one or more Fortify 360 Server 1.x user accounts to migrate, then click Next.




Migrating Fortify Server 1.x Applications (GUI Mode)

The following procedure is a continuation of the procedure under “Migrating Fortify 360 Server 1.x Users (Console Mode)” on page 59.

Before beginning this procedure, review the information under “Preparing for Migration” on page 53, perform the following procedure to complete the second pass of the two‐pass migration process.

To migrate Fortify 360 Server 1.x Applications (GUI mode):

1. In the Migrate Applications Individually panel, choose one or more Fortify 360 Server 1.x Applications to migrate, then click Next.

The Migration Utility displays the Select 360v2 Project Attributes panel. Bold red type indicates items that must be selected before you can continue to the next panel.

2. Choose the target project type (Basic Remediation of Manager) and associated attributes. In the Select 360 Application Attributes panel:

a. Choose Basic Remediation or SSA Project.

Because migrating Basic Remediation Projects also finishes them, you must select all required attributes and Fortify 360 Server Project Templates at the time of migration. SSA Projects must be finished after migration. For more information about using Fortify 360 Server to finish migrated SSA Projects, see “Configuring Migrated SSA Projects” on page 60.

b. For the type of Fortify 360 Server Project you chose in the preceding sub‐step, select required and optional project attributes.

For a given project type, bold red type identifies items that must be selected before you can continue to the next panel. You must select values for these options to enable the Next button.

c. Click Next.

The Migration Utility displays the Migrate Application Scans panel.

3. In the Migrate Application Scans panel, choose the scans to migrate to Fortify 360 Server.

• Choose Migrate all Application Scans then click Next if you want to migrate all the FPRs contained in the selected Fortify 360 Server 1.x Applications.

• Choose Migrate Application Scans after, select a date, then click Next to migrate only more recent scans. This enables you to reduce the number of superfluous FPRs contained in the selected Applications.

• Choose Do Not Migrate any Application Scans then click Next if you want to reload scan data into the selected Applications after they have been migrated to Fortify 360 Server.

In the Migration Utility, select or clear the options for the Applications being migrated.

4. In the Migrate Users panel, migrate the Users associated with an Application being migrated.

• To automatically migrate users assigned to the selected Applications, click Migrate 360 Server 1.x Users.

The User options will not create duplicate Fortify 360 Server Users: If user already exists in Fortify 360 Server, the Migration Utility will not create duplicate accounts for that user name.

5. Click Migrate.


6. To migrate additional Applications, repeat this procedure.


Running the Migration Utility in Console ModeThis section contains the following topics:

• Overview of Console Mode

• Creating Lists of Fortify 360 Server 1.x Entity IDs and Names

• Migrating Fortify 360 Server 1.x Applications (Console Mode)


Overview of Console ModeWhen run on computers that support a graphical user interface (GUI), the Migration Utility defaults to GUI mode. For information about GUI mode, see “Running the Migration Utility in GUI Mode” on page 56

In computers that do not support a GUI, you must run the Migration Utility in console (command line) mode. Perform the procedures in this section to run the Migration Utility in console mode.

Creating Lists of Fortify 360 Server 1.x Entity IDs and NamesWhen run in console mode, the Migration Utility accepts only numeric Fortify 360 Server 1.x entity identifiers (IDs) as input, not text‐based Fortify 360 Server 1.x Application names. For large 360 Server 1.x installations, the list of numeric Application IDs produced by the Migration Utility may be too long to be conveniently managed directly from the command line.

To help you manage long lists of 360 Server 1.x entity IDs when using console mode, use the -genidfiles command‐line parameter. The -genidfiles parameters creates text file lists of Application IDs and names, and User IDs and names,.

After generating the list files, you can then edit the text file outside of the Migration Utility to create one or more customized lists. The next time the Migration Utility prompts for a comma‐separated list of numeric Application IDs, you can simply type the file name of a customized list rather than type a lengthy list of numeric IDs.


The following procedure illustrates the use of the -genidfiles parameter.

To generate text files containing 360 Server 1.x Application IDs and names:

1. Open a command line in <Server1x_Install_Dir>/migration/bin, then type:

f360v1migration -genidfiles

(In Windows computers, type f360v1migration.bat -genidfiles)

For each category for which data exists, the Migration Utility creates a text file in the same directory as the Migration Utility, then exits:

• application_ids.txt

• user_ids.txt

2. Open one of the generated files in a text editor.

Each text file contains a list of IDNumber EntityName pairs, one comma‐separated pair per line. The following illustrates the general form of the list.1,EntityName9,EntityName7,EntityName…14,EntityName

3. Use a text editor to create one or more customized lists. Each line in a customized list files must:

• Begin with a numeric Application ID

• Contain only one comma‐separated IDNumber IDName pair per line

Insert a number sign (#) as the first character on a line to exclude unwanted items.

Migrating Fortify 360 Server 1.x Users (Console Mode) After reviewing the information under “Preparing for Migration” on page 53, perform the following procedure to complete this initial pass of the two‐pass migration process. (For information about the two‐pass migration process, see “Overview of Two‐pass Applications Migration” on page 53).

To migrate Fortify 360 Server 1.x Applications in Console mode:

1. Start Fortify 360 Server and the Fortify 360 Server 1.x database.

The Migration Utility reads data from the 360 Server 1.x database, then uses the Fortify 360 Server web services interface to migrate it into the Fortify 360 Server database.


a. In <Server1x_Install_Dir>/migration/bin, run f360v1migration (In Windows computers, f360v1migration.bat).

b. In response to the login prompts, type the URL of the Fortify 360 Server web services, and the username and password of a Fortify 360 Server Administrator level account.

The Migration Utility must have access to the Administrator access to Fortify 360 Server to perform migration. After connecting to Fortify 360 Server, the Migration Utility displays the Select 360 Server 1.x Users panel.

3. In response to the prompt to Enter the ids of the Users, perform one of the following:

• Type a comma‐separated list of numeric User IDs.


For information about generating text files containing lists of IDNumber IDName pairs, see “Creating Lists of Fortify 360 Server 1.x Entity IDs and Names” on page 58.



Migrating Fortify 360 Server 1.x Applications (Console Mode)The following procedure is a continuation of the procedure under “Migrating Fortify 360 Server 1.x Users (Console Mode)” on page 59.

After reviewing the information under “Preparing for Migration” on page 53, perform the following procedure to complete the second pass of the two‐pass migration process.

To migrate Fortify 360 Server 1.x Applications (console mode):

1. When prompted by the Migration Utility, choose Migrate Applications individually.

2. When prompted, perform one of the following:

• Type a comma‐separated list of numeric Application IDs.


3. When prompted for the target Fortify 360 Server Project version type, choose Basic Remediation or SSA Project.

Because migrating Basic Remediation Projects also finishes them, you must select all required attributes and Fortify 360 Server Project Templates at the time of migration. For more information about the role of Fortify 360 Server 1.x Project templates during migration of Basic Remediation Projects, see “Categorize Fortify 360 Server Project Types” on page 54.

SSA Projects can be finished after migration. For information about using Fortify 360 Server to finish migrated projects, see “Configuring Migrated SSA Projects” on page 60.

4. For the type of Fortify 360 Server Project you chose in the preceding step, select required and optional project attributes.

5. When prompted, choose the Application scans to migrate to Fortify 360 Server.

• Choose Migrate all Application Scans to migrate all the FPRs contained in the selected Fortify 360 Server 1.x Applications.

• Choose Migrate Application Scans after, then type a date to migrate only more recent scans. This enables you to reduce the number of superfluous FPRs contained in the selected Applications.

• Choose Do Not Migrate any Application Scans then click Next if you want to reload scan data into the selected Applications after they have been migrated to Fortify 360 Server.

6. To migrate additional Applications, repeat this procedure.

Configuring Migrated SSA ProjectsOne of the benefits of migrating Fortify 360 Server 1.x Applications to Fortify 360 Server SSA Projects is that you can use Fortify 360 Server to add Project Attributes to the “unfinished” Projects after migration.

To finish and unfinished SSA Project:

1. Login to Fortify 360 Server as an Administrator, Security Lead, or Manager.

2. Select an unfinished SSA Project.

3. Use the Project Edit function to select all required Fortify 360 Server Project attributes.

4. Select a Process Template for the Project.

If unsure what template to use, select a template that is more rigourous than is needed, then exempt any unwanted requirements and activities contained in the template.

5. After completely configuring the unfinished Project, click Finish.

See the Fortify 360 Server User Guide for more information about working with Fortify 360 Server Projects.


Resetting Migrated Applications InformationFor each use of the Migration Utility, the utility records which Fortify Server 1.x entities have been migrated.

To completely reset the Migration Utility’s history, delete the migrated entities from Fortify 360 Server, then in <Server1x_Install_Dir>/migration/config/, delete migrated.properties.


Using the fortifyclient UtilityThis chapter contains the following topics:

• Overview of the fortifyclient Utility

• Understanding fortifyclient Access Tokens

• Running the fortifyclient Utility

• Archiving and Restoring Runtime Events

Overview of the fortifyclient UtilityFortify 360 Server includes a new command‐line utility: fortifyclient. (In Windows computers fortifyclient.bat).

fortifyclient bidirectionally transfers information and objects to and from Fortify 360 Server.

To use fortifyclient to perform FPR uploads requires the URL of Fortify 360 Server and one the following:

• A user account on that server with privileges sufficient to perform the operation specified by the fortifyclient command line

• A fortifyclient access token acquired by submitting the credentials for an existing Fortify 360 Server

Understanding fortifyclient Access Tokensfortifyclient access tokens enable scripted processes to perform operations without revealing Fortify 360 Server user names and passwords.

You can use the credentials of any existing Fortify 360 Server user account to create an access token. The access token inherits the privilege level of the account type (Administrator, Security Lead, Manager, Developer) used to create the token.

When fortifyclient uses an access token to perform an operation, Fortify 360 Server logs the operation under the account name used to create the token.

Running the fortifyclient UtilityThis section contains the following topics:

• Specifying a Properly Formed Fortify 360 Server URL

• Listing fortifyclient Options and Parameters

• Using fortifyclient to Acquire an Upload Access Token

• Listing fortifyclient Access Tokens

• Using fortifyclient to List Project Versions

• Using fortifyclient to Upload an FPR

• Using fortifyclient to Download an FPR

• Using fortifyclient to Import a Content Bundle


Specifying a Properly Formed Fortify 360 Server URL

Most fortifyclient commands include the URL of the Fortify 360 Server.

When specifying the URL Fortify 360 Server to fortifyclient, you must include both the port number and the context path /f360/ in the URL. The following illustrates a properly formed fortifyclient Fortify 360 Server URL:

http://nnn.nnn.nnn.nnn:8080/f360/

In the examples contained in this chapter, [360Sv2.5_URL] represents a properly formed URL.

Listing fortifyclient Options and ParametersTo list fortifyclient commands and parameters, in <360Sv2_install_dir>/Deployment/fortifyclient/bin, type fortifyclient. (In Windows computers, type fortifyclient.bat).

fortifyclient lists its commands and options. In Fortify 360 Server, the command and option names are case‐sensitive.

Using fortifyclient to Acquire an Upload Access Tokenfortifyclient upload access tokens enable account and password information to be concealed during the uploading of FPRs to Fortify 360 Server.

To perform the procedure in this section, you will need:

• The URL of Fortify 360 Server

For information about the Fortify 360 Server URL, see “Specifying a Properly Formed Fortify 360 Server URL” on page 63.

• A Fortify 360 Server user name and password with account privileges that permit the operations you will use the fortifyclient access token to perform

To use fortifyclient to acquire an analysis upload token:

1. in <360Sv2_install_dir>/Deployment/fortifyclient/bin, type (line break added for readability):

fortifyclient -url [360Sv2.5_URL] token -gettoken AnalysisUploadToken -user [AccountName]

In the preceding example, AnalysisUpLoadToken is the case‐sensitive fortifyclient upload token specifier.

fortifyclient prompts for a password.

2. Type the password for [AccountName].

fortifyclient displays a token of the general form cb79c492-0a78-44e3-b26c-65c14df52e86

3. Copy the token returned by fortifyclient into a text file.

The ability of fortifyclient to use the token to read or write information to or from Fortify 360 Server corresponds to the account privileges of the Fortify 360 Server user account specified by the -user parameter.


Specifying DaysToLive for fortifyclient Access Tokens

As described in “Using fortifyclient to Acquire an Upload Access Token” on page 63, fortifyclient employs tokens that enable the administration to conceal user account information.

fortifyclient tokens can also be configured to expire after a certain number of days. The following command illustrates the use of the case‐sensitive -daysToLive parameter to acquire a token that expires after two days (line break added for readability):

fortifyclient -url [360Sv2.5_URL] token -gettoken AnalysisUploadToken -user admin -daysToLive 2

In the preceding example, the case‐sensitive daysToLive parameter must be typed exactly as shown.

Listing fortifyclient Access TokensFortify 360 Server administrators can use fortifyclient to list all previously generated access tokens for all Fortify 360 Server user accounts.

Listing access tokens is an administrative‐level operation: the Fortify 360 Server fortifyclient command‐line utility does not support filtering the list of tokens by Fortify 360 Server account name or account privilege level.

To use fortifyclient to list all access tokens:

1. in <360Sv2_install_dir>/Deployment/fortifyclient/bin, type (line break added for readability):

fortifyclient -url [360Sv2.5_URL] listtokens -user [AdminAccountName]

In the preceding example, AdminAccountName is the name of a Fortify 360 Server Administrator‐level user account.

fortifyclient prompts for a password.

2. Type the password for [AdminAccountName].

fortifyclient lists the ID, owner, creation date, expiration date, and creation I.P. address of all fortifyclient access tokens.

Using fortifyclient to List Project VersionsYou can use fortifyclient to list the Fortify 360 Server Project Versions accessible by the account used to create a particular access token. (Administrator‐level accounts can view all Project Versions; Security Lead accounts can view all Project Versions they created or for which they have been granted access; Manager and Developer accounts can view Project Versions for which they have been granted access).

To perform the command in this section, you must first perform the procedure under “Using fortifyclient to Acquire an Upload Access Token” on page 63.

To retrieve a list of Project identifiers, Project Names, and Project Versions, in <360Sv2_install_dir>/Deployment/fortifyclient/bin, type:

fortifyclient -url [360Sv2.5_URL] -authtoken [token] listprojects

In the preceding example, [authtoken] is a valid fortifyclient access token. You can also use the -user and -password parameters to specify user account credentials.

For all Project Versions accessible to the user account that created the token, fortifyclient utility lists the Project Version’s ID, name, and version number.


Using fortifyclient to Upload an FPR

A common task performed by a script is the periodic uploading of FPRs to Fortify 360 Server.

fortifyclient supports the use of the AccessUploadToken to conceal user credentials when using scripts to periodically upload FPRs to Fortify 360 Server. An access token’s DaysToLive parameter can also be used to provide additional security.

The following topics illustrate two methods for using fortifyclient to upload an FPR:

• Uploading Using a Fortify 360 Server Project Identifier

• Uploading Using a Fortify 360 Server Project and Project Version

To perform the commands in this section, you must first perform the procedure under “Using fortifyclient to Acquire an Upload Access Token” on page 63.

Uploading Using a Fortify 360 Server Project Identifier

To use fortifyclient to upload an FPR into a Fortify 360 Server specified by a project identifier, in <360Sv2_install_dir>/Deployment/fortifyclient/bin, type (line break added for readability):

fortifyclient -url [360Sv2.5_URL] -authtoken [token] uploadFPR -file [FPRname.fpr] -projectID [ID_number]

In the preceding example:

• [token] is a valid fortifyclient access token

• [FPRname.fpr] is the full pathname to the FPR file

• [ID_Number] is a Fortify 360 Server project identifier

For more information about acquiring Fortify 360 Server project identifiers, see “Using fortifyclient to List Project Versions” on page 64.

Uploading Using a Fortify 360 Server Project and Project Version

To use fortifyclient to upload an FPR into a Fortify 360 Server Project Version specified by the project name and version, in <360Sv2_install_dir>/Deployment/fortifyclient/bin, type (line break added for readability):

fortifyclient -url [360Sv2.5_URL] -authtoken [token] uploadFPR -file [FPRname.fpr] -project [ProjectName] -version [ProjectVersion]


• [token] is a valid fortifyclient access token


• [ProjectName] is a Fortify 360 Server Project name

• [ProjectVersion] is a corresponding Fortify 360 Server Project Version

Using fortifyclient to Download an FPRYou can use fortifyclient to download FPRs.

The following topics illustrate two methods for using fortifyclient to download an FPR:

• Downloading using a Fortify 360 Server Project Identifier

• Downloading Using a Fortify 360 Server Project and Project Version


Downloading using a Fortify 360 Server Project Identifier

To use fortifyclient to download an FPR into a Fortify 360 Server specified by a project identifier, in <360Sv2_install_dir>/Deployment/fortifyclient/bin, type (line breaks added for readability):

fortifyclient -url [360Sv2.5_URL] -user [UserName] -password [password]downloadFPR -file [FPRname.fpr] -projectID [ID_number]


• [UserName] and [password] are login credentials for a Manager‐level account or higher that has access to the Fortify 360 Server Project Version containing the FPR

Fortify 360 Server does not support the use of access tokens to download FPRs.


• [ID_Number] is a Fortify 360 Server project identifier

For more information about acquiring Fortify 360 Server project identifiers, see “Using fortifyclient to List Project Versions” on page 64.

Downloading Using a Fortify 360 Server Project and Project Version

To use fortifyclient to download an FPR into a Fortify 360 Server Project Version specified by the project name and version, in <360Sv2_install_dir>/Deployment/fortifyclient/bin, type (line breaks added for readability):

fortifyclient -url [360Sv2.5_URL] -user [UserName] -password [password]downloadFPR -file [FPRname.fpr] -project [ProjectName] -version [ProjectVersion]


• [UserName] and [password] are login credentials for a Manager‐level account or higher that has access to the Fortify 360 Server Project Version containing the FPR

Fortify 360 Server does not support the use of access tokens to download FPRs.


• [ProjectName] is a Fortify 360 Server Project name

• [ProjectVersion] is a corresponding Fortify 360 Server Project Version

Using fortifyclient to Import a Content BundleAs part of its ongoing support for Fortify 360 Server, Fortify will periodically provide content bundles (.zip filename extension) that contain one or more Project Templates, Process Templates, or report definitions.

To use fortifyclient to import a content bundle into Fortify 360 Server, in <360Sv2_install_dir>/Deployment/fortifyclient/bin, type (line break added for readability):

fortifyclient -url [360Sv2.5_URL] -user [UserName] -password [password] import -bundle [bundle_name]


• [UserName] and [password] are login credentials for a Security Lead or Administrator account that has access to the Fortify 360 Server Project Version containing the FPR

Fortify 360 Server does not support the use of access tokens to upload content bundles.

• [bundle_name] is the full pathname to the content bundle (.zip filename extension)


Archiving and Restoring Runtime EventsThis section contains the following topics:

• Overview of Archiving and Restoring Runtime Events

• Listing Runtime Applications

• Archiving Runtime Events

• Listing Runtime Archives

• Restoring Runtime Events

Overview of Archiving and Restoring Runtime EventsBeginning with Fortify Real‐Time Analyzer 2.5, you can use the fortifyclient command‐line utility to archive and restore Fortify Real‐Time Analyzer 2.5 events.

Fortify 360 Server includes a new Runtime tab. The tab provides access to Runtime Console tools and features used to manage one or more instances of Fortify Real‐Time Analyzer 2.5 running in Federated mode. The fortifyclient command‐line utility includes a new set of features to support the new Runtime Console

Overview of Archived Runtime Events

Fortify 360 Server stores Runtime event archives in the Fortify 360 Server database. Stored archives can be downloaded for external storage or data mining.

Fortify 360 Server removes archived events from Fortify 360 Server charts and lists.

Overview of Restored Runtime Events

Fortify 360 Server reassigns all restored events to Runtime Applications on the basis of the Runtime Console’s current set of Application Assignment Rules.

For more information about Runtime Console Application Assignment Rules, see the Fortify RTA User’s Guide.

Listing Runtime ApplicationsBefore you can archive a given Runtime Application’s events, you must use fortifyclient to obtain that Application’s numeric identifier.

To use fortifyclient to obtain a list of all Runtime Application identifiers, in <360Sv2_install_dir>/Deployment/fortifyclient/bin, type (line break added for readability):

fortifyclient -url [360Sv2.5_URL] -user [AccountName] -password [password] listRuntimeApplications


• [UserName] and [password] are login credentials for a Manager, Security Lead or Administrator account that has access to the Fortify 360 Server Runtime Application.

The fortifyclient command‐line utility returns a list of numeric Runtime Application IDs and names.

Archiving Runtime EventsTo use fortifyclient to archive a Runtime Application’s events, in <360Sv2_install_dir>/Deployment/fortifyclient/bin, type (line breaks added for readability):

fortifyclient -url [360Sv2.5_URL] -user [AccountName] -password [password] archiveRuntimeEvents -startDate [mmddyyyy] -endDate [mmddyyyy] -applicationIds [AppID1,AppID2,...]




• [mmddyy] specify the date of the first and last Runtime Event to include in the archive.

• [AppID1,AppID2,...] specifies the numeric identifiers of the Runtime Applications to archive.

Listing Runtime ArchivesTo use fortifyclient to list the Runtime Event archives contained in the Fortify 360 Server database, in <360Sv2_install_dir>/Deployment/fortifyclient/bin, type (line break added for readability):

fortifyclient -url [360Sv2.5_URL] -user [AccountName] -password [password] listRuntimeEventArchives



The fortifyclient command‐line utility returns a list of numeric archive IDs, runtime application names, start date, end date, and restored status (true or false).

Restoring Runtime EventsTo use fortifyclient to restore a previously archived set of Runtime events, in <360Sv2_install_dir>/Deployment/fortifyclient/bin, type (line breaks added for readability):

fortifyclient -url [360Sv2.5_URL] -user [AccountName] -password [password] restoreRuntimeEventArchive -archiveId [ArchiveID1,ArchiveID2,...]



• [mmddyy] specify the date of the first and last Runtime Event to include in the archive.

• [ArchiveID1,ArchiveID2,...] specifies the numeric identifiers of one or more Runtime archives to restore.


Running Fortify 360 Server in WebSphere 7.0This section contains the following topics:

• Overview of Running Fortify 360 Server in WebSphere 7.0

• Downloading a Fortify X.509 DER Certificate

• Downloading SUN‐standard xercesImpl.jar

• Configuring f360.war to Run Under WebSphere 7.0

• Adding theX.509 Certificate to WebSphere 7.0

Overview of Running Fortify 360 Server in WebSphere 7.0To run Fortify 360 Server to run under WebSphere .7.0, you must configure both the Fortify 360 Server WAR and the WebSphere .7.0 application server.

Before you can configure either the Fortify 360 Server WAR or the WebSphere .70 server, you must download:

• A copy of the Fortify X.509 DER certificate

• A SUN‐standard instance of xercesImpl.jar

After acquiring these resources, you add the SUN‐standard xercesImpl.jar file to the f360.war file.

Finally, you use the WebSphere 7.0 ikeyman utility to add the Fortify X.509 DER certificate to the WebSphere certificate store.

Downloading a Fortify X.509 DER CertificateThis section contains the following topics:

• Overview of Downloading a DER Certificate

• Using Firefox 3 to Download a X.509 DER Certificate

• Using Internet Explorer 8 to Export a X.509 DER Certificate

Overview of Downloading a DER CertificateTo run Fortify 360 Server under WebSphere 7.0, you must download a copy of the Fortify Web certificate in X.509 DER format. The certificate enables the instance of Fortify 360 Serverrunning under the WebSphere 7.0 server to establish an HTTPS connection with the Fortify rulepack update server at update.fortify.com.

The procedures in this section describe how to use the Firefox 3 or Internet Explorer 8 Web browsers to download a copy of the Fortify certificate as an X.509 DER file.

Using Firefox 3 to Download a X.509 DER CertificateTo use Firefox 3 to export a fortify.com certificate:

1. In Firefox 3, browse to:


2. Open the certificate export tool.

a. In the update.fortify.com page, right‐click then choose View Page Info.

Firefox 3 displays the Page Info tool.

b. In the Page Info tool, click the Security tab, then in the Security Tab choose View Certificate.

Firefox 3 displays the Certificate Viewer tool.



c. In the Certificate Viewer tool, click the Details tab, then click Export.

Firefox 3 displays the Save Certificate to File tool.

3. Export the certificate as an X.509 DER file.

a. In the Certificate Viewer tool, click the Details tab then click Export.

Firefox 3 displays the Save Certificate to File tool.

b. In Save Certificate to File tool, in the Save as type list, choose X.509 Certificate (DER) then click Save.

Click Browse Folders to choose where to save the exported certificate.

Firefox 3 saves the certificate file.

Using Internet Explorer 8 to Export a X.509 DER CertificateTo use Internet Explorer 8 to export a fortify.com certificate:

1. In Internet Explorer 8, browse to:


2. Open the certificate export tool.

a. In the Properties tool, click Certificates.

Internet Explorer 8 displays the Certificate tool.

b. In the Certificate tool, click the Details tab, then click Copy to File.

Internet Explorer 8 displays the Certificate Export Wizard.

3. Export the certificate as an X.509 DER file.

a. In the Certificate Export Wizard, click Next, then click Copy to file.

Internet Explorer 8 displays the Export File Format panel.

b. In the Export File Format panel, choose DER Encoded Binary X.509 (.CER), then click Next.

Internet Explorer 8 displays the File to Export panel.

c. In the File to Export panel, use the Browse, Save As, and Browse Folders tools to choose where to save the exported certificate.

Internet Explorer 8 saves the certificate file.

Downloading SUN‐standard xercesImpl.jarThis section contains the following topics:

• Overview of Downloading Xerces

• Downloading SUN‐standard xercesImpl.jar

Overview of Downloading XercesTo enable WebSphere 7.0 to run Fortify 360 Server, WebSphere 7.0 requires classes packaged in a SUN‐standard instance of xercesImpl.jar.

Downloading SUN‐standard xercesImpl.jarPerform the procedure in this section to acquire a version of xercesImpl.jar required to run Fortify 360 Server in WebSphere 7.0.

To download SUN‐standard xercesImpl.jar:

1. Download the JAXP 1.3. class file to a working directory.



In https://jaxp.dev.java.net/1.3/index.html download the JAXP 1.3 class file.

The general form of the JAXP 1.3 class file name is JAXP_RI_yyyymmdd.class, where yyyymmdd specifies a date in ISO format.

2. Unpack the JAXP_RI_yyyymmdd.class file. In a command window, type:

java -cp . JAXP_RI_yyyymmdd

This creates directory of the form jaxp-1_3-yyyymdd.

3. Continue to “Configuring f360.war to Run Under WebSphere 7.0”, in the next section, to configure the Fortify 360 Server WAR file.

Configuring f360.war to Run Under WebSphere 7.0Perform the procedure in this section to copy the JAXP 1.3 instance of xercesImpl.jar into the Fortify 360 Server WAR file and edit WAR file logging settings.

To configure f360.war to run in WebSphere 7.0:

1. Unpack f360.war into a working directory named f360.

The remainder of this procedure assumes that the unpacked f360.war file structure resides in f360.

2. In the jaxp-1_3-yyyymdddirectory you created in “Downloading SUN‐standard xercesImpl.jar” on page 70, copy xercesImpl.jar to f360/WEB-INF/lib.

3. In the WebSphere 7.0 installation directory, in the profiles subdirectory, copy the name of the server instance.

For example, AppSrv01.

You will need this information to perform the next step.

4. Configure Fortify 360 Server logging for use with WebSphere:

a. In f360/WEB-INF/classes, open log4j.properties in a text editor.

b. Find and replace all instances of catalina.base with SERVER_LOG_ROOT.

c. Find and replace all instances of /logs/f360 with /AppSrv01/logs/f360, where AppSrv01 is the name of the WebSphere 07 server instance you copied in the preceding step.

d. Save and close the updated file.

5. In the f360 directory, repackage f360.war.

When repackaging the WAR, ensure that only the contents of the f360 working directory and not the f360 working directory itself is included in the repackaged WAR.

6. Copy the updated f360.war to the WebSphere 7.0 application profile for Fortify 360 Server.

7. Continue to “Adding theX.509 Certificate to WebSphere 7.0”, in the next section, to add the Fortify X.509 certificate to the WebSphere 7.0 application server.

Adding theX.509 Certificate to WebSphere 7.0The final task required to configure Fortify 360 Server to run under WebSphere 7.0 is to use the WebSphere key management tool to add the certificate to the WebSphere 7.0 application server’s certificate store.

https://jaxp.dev.java.net/1.3/index.html

Documents

Fortify 360 Server Installation and Configuration Guide...The Fortify 360 documentation set contains installation, user, and deployment guides for various 360 components, including