Fortify® 360 Server Installation and Configuration Guide Fortify 360, Version 2.6 May 2010 Copyright© 2010 Fortify® Software, Inc.June 14, 2010 12:21 pm All Rights Reserved. Printed in the United States of America. Fortify Software, Inc. 2215 Bridgepointe Pkwy Suite 400 San Mateo, CA 94404 Fortify Software, Inc. (“Fortify”) and its licensors retain all ownership rights to this document (the “Document”). Use of the Document is governed by applicable copyright law. Fortify may revise this Document from time to time without notice. THIS DOCUMENT IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL FORTIFY BE LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY ERROR IN THIS DOCUMENT, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS, PROFITS, USE OR DATA. FORTIFY RESERVES THE RIGHT TO MODIFY OR REMOVE ANY OF THE FEATURES OR COMPONENTS DESCRIBED IN THIS DOCUMENT FROM THE FINAL PRODUCT, WITHOUT NOTICE. Fortify is a registered trademark of Fortify Software, Inc. Brand and product names in this Document are trademarks of their respective owners. Part number: 1‐151‐2010‐05‐26‐1 Contents Contacting Fortify Software. viii Technical Support . viii Corporate Headquarters. viii Web Site . viii About the Fortify 360 Documentation Set . viii Overview of Fortify 360 Server Installation. 1 How to Use this Guide . 1 The Central Role of Fortify 360 Server . 1 Overview of the Fortify 360 Server Installation Environment. 2 Preparing to Install Fortify 360 Server . 3 Preparing the Application Server . 3 Preparing the Fortify 360 Server Database. 4 Preparing the Optional LDAP Server . 4 Preparing the Optional Bugzilla System . 4 Preparing the Optional E‐mail Server . 4 Preparing Fortify Analysis Agents . 4 Securely Deploying Fortify 360 Server . 5 Overview of Secure Deployment . 5 Securing Access to Facilities . 5 Securing the Application Server. 5 Use HTTPS and SSL Communications . 5 Securing Passwords and User Roles. 6 Managing Computer Services and Accounts . 6 Installing Fortify 360 Server . 7 Overview of Fortify 360 Server . 7 Overview of Fortify 360 Server Installation . 7 Migrating from Version 2.6.0 to 2.6.1 . 8 Downloading and Unpacking Installation Files . 8 Selecting the Correct JDK Version . 8 Overview of Selecting a JDK . 8 Using 360configuration.jar to Select a JDK . 9 Configuring Rulepack Update URL . 9 Configuring Tomcat 6 Server Memory. 10 Overview of Configuring Tomcat 6 Memory. 10 Configuring Tomcat 6 Memory in Windows Computers . 10 Configuring Tomcat 6 Memory in Unix‐based Computers. 11 Fortify 360 Server Installation & Configuration Guide iii Configuring Application Server pragma no‐cache. 12 Overview of pragma no‐cache Settings. 12 Configuring pragma no‐cache in Apache Tomcat . 12 Configuring pragma no‐cache in Other Application Servers. 12 Enabling Fortify RTA Communications. 12 After Completing Installation . 13 Configuring a New Fortify 360 Server Database. .14 How to Use This Chapter . 14 If You Are Upgrading from an Earlier Version of Fortify 360 Server. 14 Overview of Creating a Fortify 360 Server Database . 14 Before Creating a Fortify 360 Server Database . 14 Database Instance and Privileges Requirements. 15 Database‐specific Configuration Requirements. 15 Fortify 360 Server Database Character Set Support . ..