How can we upgrade the AutoSys Tomcat webserver to address vulnerabilities?
Release : 11.3.6
Component : CA Workload Automation AE (AutoSys) Web Server
1. Take a backup of the existing web server in $AUTOSYS/../webserver. Lets name backup name as old
2. Download newer (for example 8.5.41) tomcat tar file from http://tomcat.apache.org/ or obtain your inhouse supported tomcat and extract it at $AUTOSYS/..
3. Copy below files from old to new:
Copy old/bin/waae_webserver* to new $AUTOSYS/webserver/bin
Copy old/bin/wrapper-linux-x86-64 to new $AUTOSYS/webserver/bin
Copy old/lib/libwrapper* to new $AUTOSYS/webserver/lib
Copy old/lib/wrapper.jar to new $AUTOSYS/webserver/lib
Copy old/conf/Tomcat-wrapper-license.conf to new $AUTOSYS/webserver/conf
Copy old/conf/wrapper.conf to new $AUTOSYS/webserver/conf
4. Change new $AUTOSYS/webserver/conf/server.xml to contain below XML tag under org.apache.coyote.http11.Http11NioProtocol:
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" SSLEnabled="true" acceptCount="100"
maxThreads="400" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" relaxedQueryChars="|<>"
ciphers="SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA,
TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA,
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA" />
5.Change the owner and permissions of webserver similar to old