Configuring LiveUpdate Administrator to use HSTS

Products

• Endpoint Protection

Issue/Introduction

This document demonstrates how to enable HTTP Strict Transport Security (HSTS) in the Symantec LiveUpdate Administrator (LUA).

Resolution

Requirements

• The LUA must be using a 3rd party certificate. 
  • Self-signed certificate (the default LUA configuration) does not support HSTS.
  • Follow the steps from Replace LiveUpdate Administrator certificate to create a new third-party certificate
  • Also refer to these documents as applicable:
    Customizing which protocols and/or ciphers are used by LiveUpdate Administrator
    Changing the communications protocol to either HTTP or HTTPS
  • The root certificate must be installed in the Trusted Root Certification Authorities on the server where LUA is installed.

Steps to enable HSTS:

1. Stop the LUA Apache Tomcat Service.
   
   
2. Open the web.xml configuration file (Default Path: C:\Program Files (x86)\Symantec\LiveUpdate Administrator\tomcat\conf) with a text editor.
   Navigate to the section “Built in Filter Definitions”.
   The first filter is httpHeaderSecurity, which is commented out. On the next line below the closing comment (-->) copy and paste the following filter configuration.
   
   

   [
   <filter>
       <filter-name>httpHeaderSecurity</filter-name>
       <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
         <init-param>
             <param-name>hstsEnabled</param-name>
             <param-value>true</param-value>
        </init-param>
        <init-param>
             <param-name>hstsMaxAgeSeconds</param-name>
             <param-value>31536000</param-value>
        </init-param>
        <init-param>
             <param-name>hstsIncludeSubDomains</param-name>
             <param-value>true</param-value>
        </init-param>
        <async-supported>true</async-supported>
   </filter>
   ]

3. Navigate to the section “Built in Filter Mappings".  The first filter is httpHeaderSecurity, it is commented out. On the next line below the closing comment (-->), copy and paste the following filter-mapping configuration.
   
   

   [
   <filter-mapping>
       <filter-name>httpHeaderSecurity</filter-name>
       <url-pattern>/*</url-pattern>
       <url-pattern>*</url-pattern>
       <dispatcher>REQUEST</dispatcher>
   </filter-mapping>
   ]

4. Start the LUA Apache Tomcat Service.
   
   
5. Verify that the LUA web console is working by logging into the UI.

Note: It is recommended to verify the steps in a Test/UAT Environment before implementing in Production.

Additional Information

For LUA versions below 2.3.13 Apache Tomcat 8 Configuration Reference

For LUA 2.3.13 and above with Apache Tomcat version 9.0.90 Apache Tomcat 9 Configuration Reference