Disabling Symantec Endpoint Protection Manager's HTTP Port 9090

Products

• Endpoint Protection

Issue/Introduction

Vulnerability scanners may flag SEPM's HTTP port 9090 as an "unencrypted administrative interface", since it responds over plain HTTP. 

What Port 9090 Actually Does

Port 9090 does not serve the SEPM administrative console, and no login, session, or administrative traffic ever travels over it. It serves a single static landing page whose only two functions are:

• Providing a download link for the legacy remote Java console package.
• Providing a download link for the SEPM server's SSL certificate, so an administrator's browser or OS can be set up to trust the HTTPS console at port 8443 before connecting to it.

No credentials are entered, no session is established, and no confidential or customer data is transmitted or displayed on this page. The actual console, where authentication, session cookies, and administrative actions occur is served exclusively over HTTPS on port 8443.

If your organization requires port 9090 to be closed, this article outlines the steps to disable it.

Environment

Symantec Endpoint Protection Manager 14.x

Resolution

Step 1: Backup the SSL Certificate

Disabling port 9090 will remove access to its landing page and the easy certificate download link. Before proceeding, download the SEPM server's SSL certificate from the 9090 landing page and distribute it to any admin workstations that need to trust the HTTPS console.

• Note: If you skip this, you can still retrieve the certificate later by navigating to https://<hostname>:8443/, accepting the browser's security warning, and manually exporting the certificate from your browser.

Step 2: Disabling Port 9090

1. Create a backup copy of <install path>\Symantec Endpoint Protection Manager\tomcat\conf\server.xml
2. Open server.xml in a text editor.
3. Locate the two <Connector .../> elements with port="9090" (one for IPv4, address="0.0.0.0", and one for IPv6, address="::0"). Comment out both elements by wrapping them in <!-- and -->
4. Save the file.
5. Restart the Symantec Endpoint Protection Manager service (semsrv).
6. After this change, you will need to access the console directly via HTTPS
   • https://<hostname or IP as it appears in the SEPM certificate>:8443/console/apps/sepm

Step 3: Update the Start Menu Shortcut:

Disabling port 9090 will break the Start Menu shortcut for the web console. To resolve this perform the following steps:

1. Open <install path>\Symantec\Symantec Endpoint Protection Manager\bin\weburl.bat with a text editor
2. Change the content from start http://localhost:9090 to start https://localhost:8443