WebInspect Enterprise 10.10 Installation process Hans Enders / January 2014

This visual walk-through is meant to augment the WebInspect Enterprise Implementation Guide and WebInspect Enterprise Installation Guide, not to replace them. Those guides offer many more details on the topics covered here. Guides resource: https://download.hpsmartupdate.com/wie/

Sections:. Preliminary Requirements. Systems & Accounts Needed Sections: Preliminary Requirements Systems & Accounts Needed IIS Configuration .NET Configuration Install Manager (Server) Server Initialization Install Console Configure Sensor

Some things needed: MS SQL Server prepared and running for the WebInspect Enterprise database. Specs: https://download.hpsmartupdate.com/wie/ Install HP SSC Server first, as its URL is required for the Initialization phase. Need the fortify.license file for this. WebInspect Enterprise Activation Token (license) before running the WebInspect Enterprise Initialization. Can install the Server and Console components without this. One or more remote workstations that will serve as the scanning Sensor machines. Install: https://download.hpsmartupdate.com/webinspect/ May use SQL Express 2008 R2 on localhost ,or plan to have additional databases on a shared SQL environment. No Sensor license is needed, it is a feature of the Server’s license. WebInspect desktop licenses cannot be applied for Sensors.

Accounts needed: Windows services account and administrator: Admin-level Windows OS account on the Manager server used to run the background Windows service(s) for the WebInspect Enterprise Manager. Best used for the installation as well. For this installation, do not attempt to use the Run As Admin feature in Windows. e.g. wieadmin Database Owner: Account that is DBO to the planned WebInspect Enterprise database. WebInspect Enterprise will also retain this account for daily use interfacing with this database. This SQL account needs the DB Creator permission unless the SA has previously created a blank WIE DB for the installer to use. This SQL account can be the same Windows account used for running the WIE services (above), or it can be a pure SQL account. The SA account is specifically restricted from being used for this role. e.g. wieadmin, wie-sql-admin Sensor User: User-level Windows account used only for remote Sensors to authenticate to the Manager server component. Can be a network service account or a Local User account on the WebInspect Enterprise Manager machine. e.g. wiesensoruser

Accounts needed: Sensor administrative account: For each remote Sensor machine, the user will need a local Windows Administrator account for installing the software as well as for running the background Windows service that is the Sensor during operation, i.e. “WebInspect Sensor Service”.

SSC server accounts needed: SSC administrative account: General administrative account defined within the HP SSC server. Will be specified during WIE Initialization. Becomes the first/fallback administrator account in the WebInspect Enterprise UI. e.g. admin, sscadmin WIE service account: Account that only holds the WebInspect Enterprise Role. Used by WebInspect Enterprise to interface with the HP SSC component. This account should not be used to log into the UI for WIE nor SSC. Can be the SSC admin account discussed above, although this is not recommended. e.g. wieservice WIE day-to-day administrative account: Account within SSC that will be used for administering within the WIE UI. First WIE login will be with the SSC admin account, but then add this WIE admin account to the necessary WIE admin Roles. The primary SSC admin account will then be used as a fallback safety only. If linked to LDAP during a POV, this account can be the primary user’s network logon. e.g. wieadmin

Some warnings for 10.10: The SSC Server URL must end in “/ssc”, otherwise WIE 10.10 may have difficulty locating it for bonding and synchronization. If you configured SSC as something else, e.g. “/fortifyssc”, you will need to go change that configuration before continuing with the WebInspect Enterprise Initialization phase described later. Edit the HOSTS files for your SSC and WIE Server machines, such that: each identifies the other by full name the local machine’s name should also be specified Do not attempt to install these products using the Run As Administrator feature, use an actual Administrator account. You can ignore this advice, but it will save you lots of small cases of aggravation and do-over.

Some warnings for 10.10: During the WebInspect Enterprise Initialization process, pay close attention to the host name displayed for the selected certificate. This name will have to be used throughout the configuration screens and by the user community. Correct or create the certificate in WebInspect Enterprise Initialization if the default name will cause troubles. For both SSC and WebInspect Enterprise, it is best to not use the host name “localhost” for connections. Use the actual machine name, and particularly for WebInspect Enterprise use the one that had been displayed for its SSL certificate. Ensure there are HOSTS file entries matching these names. Update or distribute user community Bookmarks and instructions that match these names.

For our install, we added the installer’s Windows administrator account to the SQL server, e.g. hpswadm

The SQL connection account for WebInspect Enterprise will need these permissions for the planned WIE database.

Sections:. Preliminary Requirements. Systems & Accounts Needed Sections: Preliminary Requirements Systems & Accounts Needed IIS Configuration .NET Configuration Install Manager (Server) Server Initialization Install Console Configure Sensor

Enabling IIS on Windows 2008 R2

Defaults before configuration, page 1 of 2

Defaults before configuration, page 2 of 2

Enable the following…

Dynamic Compression is optional.

IIS is now prepped for WebInspect Enterprise, but not yet configured.

This error during the installation indicates that IIS has not had its This error during the installation indicates that IIS has not had its .NET 4.0 configured yet.

Sections:. Preliminary Requirements. Systems & Accounts Needed Sections: Preliminary Requirements Systems & Accounts Needed IIS Configuration .NET Configuration Install Manager (Server) Server Initialization Install Console Configure Sensor

Microsoft .NET 4.0 Framework must be installed before configuring this part.

Note that these ISAPI filters Note that these ISAPI filters .NET entries here can be created automatically by running “aspnet_regiis.exe –i” from the command line within the respective 4.0 folders. Run from both the 32-bit and 64-bit folder to be sure. The WebInspect Enterprise Implementation Guide details this. If 4.0 is not listed, use the Add button found in the right-hand pane. There must be two pointers for 4.0: one for the \Framework64\ folder and one for the \Framework\ folder (32-bit). 4.0 uses paths very similar to those shown for v2.0. May use full paths with drive letters or the same “%windir%\” variable as shown for the two v2.0 entries.

.NET 4.0 is now prepped for WebInspect Enterprise

Sections:. Preliminary Requirements. Systems & Accounts Needed Sections: Preliminary Requirements Systems & Accounts Needed IIS Configuration .NET Configuration Install Manager (Server) Server Initialization Install Console Configure Sensor

Begin with installing the Manager (server) component

Windows Start Menu post-install

Sections:. Preliminary Requirements. Systems & Accounts Needed Sections: Preliminary Requirements Systems & Accounts Needed IIS Configuration .NET Configuration Install Manager (Server) Server Initialization Install Console Configure Sensor

The WebInspect Enterprise server Initialization program starts automatically after the Manager install completes, or it may be launched from the Windows Start Menu any time a reconfiguration is required

This link is new with 10.10. It opens the User Guide PDF.

Configure the proxy settings as needed to reach the Internet. Specifically: https://licenseservice.hpsmartupdate.com

Option for isolated machines Offline Activation is detailed in other materials.

Privacy Notice link contents: C:\Program Files\HP\HP WebInspect Enterprise 10.10\Initializer\PrivacyPolicy.htm

Verify the CN name matches the Host name Verify the CN name matches the Host name. See the warning at the start of this guide.

Generally, this would be the current Windows user account who is running this installation. This will also be the first/only WIE logon to start with. Best Practice is to later set up other admin accounts and use this one only as a back-up WIE administrator. This account will also run the Windows services used by WebInspect Enterprise.

Cannot be the sa account.

“sa” is not permitted, but a DBO account for the specified DB is fine

Notice the use of the full Host name and not “localhost” Notice the use of the full Host name and not “localhost”. This prevents confusion in their SSL communication later.

Best Practice is to use two separate accounts.

This message occurred because we were re-using an existing WebInspect Enterprise database.

Now we can proceed…

Natural error from using a self-signed certificate for SSL…

Can specify Sensor User accounts now, or in the Console later.

Creating the Sensor’s authentication account.

Sensor authentication account is just a plain User.

(HP SSC Administrative account)

WebInspect Enterprise should have several Windows services running now.

Sections:. Preliminary Requirements. Systems & Accounts Needed Sections: Preliminary Requirements Systems & Accounts Needed IIS Configuration .NET Configuration Install Manager (Server) Server Initialization Install Console Configure Sensor

Now install the (mostly administrative) Console component

Windows Start Menu

Sections:. Preliminary Requirements. Systems & Accounts Needed Sections: Preliminary Requirements Systems & Accounts Needed IIS Configuration .NET Configuration Install Manager (Server) Server Initialization Install Console Configure Sensor

When installing Sensor component, wizard permits configuration

However, best Sensor configuration is via the ASC Monitor System Tray icon Windows Start Menu…

Normal-looking configuration when using SQL Express as the scan repository…

If Sensor will be using SQL Server rather than SQL Express…

Once the Sensor connects, the WIE admin needs to Enable it in Console

Once Enabled, the Sensor is ready for use The WIE admin will still need to add the Sensor(s) to the Resources tabs for the various Groups defined under Roles & Permissions…

Outcomes That Matter