1. WebInspect Enterprise 10.10 Installation process
Hans Enders / January 2014

2. This visual walk-through is meant to augment the WebInspect Enterprise Implementation Guide and WebInspect Enterprise Installation Guide, not to replace them. Those guides offer many more details on the topics covered here.
Guides resource:

3. Sections:. Preliminary Requirements. Systems & Accounts Needed
Sections: Preliminary Requirements Systems & Accounts Needed IIS Configuration .NET Configuration Install Manager (Server) Server Initialization Install Console Configure Sensor

4. Some things needed:
MS SQL Server prepared and running for the WebInspect Enterprise database.
Specs:
Install HP SSC Server first, as its URL is required for the Initialization phase.
Need the fortify.license file for this.
WebInspect Enterprise Activation Token (license) before running the WebInspect Enterprise Initialization. Can install the Server and Console components without this.
One or more remote workstations that will serve as the scanning Sensor machines.
Install:
May use SQL Express 2008 R2 on localhost ,or plan to have additional databases on a shared SQL environment.
No Sensor license is needed, it is a feature of the Server’s license.
WebInspect desktop licenses cannot be applied for Sensors.

5. Accounts needed:
Windows services account and administrator: Admin-level Windows OS account on the Manager server used to run the background Windows service(s) for the WebInspect Enterprise Manager. Best used for the installation as well. For this installation, do not attempt to use the Run As Admin feature in Windows.
e.g. wieadmin
Database Owner: Account that is DBO to the planned WebInspect Enterprise database. WebInspect Enterprise will also retain this account for daily use interfacing with this database. This SQL account needs the DB Creator permission unless the SA has previously created a blank WIE DB for the installer to use. This SQL account can be the same Windows account used for running the WIE services (above), or it can be a pure SQL account. The SA account is specifically restricted from being used for this role.
e.g. wieadmin, wie-sql-admin
Sensor User: User-level Windows account used only for remote Sensors to authenticate to the Manager server component. Can be a network service account or a Local User account on the WebInspect Enterprise Manager machine.
e.g. wiesensoruser

6. Accounts needed:
Sensor administrative account: For each remote Sensor machine, the user will need a local Windows Administrator account for installing the software as well as for running the background Windows service that is the Sensor during operation, i.e. “WebInspect Sensor Service”.

7. SSC server accounts needed:
SSC administrative account: General administrative account defined within the HP SSC server. Will be specified during WIE Initialization. Becomes the first/fallback administrator account in the WebInspect Enterprise UI.
e.g. admin, sscadmin
WIE service account: Account that only holds the WebInspect Enterprise Role. Used by WebInspect Enterprise to interface with the HP SSC component. This account should not be used to log into the UI for WIE nor SSC. Can be the SSC admin account discussed above, although this is not recommended.
e.g. wieservice
WIE day-to-day administrative account: Account within SSC that will be used for administering within the WIE UI. First WIE login will be with the SSC admin account, but then add this WIE admin account to the necessary WIE admin Roles. The primary SSC admin account will then be used as a fallback safety only. If linked to LDAP during a POV, this account can be the primary user’s network logon.
e.g. wieadmin

8. Some warnings for 10.10:
The SSC Server URL must end in “/ssc”, otherwise WIE may have difficulty locating it for bonding and synchronization.
If you configured SSC as something else, e.g. “/fortifyssc”, you will need to go change that configuration before continuing with the WebInspect Enterprise Initialization phase described later.
Edit the HOSTS files for your SSC and WIE Server machines, such that:
each identifies the other by full name
the local machine’s name should also be specified
Do not attempt to install these products using the Run As Administrator feature, use an actual Administrator account.
You can ignore this advice, but it will save you lots of small cases of aggravation and do-over.

9. Some warnings for 10.10:
During the WebInspect Enterprise Initialization process, pay close attention to the host name displayed for the selected certificate.
This name will have to be used throughout the configuration screens and by the user community.
Correct or create the certificate in WebInspect Enterprise Initialization if the default name will cause troubles.
For both SSC and WebInspect Enterprise, it is best to not use the host name “localhost” for connections. Use the actual machine name, and particularly for WebInspect Enterprise use the one that had been displayed for its SSL certificate.
Ensure there are HOSTS file entries matching these names.
Update or distribute user community Bookmarks and instructions that match these names.

10. For our install, we added the installer’s Windows administrator account to the SQL server, e.g. hpswadm

11. The SQL connection account for WebInspect Enterprise will need these permissions for the planned WIE database.

12. Sections:. Preliminary Requirements. Systems & Accounts Needed
Sections: Preliminary Requirements Systems & Accounts Needed IIS Configuration .NET Configuration Install Manager (Server) Server Initialization Install Console Configure Sensor

13. Enabling IIS on Windows 2008 R2

16. Defaults before configuration, page 1 of 2

17. Defaults before configuration, page 2 of 2

18. Enable the following…

20. Dynamic Compression is optional.

25. IIS is now prepped for WebInspect Enterprise, but not yet configured.

26. This error during the installation indicates that IIS has not had its
This error during the installation indicates that IIS has not had its .NET 4.0 configured yet.

27. Sections:. Preliminary Requirements. Systems & Accounts Needed
Sections: Preliminary Requirements Systems & Accounts Needed IIS Configuration .NET Configuration Install Manager (Server) Server Initialization Install Console Configure Sensor

28. Microsoft .NET 4.0 Framework must be installed before configuring this part.

35. Note that these ISAPI filters
Note that these ISAPI filters .NET entries here can be created automatically by running “aspnet_regiis.exe –i” from the command line within the respective 4.0 folders. Run from both the 32-bit and 64-bit folder to be sure. The WebInspect Enterprise Implementation Guide details this.
If 4.0 is not listed, use the Add button found in the right-hand pane. There must be two pointers for 4.0: one for the \Framework64\ folder and one for the \Framework\ folder (32-bit).
4.0 uses paths very similar to those shown for v2.0. May use full paths with drive letters or the same “%windir%\” variable as shown for the two v2.0 entries.

36. .NET 4.0 is now prepped for WebInspect Enterprise

37. Sections:. Preliminary Requirements. Systems & Accounts Needed
Sections: Preliminary Requirements Systems & Accounts Needed IIS Configuration .NET Configuration Install Manager (Server) Server Initialization Install Console Configure Sensor

38. Begin with installing the Manager (server) component

48. Windows Start Menu post-install

49. Sections:. Preliminary Requirements. Systems & Accounts Needed
Sections: Preliminary Requirements Systems & Accounts Needed IIS Configuration .NET Configuration Install Manager (Server) Server Initialization Install Console Configure Sensor

50. The WebInspect Enterprise server Initialization program starts automatically after the Manager install completes, or it may be launched from the Windows Start Menu any time a reconfiguration is required

51. This link is new with 10.10. It opens the User Guide PDF.

53. Configure the proxy settings as needed to reach the Internet.
Specifically:

54. Option for isolated machines
Offline Activation is detailed in other materials.

55. Privacy Notice link contents:
C:\Program Files\HP\HP WebInspect Enterprise 10.10\Initializer\PrivacyPolicy.htm

71. Verify the CN name matches the Host name
Verify the CN name matches the Host name. See the warning at the start of this guide.

72. Generally, this would be the current Windows user account who is running this installation.
This will also be the first/only WIE logon to start with. Best Practice is to later set up other admin accounts and use this one only as a back-up WIE administrator.
This account will also run the Windows services used by WebInspect Enterprise.

74. Cannot be the sa account.

75. “sa” is not permitted, but a DBO account for the specified DB is fine

76. Notice the use of the full Host name and not “localhost”
Notice the use of the full Host name and not “localhost”. This prevents confusion in their SSL communication later.

77. Best Practice is to use two separate accounts.

78. This message occurred because we were re-using an existing WebInspect Enterprise database.

79. Now we can proceed…

82. Natural error from using a self-signed certificate for SSL…

84. Can specify Sensor User accounts now, or in the Console later.

85. Creating the Sensor’s authentication account.

87. Sensor authentication account is just a plain User.

89. (HP SSC Administrative account)

92. WebInspect Enterprise should have several Windows services running now.

93. Sections:. Preliminary Requirements. Systems & Accounts Needed
Sections: Preliminary Requirements Systems & Accounts Needed IIS Configuration .NET Configuration Install Manager (Server) Server Initialization Install Console Configure Sensor

94. Now install the (mostly administrative) Console component

102. Windows Start Menu

103. Sections:. Preliminary Requirements. Systems & Accounts Needed
Sections: Preliminary Requirements Systems & Accounts Needed IIS Configuration .NET Configuration Install Manager (Server) Server Initialization Install Console Configure Sensor

104. When installing Sensor component, wizard permits configuration

106. However, best Sensor configuration is via the ASC Monitor System Tray icon
Windows Start Menu…

107. Normal-looking configuration when using SQL Express as the scan repository…

108. If Sensor will be using SQL Server rather than SQL Express…

115. Once the Sensor connects, the WIE admin needs to Enable it in Console

118. Once Enabled, the Sensor is ready for use
The WIE admin will still need to add the Sensor(s) to the Resources tabs for the various Groups defined under Roles & Permissions…

119. Outcomes That Matter