4.12 Default Security Settings in Configuration Files

4.12.1 ESP web.xml

<context-param>
      <param-name>phishingCheck</param-name>
    <param-value>standard</param-value>
</context-param>

<welcome-file-list>
      <welcome-file>index.html</welcome-file>
</welcome-file-list>

<error-page>
      <error-code>500</error-code>
    <location>/index.html</location>
</error-page>

<filter>
      <filter-name>TomcatSameOriginFilter</filter-name>
    <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter
    </filter-class>
 
<init-param>
    <param-name>antiClickJackingOption</param-name>
        <param-value>SAMEORIGIN</param-value>
</init-param>
</filter>

<filter-mapping>
      <filter-name>TomcatSameOriginFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

You can modify this file using Advanced File Configurator. See Advanced File Configurator in the NetIQ Access Manager Appliance CE 24.2 (v5.1) Administration Guide.

4.12.2 Access Gateway Advanced Options

SSLProtocol TLSv1.1 +TLSv1.2

SSLCipherSuite !aNULL:!eNULL:!EXPORT:!DSS:!DES:!RC4:ALL:!EDH

4.12.3 httpd.conf

The mod_headers library is enabled.

LoadModule headers_module libexec/mod_headers.so

You can modify this file using Advanced File Configurator. See Advanced File Configurator in the NetIQ Access Manager Appliance CE 24.2 (v5.1) Administration Guide.

4.12.4 NovellAgSettings.conf

The header set directive for the HSTS header is added at the bottom of the file:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

You can modify this file using Advanced File Configurator. See Advanced File Configurator in the NetIQ Access Manager Appliance CE 24.2 (v5.1) Administration Guide.