4.10 Default Security Settings in Configuration Files

4.10.1 ESP web.xml

Linux: /opt/novell/nam/mag/webapps/nesp/WEB-INF/

Windows: \Program Files\Novell\Tomcat\webapps\nesp\WEB-INF

<context-param>
    	<param-name>phishingCheck</param-name>
    <param-value>standard</param-value>
</context-param>

<welcome-file-list>
	    <welcome-file>index.html</welcome-file>
</welcome-file-list>

<error-page>
	    <error-code>500</error-code>
    <location>/index.html</location>
</error-page>

<filter>
	    <filter-name>TomcatSameOriginFilter</filter-name>
    <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter
    </filter-class>
  
<init-param>
    <param-name>antiClickJackingOption</param-name>
		    <param-value>SAMEORIGIN</param-value>
</init-param>
</filter>

<filter-mapping>
    	<filter-name>TomcatSameOriginFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

4.10.2 Access Gateway Advanced Options

SSLProtocol TLSv1.1 +TLSv1.2

SSLCipherSuite !aNULL:!eNULL:!EXPORT:!DSS:!DES:!RC4:ALL:!EDH

4.10.3 httpd.conf

Linux: /etc/opt/novell/apache2/conf

Windows: C:\Program Files\Novell\apache\conf

The mod_headers library is enabled.

Linux: LoadModule headers_module libexec/mod_headers.so

Windows: LoadModule headers_module modules/mod_headers.so

4.10.4 NovellAgSettings.conf

Linux: /etc/opt/novell/apache2/conf

Windows: C:\Program Files\Novell\apache\conf

The header set directive for the HSTS header is added at the bottom of the file:Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"