Method 2: Enabling HSTS When Manually Upgrading or When Not Upgrading

Technical Articles
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

Perform these steps if:

  • You are manually upgrading to Jamf Pro 10.44.0 or later.

  • You are delaying upgrading to Jamf Pro 10.44.0 or later.

  • You plan to remain on your installed version of Jamf Pro (10.4.0–10.43.x).

To enable HSTS for these scenarios, you must edit three elements in the Apache Tomcat web.xml file.

Requirements

Jamf Pro 10.4.0–10.43.x

  1. Stop Tomcat. For instructions, see the Starting and Stopping Tomcat article.
  2. Locate and open the web.xml file in a text editor:

    • Linux: /usr/local/jss/tomcat/conf/web.xml

    • Windows: C:\Program Files\JSS\Tomcat\conf\web.xml

  3. Find the commented out httpHeaderSecurity <filter> element and replace it as shown below:
    Before:
    <!--
    <filter>
        <filter-name>httpHeaderSecurity</filter-name>
        <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
        <async-supported>true</async-supported>
    </filter>
-->
    After:
    <filter>
    <filter-name>httpHeaderSecurity</filter-name>
    <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
    <init-param>
        <param-name>hstsEnabled</param-name>
	<param-value>true</param-value>
    </init-param>
    <init-param>
        <param-name>hstsMaxAgeSeconds</param-name>
        <param-value>31536000</param-value>
    </init-param>
    <init-param>
        <param-name>hstsIncludeSubDomains</param-name>
        <param-value>true</param-value>
    </init-param>
    <init-param>
        <param-name>antiClickJackingEnabled</param-name>
        <param-value>false</param-value>
    </init-param>
    <init-param>
        <param-name>blockContentTypeSniffingEnabled</param-name>
        <param-value>false</param-value>
    </init-param>
    <init-param>
        <param-name>xssProtectionEnabled</param-name>
        <param-value>false</param-value>
    </init-param>
</filter>
  4. Find the commented out httpHeaderSecurity <filter-mapping> element and uncomment it.
    Before:
    <!--
    <filter-mapping>
        <filter-name>httpHeaderSecurity</filter-name>
        <url-pattern>/*</url-pattern>
        <dispatcher>REQUEST</dispatcher>
    </filter-mapping>
-->
    After:
    <filter-mapping>
    <filter-name>httpHeaderSecurity</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>REQUEST</dispatcher>
</filter-mapping>
  5. Find the <session-config> element and insert the following <cookie-config> element.
    <cookie-config>
    <http-only>true</http-only>
    <secure>true</secure>
</cookie-config>
    Before:
    <session-config>
    <session-timeout>30</session-timeout>
</session-config>
    After:
    <session-config>
    <session-timeout>30</session-timeout>
    <cookie-config>
        <http-only>true</http-only>
        <secure>true</secure>
    </cookie-config>
</session-config>
  6. Save and close the web.xml file.
  7. (Optional) If you are upgrading Jamf Pro, continue with the manual upgrading process. For instructions, see the manual upgrading information in the installation and configuration guide for your version of Jamf Pro:
  8. (Optional) If you are not upgrading Jamf Pro and are only enabling HSTS, start Tomcat.