On-Premise-Specific Settings

Technical Articles

Solution

Application

Content Type

Technical Documentation

Utilities & Services

ft:locale

en-US

Server OS

You can host Jamf Pro on any server that meets the requirements listed on the Jamf Pro System Requirements page of the Jamf Pro Release Notes.

Note:

Although you can install Jamf Pro on any server that meets the minimum requirements, the Jamf Pro Installers for Linux and Windows have additional requirements. For more information, see the Jamf Pro Installation and Configuration Guide for your platform.

To further secure the server OS, consider the following system settings recommendations:

Disable guest access
Disable automatic login
Remove unnecessary service accounts
Remove or reset all default passwords
Restrict account privileges to minimum required
Restrict processes to minimum required
Control available ports and network services

Java

The Jamf Pro server and supporting technologies (Apache Tomcat) rely on the Java Development Kit (JDK) with unlimited strength cryptography enabled. For more information about how to install Java, see the Installing Java and MySQL for Jamf Pro 10.14.0 or Later article.

Apache Tomcat

Apache Tomcat is an open-source web server that is developed and maintained by the Apache Software Foundation, and is used to run the Jamf Pro web app. For more information about securing Apache Tomcat, see the Security Considerations documentation from Apache.

The recommendations in this section will help you ensure Apache Tomcat is more secure.

The following table lists the default file paths to the Tomcat files you will need to configure in the instructions that follow.


File	Linux Path	Windows Path
server.xml	/usr/local/jss/tomcat/conf/server.xml	C:\Program Files\JSS\Tomcat\conf\server.xml
ServerInfo.properties	/usr/local/jss/tomcat/webapps/ROOT/WEB-INF/classes/ServerInfo.properties	C:\Program Files\JSS\Tomcat\webapps\ROOT\WEB-INF\classes\ServerInfo.properties
web.xml	/usr/local/jss/tomcat/conf/web.xml	C:\Program Files\JSS\Tomcat\conf\web.xml

Important:

You must restart Tomcat after making modifications to any of these files to make the changes take effect.

Note:

Jamf recommends that you back up any files that you plan to modify before making any changes.

Recommended server.xml modifications

Hide server information and stack traces —
Enhance Tomcat security by hiding server information and stack traces in error pages to prevent the Tomcat version from being reported in error pages and hide stack traces. This involves updating the server.xml file to include the showReport="false" and showServerInfo="false" attributes in the Valve element. Add the following lines to the Host section of the server.xml file:
```
<Valve className="org.apache.catalina.valves.ErrorReportValve" showReport="false" showServerInfo="false"/>
```

Use HTTPS only and disable HTTP —Modify the server.xml file by disabling the non-SSL HTTP Connector.

<!--
<Connector URIEncoding="UTF-8" executor="tomcatThreadPool" port="8080" protocol="HTTP/1.1"
connectionTimeout="20000" maxPostSize="8388608" redirectPort="8443" />
-->

Enable access logging —
To use the default access log valve, uncomment or set the Valve className to "org.apache.catalina.valves.AccessLogValve". You can use the default log values or configure the pattern attribute values by following the instructions in Apache's documentation:
- For Tomcat 10.1, see Extended Access Log Valve in the Apache Tomcat 10 Configuration Reference.
- For Tomcat 9, see Extended Access Log Valve in the Apache Tomcat 9 Configuration Reference.
- For Tomcat 8.5, see Extended Access Log Valve in the Apache Tomcat 8 Configuration Reference.
Prevent Tomcat version via valve modification —
To prevent the Apache Tomcat version from being reported in the response HTTP header, configure the ErrorReportValve attribute in the CATALINA_BASE/conf/server.xml file by following the Valves documentation in the Apache Tomcat User Guide.
Prevent communication over AJP port via connector modification —
To prevent the default AJP port (8009) from becoming accessible to untrusted networks, do one of the following:
- Comment out the AJP connector in the server.xml file and restart the Jamf Pro Tomcat service.
- Disable port 8009 on your firewall.
- Upgrade to Jamf Pro 10.20.0 or later.

Recommended serverInfo.properties modifications

Prevent server version disclosure —To prevent server version disclosure, modify the ServerInfo.properties file using the recommendations in the Valves section in the Apache Tomcat User Guide.

Recommended web.xml modifications

Enable HTTP Strict Transport Security (HSTS) response headers (Jamf Pro 10.4.0–10.43.x) —Jamf recommends that you enable HSTS response headers. HSTS directs web browsers to connect to your Jamf Pro server using only HTTPS. To enable HSTS response headers, you must make one-time changes to the web.xml file if you are upgrading or delaying upgrading to Jamf Pro 10.44.0. For instructions, see the Enabling HSTS for Jamf Pro article.
Note:
New installations of Jamf Pro 10.44.0 or later automatically enable HSTS response headers.
Modify the default error page in the web.xml file —Modify the web.xml file using the recommendations in the web.xml section of the Apache Tomcat User Guide.

MySQL

MySQL is a relational database management system developed and maintained by Oracle. The Jamf Pro server uses MySQL as the back-end database for storing and maintaining system data. You should ensure MySQL is up-to-date and secure by using the following recommendations:

Run the default mysql_secure_installation

The MySQL installation includes the mysql_secure_installation command-line utility, which automates the tasks for securing your MySQL installation. Running mysql_secure_installation allows you to improve the security of your MySQL installation by setting a password for root accounts and removing certain accounts, the test base, and access privileges.

For more information, see the following documentation for your version of MySQL:

If mysql_secure_installation is not available, do the following:

Set a password for the root accounts
Remove all privileges for anonymous user accounts
Remove the test database and all associated privileges

Create a unique database name and a unique MySQL user with a secure password

For more information about how to change the database name and the root MySQL user password, see the Manually Creating the Jamf Pro Database article.

Note:

To increase security, use a unique database name and root MySQL user password that differ from the examples in the article.

Limit privileges to the minimum required

If you want to further restrict access to MySQL, you can create separate user accounts with limited privileges. For more information, see the following webpages:

MySQL 8.4 Reference Manual: Adding Accounts, Assigning Privileges, and Dropping Accounts
MySQL 8.0 Reference Manual: Adding Accounts, Assigning Privileges, and Dropping Accounts

Following is a list of MySQL privileges that are required for different types of environments:

For a standalone web application or the primary node in clustered environments:
- ALTER
- CREATE
- DELETE
- DROP
- INDEX
- INSERT
- LOCK TABLES
- REFERENCES
- SELECT
- UPDATE
For a child node in clustered environments:
- DELETE
- DROP
- INSERT
- LOCK TABLES
- SELECT
- UPDATE
To view connections from cluster nodes with different MySQL users:
- PROCESS
Note:
The PROCESS privilege requires the use of "*.*".

For example, you would execute commands using the following general syntax:

GRANT <privileges> ON <database> TO <user>;

Schedule database backups

For more information, see the Backing Up the Database Using Jamf Pro Server Tools article.

Remove the <DataBasePassword> key or set a blank value

If the database password is removed from the configuration file, the database password must be entered manually for the Jamf Pro server web app during startup. In a clustered environment, the database password must be entered manually for each individual node.

Note:

Default values are included for reference only. Use unique values in production environments.

<DataBase>
...
<DataBaseName>jamfsoftware</DataBaseName>
<DataBaseUser>jamfsoftware</DataBaseUser>
<DataBasePassword></DataBasePassword>
...
</DataBase>

Securing Memcached

There are a number of ways to secure Memcached, depending on your environment. Some examples include:

Not configuring Memcached servers to be accessible externally
Implementing firewall rules to limit traffic between Memcached servers and the Jamf Pro clustered tomcat nodes
Disabling UDP in the memcached.conf file
Using the -l flag to limit traffic to a specific IP

The following excerpt of an example memcached.conf file shows how you might disable UDP and limit traffic to a specific IP:

PORT="11211"
USER="memcached"
# max connection 2048
MAXCONN="2048"
# set ram size to 2048 - 2GiB
CACHESIZE="4096"
# disable UDP and listen to loopback ip 127.0.0.1, for network connection use real ip e.g., 10.0.0.5
OPTIONS="-U 0 -l 127.0.0.1"

For more information, see the Memcached Installation and Configuration for Jamf Pro Environments article.

For more information on which ports are used in a typical Jamf Pro environment, see the Network Ports Used by Jamf Pro article.