Deployment GuideInstallation and Configuration of Scan Central on Fortify 20.1.0 Fortify SSC 20.xAuthor: Vikas JohariDate: 01 August 2020Document Version: v0.1ContentsContents (2)Installing ScanCentral Controller (3)Configuring ScanCentral in SSC (8)Configuring ScanCentral Sensor (10)Configuring the ScanCentral Client (13)Running a Simple Sample Scan using Build Tool (14)Running a Sample Scan from Visual Studio 2019 (15)Configuring Jenkins Project to use ScanCentral (20)Running a Sample Scan and uploading to SSC (23)Installing ScanCentral ControllerIn the Download folder extract ScanCentral Controller zip file.Unzip the Fortify_ScanCentral_Controller_20.1.0_x64.zip.Move the "Fortify_ScanCentral_Controller_20.1.0_x64" folder to C:\Program Files\Fortify folder.Open the folder.Open server.xml of tomcat\conf folder in Notepad++.Note: In this server SSC and Jenkins is already running on port 8080 so, we need to change port of ScanCentral components i.e. 8280 else there will be a port conflict.Find the server port 8005, and change it to 8205.Find the port Connector port 8080 and change it to 8280.Note: In case you are planning to use SSL Port then make sure port 8443 is also change to some other non conflicting port.Save the file.Open the C:\ProgramFiles\Fortify\Fortify_ScanCentral_Controller_20.1.0_x64\tomcat\webapps\scancentra l-ctrl\WEB-INF\classes\config.properties file in Notepad++.Locate and fix the URLs.Save the File.Open CMD in ScanCentral_Controller's tomcat\bin folder. Make sure CMD is having Adminstrator privilidge.Run the command –> service.bat install ScanCentralControllerOpen services.mscFind the new Apache Tomcat 9.0 ScanCentralController service.Make this service Automatic (Delayed Start).In Log On, change to "Local System account" and Enable "Allow service to interact with desktop".Start the service.Start the Browser and connect to port 8280. The URL will be :8280/scancentral-ctrlThis message indicates that Fortify ScanCentral Controller is working. Configuring ScanCentral in SSCNow open SSC and login as admin.Open Administration -> Configuration -> ScanCentral.Enable the ScanCentral.In the ScanCentral URL: :8280/scancentral-ctrlThe Poll Period: 30 secondsShared Secret: changemeClick Save.Note: if you want to use different Shared Secret then make the changes in the below file –Restart SSC's Tomcat.Login into SSC and click on SCANS -> Controller.Validate that the information from the config file displays in the screen.Configuring ScanCentral SensorNow configure the Sensor –Create a file as "C:\ProgramFiles\Fortify\Fortify_SCA_and_Apps_20.1.0\Core\config\worker.properties" and enter the text as above.Note: if you want to change the different token then you need to first change in the controllerconfig.properties file then on worker.properties.Go to the folder "C:\ProgramFiles\Fortify\Fortify_SCA_and_Apps_20.1.0\bin\scancentral-worker-service" open CMD as Administrator.Create a folder named C:\ScanCentralWorkdirThe command will be -setupworkerservice.bat 20.1.0 :8280/scancentral-ctrl CHANGEME123!Type "Y" and hit Enter key.Open Services.mscOpen Properties of the FortifyScancentralWorkerServiceSet the Startup type as "Automatic (Delayed Start).In Log On -> Local System account and Allow service to interact with desktop. Click OK and Start the Service.Open SSC go to SCANS -> Sensors.Check the State of it.The Active State indicates that the sensor is running fine.Configuring the ScanCentral ClientOpen the "C:\ProgramFiles\Fortify\Fortify_SCA_and_Apps_20.1.0\Core\config\client.properties" and update the client_auth_token value as per the C:\ProgramFiles\Fortify\Fortify_ScanCentral_Controller_20.1.0_x64\tomcat\webapps\scancentra l-ctrl\WEB-INF\classes\config.properties file.Running a Simple Sample Scan using Build ToolChange the folder toC:\Program Files\Fortify\Fortify_SCA_and_Apps_20.1.0\plugins\maven\maven-plugin-src\samples\EightBall using CMD to test ScanCentral client.Run the below command to use mavan as build tool –scancentral -url :8280/scancentral-ctrl start -bt mvnWait for the message "Submitted job and received token: .."Go back to SSC -> SCANS -> Scan Requests.Validate the Build ID and Job token and Status of the job. Wait for few min let it to complete.can be download from EXPORT dropdown.The FPR file can be opened in AWB.Running a Sample Scan from Visual Studio 2019Open Riches DotNet Solution in Visual Studio 2019 -> Extensions -> Fortify -> Options -> ScanCentralSettings.Configure the ScanCentral Settings.Open SSC -> Administration -> Users -> Token Management.Click New.Select the ScanCentralCtrlToken, enter a description, click Save.Copy and Save the Tokens in the safe place. Click Close.Create a new version "5.0" for Visual Studio of Riches DotNet Application. The FPR file from Visual Studio's ScanCentral will be uploaded on version 5.0.Go back to Visual Studio.Enable the Send Scan Results to SSC and enter the Controler Token. Click OK.Extensions -> Fortify -> Upload Solution to ScanCentral.Enter the credentials of SSC and click OK.Select 5.0, click OK.The plugin will display the confirmation along with the Job token. Click OK to close the window. Open SSC -> SCANS -> Scan Requests.The RichesDotNet job will appear in few seconds, hit Fefresh if it is not visible.Wait for it to complete.ScanCentral will upload the FRP into the Application version. Validate in the application version -> Artifact.FPR file will be uploaded there.Configuring Jenkins Project to use ScanCentralIn SSC, create a new version "6.0" of Riches DotNet Application.Open Jenkins -> Manage Jenkins -> Configure System, scroll down to the end of the page.Validate that the SSC URL is configured and Controller URL is blank and non editable. Because this plugin expects the ScanCentral should be configured before configuring Jenkins plugin.Lets use the workaround.Remove the SSC URL, now Controller URL will be active, now enter the Controller URL, Controller Token and then SSC URL.Test SSC Connection and Test Controller Connection.Click Save.Create a new Jenkins Project named "Riches DotNet via ScanCentral", and select Copy from "Riches DotNet via GitLab" Project. This option is in the bottom of the screen.In the Post Build Action -> Fortify Assessment, select the below options –Save and run the Project.If everything goes well then the Scan job will be submitted to ScanCentral and the token will be received.Note: The logic gate will not work with ScanCentral, that’s why option for Logic Gate will be missing at this point and you will need to create them later in the software lifecycle. Since the goal with ScanCentral is to perform asynchronous scans in a way that the build pipeline does not have to wait for it to finish.Now check the Scan Requests in SSC –version.Running a Sample Scan and uploading to SSCCreate a new Application named "WebGoat for ScanCentral" version "5.0".Run the fortifyclient command to extract the list of application -fortifyclient -url :8080/ssc -authtoken db796568-9a96-4611-82d9-9a9954902087 listApplicationVersionsNote: The token generated in section "Running a Sample Scan from Visual Studio 2019" should be used.Create the build using –cd "C:\ProgramFiles\Fortify\Fortify_SCA_and_Apps_20.1.0\Samples\advanced\webgoat"sourceanalyzer -b WebGoat_via_ScanCentral -cleansourceanalyzer -b WebGoat_via_ScanCentral -source 1.5 -cp"WebGoat5.0/WebContent/WEB-INF/lib/*.jar" WebGoat5.0/JavaSourceWebGoat5.0/WebContentSubmit the scan using –scancentral -url :8280/scancentral-ctrl start -upload –-application "WebGoat for ScanCentral" --application-version "5.0" -bWebGoat_via_ScanCentral -uptoken db796568-9a96-4611-82d9-9a9954902087 -scan -Xmx2GScan is submitted to ScanCentral -Validate the Scan in Scan Requests. When status changed to "Upload Completed"< !! End of the Document !! >。
控制台怎么打开
打开控制台的方法取决于您使用的操作系统和要打开的控制台类型。
以下是在不同操作系统上打开不同类型的控制台的常见方法：
1. Windows 操作系统:
- 命令提示符(Command Prompt):
- 按下`Win + R`，然后输入`cmd` 并按Enter 键。
- 或者在开始菜单中搜索"命令提示符" 并点击打开。
- PowerShell 控制台:
- 按下`Win + R`，然后输入`powershell` 并按Enter 键。
- 或者在开始菜单中搜索"PowerShell" 并点击打开。
- Windows Terminal (如果已安装):
- 在开始菜单中搜索"Windows Terminal" 并点击打开。
2. macOS 操作系统:
- 终端(Terminal):
- 打开"应用程序" 文件夹，然后进入"实用工具" 文件夹，找到并点击"终端"。
3. Linux 操作系统:
- 大多数Linux 发行版上都有一个终端应用程序，可以在应用程序菜单中找到。
您也可以使用快捷键`Ctrl + Alt + T` 打开终端。
请注意，具体的命令行工具和控制台类型可能因操作系统和发行版而异。
上述方法适用于常见的情况，但可能因个体情况而异。
如果您使用的是特定的控制台或集成开发环境（IDE），请查阅相关文档以了解如何打开控制台。
