Web Services Security Guides › CA SiteMinder® Web Services Security Agent Guide for Apache-based Web Servers › Install and Configure Apache-based Agents on UNIX/Linux

Install and Configure Apache-based Agents on UNIX/Linux

This section contains the following topics:

Agent Installation Compared to Agent Configuration

Set the JRE in the PATH Variable

Apply the Unlimited Cryptography Patch to the JRE

Configure the JVM to Use the JSafeJCE Security Provider

How to Install SiteMinder WSS Agents for Web Servers on UNIX or Linux Systems

How to Install SiteMinder WSS Agents on z/OS Systems

How to Configure SiteMinder WSS Agents on UNIX/Linux

How to Configure SiteMinder WSS Agents on z/OS Systems

Optional Agent Settings for UNIX/Linux

Agent Installation Compared to Agent Configuration

The concepts of installation and configuration have specific meanings when used to describe CA SiteMinder® agents.

Installation means installing the CA SiteMinder® agent software on a computer system. For example, installing an agent creates directories and copies the CA SiteMinder® agent software and other settings to the computer.

Configuration occurs after installation and means the act of preparing the CA SiteMinder® agent software for a specific web server on a computer. This preparation includes registering the agent with CA SiteMinder® Policy Servers, and creating a runtime server instance for the web server that is installed on the computer.

Use the wizard-based installation and configuration programs to install and configure your agent on your first web server. The wizard-based programs create a .properties file.

Use the .properties file and the respective executable file to install or configure the agent silently on additional web servers.

Set the JRE in the PATH Variable

Set the Java Runtime Environment (JRE) in the UNIX system PATH variable.

To set the JRE in the PATH variable

Open a Command Window.
Run the following commands:
```
PATH=$PATH:JRE
export PATH
```
JRE

Defines the location of your Java Runtime Environment bin directory.

Apply the Unlimited Cryptography Patch to the JRE

Patch the Java Runtime Environment (JRE) used by the Agent to support unlimited key strength in the Java Cryptography Extension (JCE) package. The patches for all supported platforms are available from the Oracle website.

The files that need to be patched are:

local_policy.jar
US_export_policy.jar

The local_policy.jar and US_export_policy.jar files can found be in the following locations:

Windows
jre_home\lib\security
UNIX
jre_home/lib/security

jre_home: Defines the location of your Java Runtime Environment installation.

Configure the JVM to Use the JSafeJCE Security Provider

The SiteMinder WSS Agent XML encryption function requires that the JVM is configured to use the JSafeJCE security provider.

Follow these steps:

Add a security provider entry for JSafeJCE (com.rsa.jsafe.provider.JsafeJCE) to the java.security file located in the following location:
- JVM_HOME\jre\lib\security (Windows)
- JVM_HOME/jre/lib/security (UNIX)
JVM_HOME

Is the installed location of the JVM used by the application server.

In the following example, the JSafeJCE security provider entry has been added as the second security provider:
```
security.provider.1=sun.security.provider.Sun
security.provider.2=com.rsa.jsafe.provider.JsafeJCE
security.provider.3=sun.security.rsa.SunRsaSign
security.provider.4=com.sun.net.ssl.internal.ssl.Provider
security.provider.5=com.sun.crypto.provider.SunJCE
security.provider.6=sun.security.jgss.SunProvider
security.provider.7=com.sun.security.sasl.Provider
```
Note: If using the IBM JRE, always configure the JSafeJCE security provider immediately after (that is with a security provider number one higher than) the IBMJCE security provider (com.ibm.crypto.provider.IBMJCE)
Add the following line to JVM_HOME\jre\lib\security\java.security (Windows) or JVM_HOME/jre/lib/security/java.security (UNIX) to set the initial FIPS mode of the JsafeJCE security provider:
```
com.rsa.cryptoj.fips140initialmode=NON_FIPS140_MODE
```
Note: The initial FIPS mode does not affect the final FIPS mode you select for the SiteMinder WSS Agent.

How to Install SiteMinder WSS Agents for Web Servers on UNIX or Linux Systems

Installing CA SiteMinder® agents on the UNIX or Linux operating environments requires several separate procedures. These procedures are described using the following process:

Gather the information that the installation program requires.
Do one of the following procedures:
- Run the installer to install a SiteMinder WSS Agent using a GUI.
- Run the installer to install a SiteMinder WSS Agent using a UNIX console.

Gather the Information for the Installation

Gather the following information about your web server before running the installation program for the CA SiteMinder® agent:

Installation Directory

Specifies the location of the CA SiteMinder® agent binary files on your web server. The web_agent_home variable is set to this location.

Limit: CA SiteMinder® requires the name "webagent" for the bottom directory in the path.

Run the Installer to Install a SiteMinder WSS Agent Using a UNIX Console

Install the SiteMinder WSS Agent using the CA SiteMinder® Web Services Security installation media on the Technical Support site. Consider the following:

Depending on your permissions, you may need to add executable permissions to the install file by running the following command:
```
chmod +x ca-sm-wss-12.52-cr-unix_version.bin
```
cr

Specifies the cumulative release number. The base 12.52 release does not include a cumulative release number.

unix_version

Specifies the UNIX version: sol or linux.
If you execute the CA SiteMinder® Web Services Security installer across different subnets, it can crash. Install CA SiteMinder® Web Services Security components directly on the host system to avoid the problem.

To install the SiteMinder WSS Agent

Exit all applications that are running.
Open a shell and navigate to where the install program is located.
Enter the following command:
```
./ca-sm-wss-12.52-cr-unix_version.bin -i console
```
The CA SiteMinder® Web Services Security installer starts.
Use gathered system and component information to install the SiteMinder WSS Agent. Consider the following as you make your selections:
- When prompted to select what agents to install, select CA SiteMinder® Web Services Security Agent for Web Servers.
- When prompted to select the Java version, the installer lists all Java executables present on the system. Select a supported 32-bit Java Runtime Environment (refer to the Platform Support Matrix on the Technical Support site).
- Do not use space characters in the SiteMinder WSS Agent install path. For example, "/CA Technologies/agent" will result in install failure.
- If the installer detects the presence of an existing CA SiteMinder® Web Agent, it displays a warning dialog stating that the install will upgrade the Web Agent. Click Continue to upgrade the Web Agent to a SiteMinder WSS Agent. If you proceed, the software upgrade occurs in the installed location of the existing Web Agent.
Review the information presented on the Pre-Installation Summary page, then proceed.
Note: If the installation program detects that newer versions of certain system libraries are installed on your system it asks if you want to overwrite these newer files with older files. Select No To All if you see this message.

The SiteMinder WSS Agent files are copied to the specified location. Afterward, the CA CA SiteMinder® Web Services Security Configuration screen is displayed.
Select one of the following options:
- Yes. I would like to configure CA SiteMinder® Web Services Security Agents now.
- No. I will configure CA SiteMinder® Web Services Security Agents later.
Hit Enter.
If you selected the option to configure SiteMinder WSS Agents now, the installation program prepares the CA SiteMinder® Web Services Security Configuration Wizard and begins the trusted host registration and configuration process.

If you did not select the option to configure SiteMinder WSS Agents now or if you are required to reboot the system after installation you must start the configuration wizard manually later.

Installation Notes:

To check if the unattended installation completed successfully, see the CA_SiteMinder_Web_Services_Security_Install_install-date-and-time.log file in WSS_HOME/install_config_info directory. This log file contains the results of the installation.

WSS_Home

Specifies the path to where CA SiteMinder® Web Services Security is installed.

install-date-and-time

Specifies the date and time that the SiteMinder WSS Agent was installed.

The Agent cannot communicate properly with the Policy Server until the trusted host is registered.
The Agent cannot communicate properly with the Policy Server until the trusted host is registered.

More information:

How to Configure Agents and Register a System as a Trusted Host

Run the Installer to Install a SiteMinder WSS Agent Using a GUI

Install the SiteMinder WSS Agent using the CA SiteMinder® Web Services Security installation media on the Technical Support site. Consider the following:

Depending on your permissions, you may need to add executable permissions to the install file by running the following command:
```
chmod +x ca-sm-wss-12.52-cr-unix_version.bin
```
cr

Specifies the cumulative release number. The base 12.52 release does not include a cumulative release number.

unix_version

Specifies the UNIX version: sol or linux.
If you execute the CA SiteMinder® Web Services Security installer across different subnets, it can crash. Install CA SiteMinder® Web Services Security components directly on the host system to avoid the problem.

To install the SiteMinder WSS Agent

Exit all applications that are running.
Open a shell and navigate to where the install program is located.
Enter the following command:
```
./ca-sm-wss-12.52-cr-unix_version.bin
```
The CA SiteMinder® Web Services Security installer starts.
Use gathered system and component information to install the SiteMinder WSS Agent. Consider the following when running the installer:
- When prompted to select what agents to install, select CA SiteMinder® Web Services Security Agent for Web Servers.
- When prompted to select the Java version, the installer lists all Java executables present on the system. Select a supported 32-bit Java Runtime Environment (refer to the Platform Support Matrix on the Technical Support site).
- If you enter path information in the wizard by cutting and pasting, enter (and delete, if necessary) at least one character to enable the Next button.
- Do not use space characters in the SiteMinder WSS Agent install path. For example, "/CA Technologies/agent" will result in install failure.
- If the installer detects the presence of an existing CA SiteMinder® Web Agent, it displays a warning dialog stating that the install will upgrade the Web Agent. Click Continue to upgrade the Web Agent to a SiteMinder WSS Agent. If you proceed, the software upgrade occurs in the installed location of the existing Web Agent.
Review the information presented on the Pre-Installation Summary page, then click Install.
Note: If the installation program detects that newer versions of certain system libraries are installed on your system it asks if you want to overwrite these newer files with older files. Select No To All if you see this message.

The SiteMinder WSS Agent files are copied to the specified location. Afterward, the CA CA SiteMinder® Web Services Security Configuration screen is displayed.
Select one of the following options:
- Yes. I would like to configure CA SiteMinder® Web Services Security Agents now.
- No. I will configure CA SiteMinder® Web Services Security Agents later.
Click Done.
If you selected the option to configure SiteMinder WSS Agents now, the installation program prepares the CA SiteMinder® Web Services Security Configuration Wizard and begins the trusted host registration and configuration process.

If you did not select the option to configure SiteMinder WSS Agents now or if you are required to reboot the system after installation you must start the configuration wizard manually later.

Installation Notes:

To check if the unattended installation completed successfully, see the CA_SiteMinder_Web_Services_Security_Install_install-date-and-time.log file in WSS_HOME/install_config_info directory. This log file contains the results of the installation.

WSS_Home

Specifies the path to where CA SiteMinder® Web Services Security is installed.

install-date-and-time

Specifies the date and time that the SiteMinder WSS Agent was installed.
The Agent cannot communicate properly with the Policy Server until the trusted host is registered.

More information:

How to Configure Agents and Register a System as a Trusted Host