Micro Focus

Fortify ScanCentral SAST

Software Version: 20.2.0

Installation, Configuration, and Usage Guide

Document Release Date: Revision 2: March 9, 2021

Software Release Date: November 2020
Installation, Configuration, and Usage Guide

Legal Notices
Micro Focus
The Lawn
22-30 Old Bath Road
Newbury, Berkshire RG14 1QN
UK
https://www.microfocus.com

Warranty
The only warranties for products and services of Micro Focus and its affiliates and licensors (“Micro Focus”) are set forth in
the express warranty statements accompanying such products and services. Nothing herein should be construed as
constituting an additional warranty. Micro Focus shall not be liable for technical or editorial errors or omissions contained
herein. The information contained herein is subject to change without notice.

Restricted Rights Legend

Confidential computer software. Except as specifically indicated otherwise, a valid license from Micro Focus is required for
possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard
commercial license.

Copyright Notice
© Copyright 2011-2021 [[[Undefined variable _HPb_Branding_Variables. ]]]

Trademark Notices
All trademarks, service marks, product names, and logos included in this document are the property of their respective
owners.

Documentation Updates
The title page of this document contains the following identifying information:
l Software Version number
l Document Release Date, which changes each time the document is updated
l Software Release Date, which indicates the release date of this version of the software
This document was produced on March 09, 2021. To check for recent updates or to verify that you are using the most recent
edition of a document, go to:
https://www.microfocus.com/support/documentation

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 2 of 80
Installation, Configuration, and Usage Guide

Contents
Preface 7
Contacting Micro Focus or one of its affiliates Fortify Customer Support 7
For More Information 7
About the Documentation Set 7

Change Log 8

Chapter 1: Introduction 12
Intended Audience 12
Related Documents 12
All Products 13
Micro Focus or one of its affiliates Fortify Software Security Center 14
Micro Focus or one of its affiliates Fortify Static Code Analyzer 14
What's New in Micro Focus ScanCentral SAST 20.2.0 16
Product Name Change 16
Starting Clients Without Client Authentication 16
Version Compatibility Changes for Remote Translation 16
Changes to Version Compatibility Between the Controller and Clients 17
New Command Options 17
Changes to Auto-Update 18
Removed packagescanner Option 18
Renamed Properties in scancentral.properties 18
New -exclude-disabled-projects Option 18
Renamed ssc_cloudctrl_secret Option 19
Changed Default for client_auto_update 19
Fortify Static Code Analyzer Build Folder Automatically Cleared 19

Chapter 2: Fortify ScanCentral SAST Components 20

Installing and Configuring the Fortify ScanCentral SAST Components 21
Installing the Controller 21
Installing and Uninstalling the ScanCentral SAST Controller as a Service 22
Installing the Controller as a Service 22
Uninstalling the Controller Service 23

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 3 of 80
Installation, Configuration, and Usage Guide

Configuring the ScanCentral SAST Controller 23

Encrypting the Shared Secret 25
Encrypting the Shared Secret on the Controller 26
Encrypting the Shared Secret on a Sensor 26
Encrypting the Shared Secret on a Client 27
About the pool_mapping_mode Property 28
Securing the Controller 29
Creating a Secure Connection Using Self-Signed Certificates 29
Creating a Secure Connection Using a Certificate Signed by a Certificate Signing
Authority 32
Securing the Controller for Authorized Client Use Only 35
Allowing CloudScan Clients that do not Support Client Authentication to Connect to
the Controller 36
Securing ScanCentral SAST Deployment 36
Creating ScanCentral SAST Clients 36
Creating a Standalone Client 37
Creating an Embedded Client Using Static Code Analyzer 37
Updating a Client 37
Creating ScanCentral SAST Sensors 39
Creating a Sensor Using Static Code Analyzer 20.2.0 39
Creating a ScanCentral SAST Sensor as a Service 39
Changing Sensor Expiration Time 40
Support for Multiple Fortify Static Code Analyzer Versions 40
Configuring Sensors to Use the Progress Command when Starting on Java 41
(Windows only) Configuring Sensors to Offload Translation For .NET Languages 42
Enabling .NET Translation Capability on Sensors 43
Using the MSBuild ScanCentral SAST Integration 43
Excluding .NET Projects from Translation 44
Fortify Static Code Analyzer Mobile Build Session Version Compatibility 44
Starting the ScanCentral SAST Components 45
Starting the Controller 45
Starting ScanCentral SAST Sensors 45
Starting Fortify Software Security Center 46
Stopping the Controller 46

Chapter 3: About Upgrading ScanCentral SAST Components 47

Upgrading the ScanCentral SAST Controller 47
Upgrading ScanCentral SAST Sensors 48

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 4 of 80
Installation, Configuration, and Usage Guide

Enabling and Disabling Auto-Updates of Clients and Sensors 50

Chapter 4: Submitting Scan Requests 51

Offloading Scanning Only 51
Targeting a Specific Sensor Pool for a Scan Request 51
Offloading Both Translation and Scanning 52
Translating Python Projects 53
Translating Apex Projects 55
Using the PackageScanner Tool 56
Retrieving Scan Results from the Controller 57
Viewing Scan Request Status 57
If You use the Jenkins Master / Agent Architecture 57
Viewing Client and Sensor Logs 58

Chapter 5: Working with ScanCentral SAST from Fortify Software Security Center 59
Configuring the Connection to Fortify Software Security Center 59
Submitting Scan Requests and Uploading Results to Fortify Software Security Center 60

Appendix A: Configuring Sensor Auto-Start 63

Enabling Sensor Auto-Start on Windows as a Service 63
Troubleshooting 64
Enabling ScanCentral Sensor Auto-Start on Windows as a Scheduled Task 64
Enabling ScanCentral Sensor Auto-Start on a Linux System 67

Appendix B: Optimizing Scan Performance 69

Appendix C: Fortify ScanCentral SAST Command Options 70

Global Options 70
Status Command 70
Start Command 71
Retrieve Command 74
Cancel Command 74
Worker Command 74

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 5 of 80
Installation, Configuration, and Usage Guide

Package Command 75
Arguments Command 77
Packagescanner Command 78
Progress Command 79
Accessing Help for Command-Line Options 79

Send Documentation Feedback 80

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 6 of 80
Installation, Configuration, and Usage Guide
Preface

Preface

Contacting Micro Focus or one of its affiliates Fortify

Customer Support
Visit the Support website to:
l Manage licenses and entitlements
l Create and manage technical assistance requests

l Browse documentation and knowledge articles

l Download software

l Explore the Community

https://www.microfocus.com/support

For More Information

For more information about Fortify software products:
https://www.microfocus.com/solutions/application-security

About the Documentation Set

The Fortify Software documentation set contains installation, user, and deployment guides for all
Fortify Software products and components. In addition, you will find technical notes and release notes
that describe new features, known issues, and last-minute updates. You can access the latest versions of
these documents from the following Micro Focus or one of its affiliates Product Documentation
website:
https://www.microfocus.com/support/documentation

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 7 of 80
Installation, Configuration, and Usage Guide
Change Log

Change Log
The following table lists changes made to this document.

Software Release /
Document Version Changes

Revision 2: March 9, 2021 Modified topic

In "Viewing Client and Sensor Logs" on page 58, cloudCtrl.log

was updated to scancentralCtrl.log.

Revision 1: January 4, 2021 Modified topic

l In "About Upgrading ScanCentral SAST Components" on
page 47, the version numbers in the cautionary note were
corrected.

20.2.0 General
l The product name was changed from Fortify ScanCentral to
Fortify ScanCentral SAST to distinguish it from the newly
introduced Fortify ScanCentral DAST.
New topics
l "What's New in Micro Focus ScanCentral SAST 20.2.0" on
page 16
l "Changing Sensor Expiration Time" on page 40
l "Support for Multiple Fortify Static Code Analyzer Versions" on
page 40
l "Viewing Scan Request Status" on page 57
l "Viewing Client and Sensor Logs" on page 58
Modified topics
l A note that describes the difference between standalone and
embedded clients was added to "Fortify ScanCentral SAST
Components" on page 20.
l In "Configuring the ScanCentral SAST Controller" on page 23
ssc_cloudctrl_secret was replaced with ssc_
scancentral_ctrl_secret.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 8 of 80
Installation, Configuration, and Usage Guide
Change Log

Software Release /
Document Version Changes

l In "Encrypting the Shared Secret" on page 25 ssc_cloudctrl_

secret was replaced with ssc_scancentral_ctrl_secret.
l The procedure used to start the Controller was modified in
"Starting the ScanCentral SAST Components" on page 45.
l A note about the compatibility rules that apply to remote
translation was added to "Upgrading the ScanCentral SAST
Controller" on page 47.
l "Enabling and Disabling Auto-Updates of Clients and Sensors"
on page 50 was changed to reflect the change in the default
value for the client_auto_update property from true to
false.
l Command-line options used with the packagecanner tool were
changed in "Using the PackageScanner Tool" on page 56.
l Various changes were made to command-line options in "Fortify
ScanCentral SAST Command Options" on page 70.
Removed topics
What's New in Micro Focus Fortify ScanCentral 20.1.0

20.1.0 All references to CloudScan were replaced with ScanCentral.

New topics
l What's New in Micro Focus Fortify ScanCentral 20.1.0
l "Securing the Controller for Authorized Client Use Only" on
page 35
l "Enabling and Disabling Auto-Updates of Clients and Sensors"
on page 50
l "Using the PackageScanner Tool" on page 56
Modified topics
l "Configuring the ScanCentral SAST Controller" on page 23
l "(Windows only) Configuring Sensors to Offload Translation For
.NET Languages" on page 42

19.2.0 New topics

l "Configuring Sensors to Use the Progress Command when
Starting on Java" on page 41

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 9 of 80
Installation, Configuration, and Usage Guide
Change Log

Software Release /
Document Version Changes

l Configuring Sensors to Use the Progress Command when

Starting on Java 11
l "(Windows only) Configuring Sensors to Offload Translation For
.NET Languages" on page 42
Modified topics
l "Installing the Controller" on page 21 was modified to reflect the
new installation procedure used for installation on both Linux
and Windows.
l "Creating ScanCentral SAST Clients" on page 36was modified to
reflect the introduction of the CloudScan_Client_
<version>.zip file, which is used to create stand-alone clients
that support translation on CloudScan sensors.
l "Upgrading the ScanCentral SAST Controller" on page 47 was
modified to reflect file name changes.
l The procedure described in "Upgrading ScanCentral SAST
Sensors" on page 48 was modified to reflect the fact that the
Fortify_CloudScan_Update_<version>_Linux.zip and
Fortify_CloudScan_Update_<version>_windows_
x64.zip file are no longer available (or used) and have been
replaced by the single file Cloudscan_Client_
<version>.zip.
l Information about how to use CloudScan to scan Python
projects was added to "Submitting Scan Requests" on page 51.
l New argument command options were added to "Fortify
ScanCentral SAST Command Options" on page 70.
Removed topics
Installing the CloudScan Controller on a Linux System
Installing the CloudScan Controller on a Windows System

19.1.0 New topics

l What's New in Micro Focus Fortify CloudScan 19.1.0
l "Fortify ScanCentral SAST Command Options" on page 70
Modified topics

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 10 of 80
Installation, Configuration, and Usage Guide
Change Log

Software Release /
Document Version Changes

l "Fortify ScanCentral SAST Components" on page 20

l "Creating ScanCentral SAST Clients" on page 36
l "Accessing Help for Command-Line Options" on page 79
l "Submitting Scan Requests" on page 51

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 11 of 80
 Chapter 1: Introduction
With Fortify ScanCentral SAST (ScanCentral), Fortify Static Code Analyzer users can better
manage their resources by offloading code analysis tasks from their build machines to a cloud of
machines (sensors) provided for this purpose.
You can start a Fortify Static Code Analyzer analysis of your code from a ScanCentral client in one
of two ways:
l You can perform the translation phase on a local or build machine to generate a mobile build
session (MBS). The ScanCentral client then hands off the MBS to the ScanCentral Controller,
which distributes the MBS to the sensors. The sensors then perform the scanning phase of the
analysis.
l If your application version is written in a language supported for centralized translation, you

can also offload the translation phase of the analysis to your sensors. For information about
the languages supported for offloading translation, see "Creating ScanCentral SAST Clients"
on page 36. For information about the specific language versions supported, see the Micro
Focus Fortify Software System Requirements document.
If your code is written using a language other than one supported for offloading project
translation, the translation phase (less processor- and time-intensive than the scanning phase) is
completed on the build machine. After translation is completed, ScanCentral generates a project
package, which it then moves to a distributed cloud of machines (sensors) for scanning. In
addition to freeing up build machines, this process makes it easy to add more resources to the
cloud and grow the system as needed, without having to interrupt your build process. And,
Fortify Software Security Center can direct ScanCentral to output FPR files directly to the server.
This content provides information on how to install, configure, and use ScanCentral to streamline
your static code analysis process.

Intended Audience
This content is written for anyone who intends to install, configure, or use ScanCentral to offload
the translation (for supported languages) and scanning phases of the Fortify Static Code
Analyzer process to ScanCentral sensors.

Related Documents
This topic describes documents that provide information about Micro Focus or one of its affiliates
Fortify software products.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 12 of 80
Installation, Configuration, and Usage Guide
Related Documents

Note: You can find the Micro Focus or one of its affiliates Fortify Product Documentation at
https://www.microfocus.com/support/documentation. All guides are available in both PDF
and HTML formats. Product help is available within the Fortify WebInspect products.

All Products
The following documents provide general information for all products. Unless otherwise noted,
these documents are available on the Micro Focus Product Documentation website.

Document / File Name Description

About Micro Focus or one of its This paper provides information about how to access
affiliates Fortify Product Software Micro Focus or one of its affiliates Fortify product
Documentation documentation.
About_Fortify_Docs_<version>.pdf Note: This document is included only with the
product download.

Micro Focus or one of its affiliates This document provides the details about the
Fortify Software System environments and products supported for this version
Requirements of Fortify Software.
Fortify_Sys_Reqs_<version>.pdf

Micro Focus or one of its affiliates This document provides an overview of the changes
Fortify Software Release Notes made to Fortify Software for this release and important
information not included elsewhere in the product
FortifySW_RN_<version>.pdf
documentation.

What’s New in Micro Focus or one This document describes the new features in Fortify
of its affiliates Fortify Software Software products.
<version>
Fortify_Whats_New_<version>.pdf

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 13 of 80
Installation, Configuration, and Usage Guide
Related Documents

Micro Focus or one of its affiliates Fortify Software Security

Center
The following document provides information about Fortify Software Security Center. Unless
otherwise noted, these documents are available on the Micro Focus Product Documentation
website at https://www.microfocus.com/documentation/fortify-software-security-center.

Document / File Name Description

Micro Focus or one of its affiliates This document provides Fortify Software Security
Fortify Software Security Center Center users with detailed information about how to
User Guide deploy and use Software Security Center. It provides all
of the information you need to acquire, install,
SSC_Guide_<version>.pdf
configure, and use Software Security Center.
It is intended for use by system and instance
administrators, database administrators (DBAs),
enterprise security leads, development team managers,
and developers. Software Security Center provides
security team leads with a high-level overview of the
history and current status of a project.

Micro Focus or one of its affiliates Fortify Static Code

Analyzer
The following documents provide information about Fortify Static Code Analyzer. Unless
otherwise noted, these documents are available on the Micro Focus Product Documentation
website at https://www.microfocus.com/documentation/fortify-static-code.

Document / File Name Description

Micro Focus or one of its affiliates This document describes how to install and use Fortify
Fortify Static Code Analyzer User Static Code Analyzer to scan code on many of the
Guide major programming platforms. It is intended for people
responsible for security audits and secure coding.
SCA_Guide_<version>.pdf

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 14 of 80
Installation, Configuration, and Usage Guide
Related Documents

Document / File Name Description

Micro Focus or one of its affiliates This document provides the information that you need
Fortify Static Code Analyzer Custom to create custom rules for Fortify Static Code Analyzer.
Rules Guide This guide includes examples that apply rule-writing
concepts to real-world security issues.
SCA_Cust_Rules_Guide_
<version>.zip Note: This document is included only with the
product download.

Micro Focus or one of its affiliates This document describes how to use Fortify Audit
Fortify Audit Workbench User Guide Workbench to scan software projects and audit
analysis results. This guide also includes how to
AWB_Guide_<version>.pdf
integrate with bug trackers, produce reports, and
perform collaborative auditing.

Micro Focus or one of its affiliates This document provides information about how to
Fortify Plugins for Eclipse User Guide install and use the Fortify Complete and the Fortify
Remediation Plugins for Eclipse.
Eclipse_Plugins_Guide_<version>.pdf

Micro Focus or one of its affiliates This document describes how to install and use both
Fortify Plugins for JetBrains IDEs the Fortify Analysis Plugin for IntelliJ IDEA and
and Android Studio User Guide Android Studio and the Fortify Remediation Plugin for
IntelliJ IDEA, Android Studio, and other JetBrains IDEs.
JetBrains_AndStud_Plugins_Guide_
<version>.pdf

Micro Focus or one of its affiliates This document describes how to install, configure, and
Fortify Jenkins Plugin User Guide use the plugin. This documentation is available at
https://www.microfocus.com/documentation/fortify-
Jenkins_Plugin_Guide_<version>.pdf
jenkins-plugin.

Micro Focus or one of its affiliates This document describes how to install and use Fortify
Fortify Security Assistant Plugin for Security Assistant plugin for Eclipse to provide alerts to
Eclipse User Guide security issues as you write your Java code.
SecAssist_Eclipse_Guide_
<version>.pdf

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 15 of 80
Installation, Configuration, and Usage Guide
What's New in Micro Focus ScanCentral SAST 20.2.0

Document / File Name Description

Micro Focus or one of its affiliates This document provides information about how to
Fortify Extension for Visual Studio install and use the Fortify extension for Visual Studio
User Guide to analyze, audit, and remediate your code to resolve
security-related issues in solutions and projects.
VS_Ext_Guide_<version>.pdf

Micro Focus or one of its affiliates This document describes the properties used by Fortify
Fortify Static Code Analyzer Tools Static Code Analyzer tools.
Properties Reference Guide
SCA_Tools_Props_Ref_
<version>.pdf

What's New in Micro Focus ScanCentral SAST

20.2.0
Micro Focus ScanCentral SAST 20.2.0 includes the changes described here.

Product Name Change

With the introduction of Fortify ScanCentral DAST (for dynamic scans), Fortify ScanCentral was
re-named ScanCentral SAST. For information about Fortify ScanCentral DAST, see the Micro
Focus Fortify ScanCentral DAST Configuration and Usage Guide.

Starting Clients Without Client Authentication

Starting with the Fortify ScanCentral 20.1.1 release, the client code was modified so that you can
start clients without client authentication. This means that if the client.properties file is
missing, or if the client_auth_token is missing, empty, or commented out, clients can still be
started.

Version Compatibility Changes for Remote Translation

The following version compatibility changes apply to remote translation:
l The Controller now assigns jobs from ScanCentral versions 19.2.x and 20.1.x to Fortify Static
Code Analyzer 20.1.x only.
l You cannot use Fortify Static Code Analyzer 19.2.x with version 20.2.x of the Controller.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 16 of 80
Installation, Configuration, and Usage Guide
What's New in Micro Focus ScanCentral SAST 20.2.0

l Jobs from version 20.2.x standalone clients are assigned to Fortify Static Code Analyzer only
20.2.x (the Fortify Static Code Analyzer version must match the client version).
l Jobs from an embedded client (on SCA and Apps)

Changes to Version Compatibility Between the Controller and

Clients
The changes to Controller and client version compatibility in this release are as follows.

Note: These changes apply to remote translation only. Remote scans are not affected.

l The 20.2.0 version Controller now assigns jobs submitted from ScanCentral version 19.2.x and
20.1.x clients to Fortify Static Code Analyzer versions 20.1.x only.
l You can no longer use Fortify Static Code Analyzer 19.2.x with a version 20.2.0 Controller for
remote translations and scans.
l Jobs from a version 20.2.0 standalone client are assigned only to Fortify Static Code Analyzer
version 20.2.0. (The Fortify Static Code Analyzer version must match the client version).

New Command Options

New packagescanner Options

The following packagescanner options were added:

l -b (--build-id)
l -fpr
l -package
l -sargs, --scan-arguments
l -sca-path
l -sca-scan-log
l -sca-translation-log
l -targs (--translation-arguments)
For option descriptions, see "Using the PackageScanner Tool" on page 56.

New ScanCentral SAST Client OptionsThe following new build options are
supported for ScanCentral SAST clients:
l The -bc (--build-command) option specifies custom build parameters for preparing and
building a project.
l The -skipBuild option disables the project preparation build step before packaging.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 17 of 80
Installation, Configuration, and Usage Guide
What's New in Micro Focus ScanCentral SAST 20.2.0

l Use the new ) -snm(--scan_node_modules option, which applies to both start and
package commands, to include node_modules dependencies in packages.

For more information, see "Fortify ScanCentral SAST Command Options" on

page 70.

Changes to Auto-Update
With this release, if automatic updates of your clients and sensors is enabled, auto-update works
as follows:
l Embedded clients and sensors are updated automatically with patch installation.
l Standalone clients are automatically updated with major ScanCentral SAST upgrades and with
patch installations.
l Embedded clients and sensors follow the expected client failure logic in case of failed upgrades.
l Standalone clients follow the expected client failure logic in case of failed upgrades, depending
on upgrade type.
l Auto-updates work regardless of whether values are set for the client_auth_token and
worker_auth_token properties. If, on the Controller, no value is set for client_auth_
token and the client.properties file is missing, or if the file does not contain the client_
auth_token property, auto-update still works.
l Version 20.1.x clients and sensors cannot be auto-updated to version 20.2.0.

Removed packagescanner Option

The -sca-logoption was removed from this release.

Renamed Properties in scancentral.properties

Property names in the scancentral.properties file
(Core/config/scancentral.properties) that previously started with
com.fortify.cloud.cli now start with com.fortify.scancentral.cli.

New -exclude-disabled-projects Option

The new -exclude-disabled-projects option was added to support the Fortify ScanCentral
MSBuild integration. If you specify -exclude-disabled-projects on the Fortify Static Code
Analyzer command line, no disabled projects are translated. By default (without the option), all
projects in a solution, disabled or enabled, are translated. For more information, see "Fortify
ScanCentral SAST Command Options" on page 70.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 18 of 80
Installation, Configuration, and Usage Guide
What's New in Micro Focus ScanCentral SAST 20.2.0

Renamed ssc_cloudctrl_secret Option

The ssc_cloudctrl_secret option that Fortify Software Security Center uses to request data
from the ScanCentral Controller was changed to ssc_scancentral_ctrl_secret. Note that
the ssc_cloudctrl_secret option is supported for backward compatibility with Fortify
CloudScan.

Changed Default for client_auto_update

The default value for the client_auto_update property is now false. For information about
the client_auto_update property, see "Enabling and Disabling Auto-Updates of Clients and
Sensors" on page 50.
Node Package Manager (NPM) Support
Node_modules (third-party JavaScript dependencies) are not added to the package until you
apply the --scan-node-modules option from the command line. If the option is not applied, no
node_modules are applied to the package. For more information, see "Fortify ScanCentral SAST
Command Options" on page 70.

Fortify Static Code Analyzer Build Folder Automatically

Cleared
To prevent the progressive loss of disc space as scan results accumulate, the Fortify Static Code
Analyzer clean command is now invoked automatically to clear the Fortify Static Code Analyzer
build directory for completed scans.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 19 of 80
 Chapter 2: Fortify ScanCentral SAST
Components
A Fortify ScanCentral SAST installation includes the following three components:
l ScanCentral client: A build machine on which Fortify Static Code Analyzer translates your
code and generates Fortify Static Code Analyzer mobile build sessions (MBS). The translated
source code, along with optional and required data, such as custom rules and Fortify Static
Code Analyzer command-line arguments, are uploaded to the ScanCentral Controller.
Note: A client can be either an embedded client, which resides on the same machine as
Fortify Static Code Analyzer, or a standalone client, which is independent of Fortify Static
Code Analyzer.

Within an SCA and Apps installation, the files used for ScanCentral SAST sensors and
embedded clients are the same. The only difference is how you invoke their functionality
from the command line. To use ScanCentral SAST as a sensor, you run ScanCentral using
the worker command. To use ScanCentral SAST as a client to initiate a scan, you invoke it
using the start command. Sensor functionality depends on Fortify Static Code Analyzer.
So, you can have a standalone client, but not a standalone sensor.

The interface for issuing Fortify ScanCentral SAST commands is installed on your clients. You
can use this interface to create or identify a Fortify Static Code Analyzer mobile build session,
set the parameters for the scan, and communicate your intentions to the ScanCentral
Controller.
Note: A standalone client that does not require that Fortify Static Code Analyzer be
installed may pack the code with dependencies into a package to send to the Controller for
further translation and scanning.

l ScanCentral Controller: A standalone web application that receives the Fortify Static Code
Analyzer mobile build sessions and scan instructions from ScanCentral clients (or project
packages with translation and scan instructions), routes the information to sensors, and
(optionally) uploads scan results (FPR files) to Fortify Software Security Center.
l ScanCentral sensors: Distributed network of computers set up to receive Fortify Static Code
Analyzer mobile build sessions (MBSs) and scan code using Fortify Static Code Analyzer. If
your applications are written in a supported language, the sensors can also perform the
translation phase of the analysis. For information about the languages supported for
performing translation, see "Creating ScanCentral SAST Clients" on page 36.
Note: The minimum installation requires three physical or virtual machines: a Fortify
ScanCentral SAST client, a sensor, and a Controller. A Fortify Software Security Center server
is optional.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 20 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

Note: As you set up your ScanCentral environment, you can use subnets to segment your
build machines from the sensors. The build machines need only communicate with the
ScanCentral Controller, which in turn communicates with the sensors.

Installing and Configuring the Fortify ScanCentral

SAST Components
The following table lists the components, which, in addition to Fortify Static Code Analyzer, you
must install and configure for ScanCentral SAST deployment. Install these components in the
following order:
l ScanCentral Controller
l ScanCentral clients

l ScanCentral sensors

l (Optional) Fortify Software Security Center

For information about hardware and software requirements for these components, see the Micro
Focus Fortify Software System Requirements document.
This section contains the following topics:

Installing the Controller

The ScanCentral SAST Controller (Controller) is a standalone server that sits between the
ScanCentral SAST clients, sensors, and optionally, Fortify Software Security Center. The
Controller accepts scan requests issued by the clients and passes them on to an available sensor.
A sensor returns scan results to the Controller, which stores them temporarily.

Caution! Before you install the Controller, you must first download and configure a Java
Runtime Environment (JRE). For information about supported JRE versions, see the Micro
Focus Fortify Software System Requirements guide. For information about how to download
and configure JRE, see the documentation for the supported JRE version.

Jobs are deleted from the Controller after seven days, unless you change the job_expiry_
delay variable value of 168 hours in the config.properties file. (You can find the
config.properties file in the <sc_controller_dir>/tomcat/webapps/scancentral-
ctrl/WEB-INF/classes directory.)

Caution! The name of the directory into which you install the Controller must not include
spaces.

To install the ScanCentral Controller (on a Linux or Windows system):

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 21 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

l Extract the contents of the Fortify_ScanCentral_Controller_<version>_x64.zip file

to a directory that does not include either the <sca_install_dir> or the <ssc_install_
dir>.

Note: In this document, <sc_controller_dir> refers to the ScanCentral Controller

installation directory, <sca_install_dir> refers to the Fortify Static Code
Analyzer installation directory, and <ssc_install_dir> refers to the Fortify Software
Security Center server installation directory.

After you install the ScanCentral Controller, <sc_controller_dir> resembles the following:

bin/

tomcat/

readme.txt

See Next
"Configuring the ScanCentral SAST Controller" on the next page
For information about how to update your Controller, see "About Upgrading ScanCentral SAST
Components" on page 47 and "Upgrading the ScanCentral SAST Controller" on page 47.
See Also
"Installing and Uninstalling the ScanCentral SAST Controller as a Service" below

Installing and Uninstalling the ScanCentral SAST Controller as a Service

If you use Windows, you can install the ScanCentral controller as a Windows service.

Installing the Controller as a Service

To install the Controller as a service on a machine without other Tomcat instances running:
1. Log on to Windows as a local user with administrator privileges.
2. Check to make sure that the JRE_HOME and JAVA_HOME environment variables are correctly
configured.
3. Check to make sure that the CATALINA_HOME environment variable is either empty or set up
to point to the ScanCentral SAST Tomcat directory.
4. Navigate to the <sc_controller_dir>/tomcat/bin directory, and then run the
following:

service.bat install
This creates a service with the name "Tomcat9."
To install the Controller as a service with a different name:

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 22 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

1. Check to make sure that the JRE_HOME and JAVA_HOME environment variables are correctly
configured.
2. Check to make sure that the CATALINA_HOME environment variable is either empty or set up
to point to the ScanCentral SAST Tomcat directory.
3. Navigate to the <sc_controller_dir>/tomcat/bin directory, and then run the
following:

service.bat install <service_name>

The service name must not contain any spaces.

Uninstalling the Controller Service

To uninstall the Apache Tomcat 9.0 service:
1. Stop the service.
2. Navigate to the <sc_controller_dir>/tomcat/bin directory, and then run the
following:

service.bat remove
To uninstall the controller as a service with a name other than Apache Tomcat 9.0:
1. Stop the service.
2. Navigate to the <sc_controller_dir>/tomcat/bin directory, and then run the
following:
service.bat remove <service_name>
See Also
"Configuring the ScanCentral SAST Controller" below

Configuring the ScanCentral SAST Controller

After you install the Controller, edit global properties such as the email address to be used, the
shared secret for the Controller (password that Fortify Software Security Center uses when it
requests data from the ScanCentral Controller), the shared secret for the sensor, and the Fortify
Software Security Center URL (if you plan to upload your FPRs to Fortify Software Security
Center).

Caution! To avoid potential conflicts, Fortify recommends that you run the Controller on a
Tomcat Server instance other than the instance that Fortify Software Security Center uses.

To configure the Controller:

1. Navigate to <sc_controller_dir>/tomcat/webapps/scancentral-ctrl/WEB-
INF/classes.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 23 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

2. Open the config.properties file in a text editor, and then configure the properties listed
in the following table.

Option Description

allow_ If set to true, this enables CloudScan version 19.2.0 or earlier clients
insecured_ that do not support client authentication to connect to the
clients_with_ Controller. For details, see "Securing the Controller for Authorized
empty_token Client Use Only" on page 35.

client_auto_ If set to true, this enables the Controller to automatically update all
update outdated sensors and clients. For details, see "Enabling and Disabling
Auto-Updates of Clients and Sensors" on page 50.

client_auth_ A string that contains no spaces or backslashes, used to secure the

token Controller for use by authorized clients only. If you prefer not to use
plain text, you can use an encrypted shared secret as the value for
this property. For instructions on how to encrypt a shared secret, see
"Encrypting the Shared Secret on a Client" on page 27.

worker_auth_ A string that contains no spaces or backslashes. If you prefer not to

token use plain text, you can use an encrypted shared secret as the value for
this property. For instructions on how to encrypt a shared secret, see
"Encrypting the Shared Secret on the Controller" on page 26.

ssc_url URL for the Fortify Software Security Center server; all uploads are
sent to this address.

Example: https://<ssc_host>:<port>/ssc

this_url URL for the Controller; used in emails to refer to this server for
manual job result downloads.

Example: https://<controller_
host>:8443/scancentral-ctrl

ssc_ Password that Fortify Software Security Center uses to request data
scancentral_ from the Controller. Specify a string that contains no spaces or
ctrl_secret backslashes.
(Optional) Use an encrypted shared secret. For instructions on how

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 24 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

Option Description

to encrypt a shared secret, see "Encrypting the Shared Secret" on the

next page.

Note: The ssc_cloudctrl_secret option is supported for

backward compatibility with Fortify CloudScan.

pool_mapping_ Used to configure different modes for mapping scan requests to

mode sensor pools. For information about the valid values for pool_
mapping_mode, see "About the pool_mapping_mode Property" on
page 28.

If your remote IP address is different than the configured Fortify Software Security Center
URL, you can use one of the following properties to set up the remote IP address.

ssc_remote_ip Remote IP address

ssc_remote_ Remote IP range (in CIDR format)

ip_trusted_
proxies_range

ssc_remote_ Remote IP HTTP header

ip_header
The default value is X-Forwarded-For.

remote_ip_ Remote IP proxy header

proxy_header

ssc_trusted_ If remote_ip_proxy_header is set, you must also specify a value

proxies_ for this property.
remote_ip

3. Save and close your config.properties file.

4. Start the Controller. (For instructions, see "Starting the ScanCentral SAST Components" on
page 45.)
See Also
"Installing the Controller" on page 21

Encrypting the Shared Secret

Passwords exist in the ScanCentral Controller and sensor configuration files as plain text. If you
prefer to encrypt your passwords, you can.
You can use encrypted keys as values for:

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 25 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

l worker_auth_token, smtp_auth_pass and ssc_scancentral_ctrl_secret properties

in the config.properties file on the Controller
l worker_auth_token property in the worker.properties file on a sensor
l client_auth_token property in the client.properties file on a client

Encrypting the Shared Secret on the Controller

To encrypt a shared secret on the Controller:
1. Run one of the following:
l On a Windows system, <sc_controller_dir>\bin\pwtool.bat <pwtool_key_
filepath>
l On a Linux system, <sc_controller_dir>/bin/pwtool <pwtool_key_filepath>
2. When prompted, type the password to encode, and then press Enter.
Note: For the sake of security, make sure that the pwtool key file you use to encrypt
secrets for sensors is different from the pwtool key file you use to encrypt secrets on the
Controller.

The pwtool generates a new key stored in the file on the path specified in step 1, or reuses an
existing file on specified path.
3. Copy the new encrypted secret, and paste it as the value for one of the following properties
in the config.properties file:
l worker_auth_token
l smtp_auth_pass
l ssc_scancentral_ctrl_secret
l client_auth_token

Tip: Fortify recommends that you assign separate, unique shared secrets for the
worker_auth_token, smtp_auth_pass, and ssc_scancentral_ctrl_secret
properties.

4. Create two additional encrypted shared secrets (steps 1 and 2) and, in the
config.properties file, paste these as values for the two properties to which you did not
already assign an encrypted secret in step 3.
5. Uncomment the following line (property) in the config.properties file:
Pwtools_keys_file=d:\SecretKeys\SecretKey.txt
6. Save the config.properties file.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 26 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

Encrypting the Shared Secret on a Sensor

To encrypt a shared secret on a sensor:
1. Run one of the following:
l On a Windows system, <sca_install_dir>\bin\pwtool.bat <pwtool_key_
filepath>
l On a Linux system, <sca_install_dir>/bin/pwtool <pwtool_key_filepath>
2. When prompted, type the password to encode, and then press Enter.
The pwtool generates a new pwtool.keys file to <pwtool_key_filepath> and prints a
new encrypted secret to the console.
3. Copy the encrypted secret, and paste it as the value for worker_auth_token property in
the worker.properties file.
4. Add the following line (property) to the worker.properties file:
pwtool_keys_file=<pwtool_key_filepath>

Encrypting the Shared Secret on a Client

To encrypt a shared secret on a client:
1. Run one of the following commands.
l On a Windows system:

o For a client used as part of Fortify Static Code Analyzer and applications, run <sca_
install_dir>\bin\pwtool.bat <pwtool_key_filepath>
o For a standalone client, run <client_install_dir>\bin\pwtool.bat <pwtool_
key_filepath>
l On a Linux system:
o For a client used as part of Fortify Static Code Analyzer and applications, run <sca_
install_dir>/bin/pwtool <path_to_pwtool.keys>
o For a standalone client, run <client_install_dir>/bin/pwtool <path_to_
pwtool.keys>
2. When prompted, type the password to encode, and then press Enter.
The pwtool generates a new key in the file on the specified path, or reuses an existing file and
prints the encrypted password.
3. Copy the new encrypted secret, and paste it as the value for the client_auth_token
property in the client.properties file.
4. Add the following to the client.properties file:
pwtool_keys_file=<pwtool_key_filename>
See Also
"Configuring the ScanCentral SAST Controller" on page 23
"Creating ScanCentral SAST Sensors" on page 39

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 27 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

About the pool_mapping_mode Property

The pool_mapping_mode property in the config.properties file determines how the system
maps scan requests to sensor pools. Valid values for the pool_mapping_mode property are as
follows:
l DISABLED— In this mode, a ScanCentral SAST client requests a specific sensor pool when it
submits a scan request. Otherwise, the default pool is used.
l ENABLED— In this mode, if a scan request is associated with an application version in Fortify
Software Security Center, the Controller queries Fortify Software Security Center to determine
the sensor pool assigned to the application version. Or, a ScanCentral client can request a
specific sensor pool when it submits a scan request. (A client request for a specific sensor pool
takes precedence over a query from the Controller.)
Note: Sensors in the default sensor pool run scan requests that are not associated with an
application version (and no specific pool is requested on the ScanCentral SAST client
command line).

l ENFORCED—As with the ENABLED mode, if a scan request is associated with an application
version in Fortify Software Security Center, the Controller queries Fortify Software Security
Center for the sensor pool to use for the application version. Otherwise, the default sensor pool
is targeted for scan requests. A client cannot request a specific sensor pool in the
ENFORCED mode.
The following table shows how the Fortify Software Security Center integration with Fortify
ScanCentral SAST responds to different input when pool_mapping_mode is set to DISABLED,
ENABLED, or ENFORCED.

Note: By default, in enabled and enforced modes, all application versions are assigned to the
Default pool.

INPUT DISABLED ENABLED ENFORCED

No pool or version specified Default sensor pool Default Default sensor

sensor pool pool

Specific sensor pool (only) Requested sensor pool Requested Denied

specified sensor pool

Application version (only) Default sensor pool SSC-assigned SSC-assigned

specified pool pool

Invalid sensor pool (only) Denied Denied Denied

specified

Invalid application version Default pool Denied Denied

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 28 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

INPUT DISABLED ENABLED ENFORCED

(only) specified

Valid sensor pool and Requested sensor pool Requested Denied

application version specified sensor pool

Invalid sensor pool and valid Denied Denied Denied

application version specified

Valid sensor pool but invalid Requested sensor pool Requested Denied
application version specified sensor pool

See Also
"Configuring the ScanCentral SAST Controller" on page 23

Securing the Controller

The following procedure describes how to create a secure connection (HTTPS) between the
ScanCentral SAST Controller/Tomcat server and ScanCentral SAST CLI. This procedure requires
either a self-signed certificate or a certificate signed by a certificate authority such as VeriSign.
To create a secure connection (HTTPS) between the Controller/Tomcat server and ScanCentral
CLI, use one of the following procedures.

Note: The following sections show examples of how to create a connection. For the most
current information, see your Apache Tomcat documentation.

"Creating a Secure Connection Using Self-Signed Certificates" below

"Creating a Secure Connection Using a Certificate Signed by a Certificate Signing Authority" on
page 32

Creating a Secure Connection Using Self-Signed Certificates

To enable SSL on Tomcat using a self-signed certificate:
1. To generate a keystore that contains a self-signed certificate, open a command prompt and
run one of the following Java keytool commands:
l On a Windows system:

%JAVA_HOME%\bin\keytool -genkey -alias <alias_name> -keyalg RSA -keystore

<mykeystore>

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 29 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

l On a Linux system:
$JAVA_HOME/bin/keytool -genkey -alias <alias_name> -keyalg RSA -keystore
<mykeystore>

2. Provide values for the prompts listed in the following table.

Prompt Value

Enter keystore Type a secure password.

password:

Re-enter new password: Re-type your secure password.

What is your first and Type your hostname. You can use your fully-qualified domain
last name? name here.
Note: If you plan to provide an IP address as the
hostname, then you must also provide the -ext
san=ip:<ip_ address> parameter to keytool. Without
the -ext san=ip:<ip_address> parameter, the SSL
handshake fails.

What is the name of Name to identify the group that is to use the cert.
your organizational
unit?

What is the name of Name of your organization.

your organization?

What is the name of City or locality in which your organization is located.

your City or Locality?

What is the name of State or province in which your organization is located.

your State or Province?

What is the two-letter If your server is located in the United States, type US.
country code for this
unit?

Confirm your entries: Type yes to confirm your entries.

Enter key password for Password for your Tomcat server key. Press Return / Enter to
<tomcat><Return if use the same password you established for your keystore.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 30 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

Prompt Value

same as keystore (Fortify recommends that you create a new key password.)
password>:

Re-enter new password: Re-type your key password.

3. To export the certificate from the Tomcat keystore, open a command prompt and type one
of the following:
l On a Windows system:

%JAVA_HOME%\bin\keytool -export -alias <alias_name> -keystore <mykeystore> -file

YourCertFile.cer

l On a Linux system:
$JAVA_HOME/bin/keytool -export -alias <alias_name> -keystore <mykeystore> -file
YourCertFile.cer

4. Add the following connector to the server.xml file in the tomcat\conf directory:
<Connector port="8443" maxThreads="200"
scheme="https" secure="true" SSLEnabled="true"
keystoreFile="<mykeystore>" "keystorePass="<mypassword>"
clientAuth="false" sslProtocol="TLS"/>

Note: The default server.xml file installed with Tomcat includes an example
<connector> element for an SSL connector.

5. Navigate to one of the following directories, and then open the config.properties file in
a text editor:
l (Windows) <sc_controller_dir>\tomcat\webapps\scancentral-ctrl\WEB-

INF\classes
l (Linux) <sc_controller_dir>/tomcat/webapps/scancentral-ctrl/WEB-
INF/classes
6. Update the this_url property, with your https address and port.
Example: this_url=https://<controller_host>:8443/scancentral-ctrl
7. Restart your Tomcat server.
8. Set up your clients and sensors. For information about how to set up the ScanCentral SAST
clients and sensors, see "Creating ScanCentral SAST Clients" on page 36 and, "Creating
ScanCentral SAST Sensors" on page 39, respectively.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 31 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

9. Add your self-signed certificate to the java keystore on all entities that communicate with the
Controller (includes all clients, sensors, and Fortify Software Security Center installations) as
follows:
a. For ScanCentral SASTclients and sensors, open a command prompt and type the
following:

cd <sca_install_dir>\jre\bin
Where <sca_install_dir> is the directory where the sensor or client is installed.
For a installation or for standalone ScanCentral SAST clients, open a command prompt
and type one of the following:
o On Windows:

cd %JAVA_HOME%\jre\bin

o On Linux:

cd $JAVA_HOME/jre/bin

b. Run the following command:

keytool -import -alias <aliasName> -keystore ..\lib\security\

cacerts -file YourCertFile.cer –trustcacerts

Where YourCertFile.cer is the same certificate file that you exported in step 1.

Creating a Secure Connection Using a Certificate Signed by a Certificate Signing

Authority
To enable SSL on Tomcat using a certificate signed by a certificate signing authority:
1. Use the Java keytool to generate a new keystore containing a self-signed certificate, as
follows:
l On a Windows system:

%JAVA_HOME%\bin\keytool -genkey -alias tomcat -keyalg RSA -

keystore "<mykeystore>"
l On a Linux system:

$JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA -keystore

"<mykeystore>"

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 32 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

2. The keytool prompts you for the information described in the following table.

Prompt Data

Enter keystore password: Type a secure password.

Re-enter new password: Re-enter your secure password.

What is your first and last Type your hostname. You can use your fully qualified
name? domain name here.

Note: If you plan to enter an IP address as the

hostname, then you will also need to pass an
additional parameter to keytool, -ext
san=ip:<ipaddress>. Without this additional
parameter, the SSL handshake fails.

What is the name of your Type the name of the group that is to use the certificate.
organizational unit? (This can be anything you want.)

What is the name of your Type the name of your organization (This can be
organization? anything you want.)

What is the name of your City Type the city or locality. (This can be anything you want.)
or Locality?

What is the name of your Type the state or province. (This can be anything you
State or Province? want.)

What is the two-letter country If your server is located in the United States, type US.
code for this unit?

Confirm your entries: Type yes to confirm your entries.

Enter key password for Type a password for your Tomcat server key, or press
<tomcat><Return if Return to use the same password you established for
same as keystore your keystore. Fortify recommends that you create a new
password>: password.

Re-enter new password: Re-type your key password.

3. Generate a Certificate Signing Request (CSR).

To obtain a certificate from a certificate signing authority, you must generate a Certificate
Signing Request (CSR). The certificate authority uses the CSR to create the certificate. Create

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 33 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

the CSR as follows:

On a Windows system:

%JAVA_HOME%\bin\keytool -certreq -alias <alias_name> -keyalg RSA -file

"yourCSRname.csr" -keystore "<mykeystore>"

l On a Linux system:

$JAVA_HOME/bin/keytool -certreq -alias <alias_name> -keyalg RSA -file

"yourCSRname.csr" -keystore "<mykeystore>"

4. Send the CSR file to the certificate signing authority you have chosen.
5. Once you receive your certificate from the certificate signing authority, import it into the
keystore that you created, as follows:
l On a Windows system:

%JAVA_HOME%\bin\keytool -import -alias <alias_name> -trustcacerts -file

"YourVerisignCert.crt"-keystore "<mykeystore>"

l On a Linux system:

$JAVA_HOME/bin/keytool -import -alias <alias_name> -trustcacerts -file

"YourVerisignCert.crt" -keystore "<mykeystore>"

The root CA already exists in the cacerts file of your JDK, so you are just installing the
intermediate CA for your certificate signing authority.
Note: If you purchased your certificate from VeriSign, you must first import the chain
certificate. You can find the specific chain certificate on the VeriSign website or click the
link for the chain certificate in the email you received from VeriSign with your certificate.

l On a Windows system:
%JAVA_HOME%\bin\keytool -import -alias IntermediateCA -
trustcacerts-file "chainCert.crt" -keystore "<mykeystore>"
l On a Linux system:

$JAVA_HOME/bin/keytool -import -alias IntermediateCA -

trustcacerts -file "chainCert.crt" -keystore "<mykeystore>"

6. Add the following connector to the server.xml file in the tomcat\config directory:

<Connector port="8443" maxThreads="200"

scheme="https" secure="true" SSLEnabled="true"

keystoreFile="<mykeystore>" keystorePass="<mypassword>"

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 34 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

clientAuth="false" sslProtocol="TLS"/>

Note: An example <Connector> element for an SSL connector is included in the

default server.xml file installed with Tomcat.

7. Restart Tomcat Server.

8. In the config.properties file, update the this_url property with your secure URL:
a. Navigate to the config.properties file and open it in a text editor.
On a Windows system:

<sc_controller_dir>\tomcat\webapps\scancentral-ctrl\WEB-
INF\classes\config.properties
On a Linux system:

<sc_controller_dir>/tomcat/webapps/scancentral-ctrl/WEB-
INF/classes/config.properties

b. Update the this_url property with your https address and port.
Example: this_url=https://<controller_host>:8443/scancentral-ctrl
See Also
"Securing the Controller for Authorized Client Use Only" below

Securing the Controller for Authorized Client Use Only

You can restrict the use of the ScanCentral Controller to authorized clients only.
To secure the Controller for use by authorized clients only:
1. Navigate to the <sc_controller_dir>/tomcat/webapps/cloud-ctrl/WEB-
INF/classes directory and open the config.properties file in a text editor.
2. Set the client_auth_token property.
3. On the client machine, go to the Core/config directory, and open the
client.properties in a text editor.
The client_auth_token property can be stored in the client.properties file as plain
text, or as an encrypted key. For information about how to generate an encrypted key for
client_auth_token, see "Encrypting the Shared Secret" on page 25.
4. Add the client_auth_token property to the file, and then set the same value for it that
you gave to the client_auth_token property in step 2.
5. Start the Controller.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 35 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

Allowing CloudScan Clients that do not Support Client Authentication to Connect to the
Controller
If you have CloudScan version 19.2.0 or earlier clients that do not support client authentication,
you can enable them to connect to the Controller.
To enable CloudScan version 19.2.0 or earlier clients to connect to the Controller:
1. Navigate to the ControllerTomcat/webapps/cloud-ctrl/WEB-INF/classes
directory and open the config.properties file in a text editor.
2. Set the allow_insecured_clients_with_empty_token property to true.
If you set the allow_insecured_clients_with_empty_token property to false, only
clients that support the client_auth_token can connect to Controller.
Note: If a client (CloudScan 19.2.1 or ScanCentral 20.1.0 and later client) supports the
client_auth_token property and that property value is left unspecified, the client cannot
connect to the Controller even if the allow_insecured_clients_with_empty_token is
set to true, unless the client_auth_token value on the Controller is also left unspecified.

Securing ScanCentral SAST Deployment

The Micro Focus or one of its affiliates Fortify family of products collects and displays information
about an enterprise’s applications. That information includes summaries of the potential security
vulnerabilities uncovered in the source code.
Just as you apply security precautions to your applications, you must also secure access to the
ScanCentral SAST components. The security vulnerability summaries that Fortify products
provide may mandate an even higher level of secure deployment.
ScanCentral SAST works with your code base. Because this information offers various
opportunities for mishandling or abuse, Fortify recommends that you deploy ScanCentral SAST
in a secure operations facility and secure access to ScanCentral SAST installation directories.

Creating ScanCentral SAST Clients

Unless you use a language that supports offloading the translation phase of analysis to your
sensors, you must have a licensed copy of Fortify Static Code Analyzer on each of the machines
you plan to use as ScanCentral SAST clients. If you use a language that supports offloading the
translation phase of analysis to your sensors, you can create standalone clients, independent of
Fortify Static Code Analyzer.
The languages that support offloading the translation phase of analysis are:
l Python
l Ruby
l JavaScript

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 36 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

l PHP
l Java
l ABAP (Advanced Business Application Programming)
l Apex (Salesforce)
l Classic ASP (ASP Classic)
l Adobe ColdFusion
l PL/SQL / T-SQL
l Microsoft TypeScript
l Visual Basic 6.0
l .NET applications (C#, VB.NET, .NET Core, ASP.NET, and .NET Standard)
Caution! As you specify an installation path, make sure that the path name contains no
spaces.

Creating a Standalone Client

If you plan to offload both the translation and scanning phases of analysis to your ScanCentral
SAST sensors, you can use standalone clients.
To create a standalone client (independent of Fortify Static Code Analyzer):
l Extract the contents of the Fortify_ScanCentral_Client_<version>_x64.zip file to
any directory on your machine.

Creating an Embedded Client Using Static Code Analyzer

Use the following procedure to create an embedded client (client included with SCA and Apps) if:
l You do not use a language that supports offloading translation.
and/or
l You do not plan to offload project translation to your sensors.

To create an embedded client:

1. Log on to a build machine using credentials for an account that is not an administrator or
root account.
2. Use the instructions provided in the Micro Focus or one of its affiliates Fortify Static Code
Analyzer User Guide to install Fortify Static Code Analyzer and applications on your build
machine.

Updating a Client
Important! If your Controller version is later than your Fortify Static Code Analyzer
installation version, Fortify recommends that you update the ScanCentral SAST client to the
same version as the ScanCentral Controller. This ensures you are running the most recent

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 37 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

code.

To update a standalone client (independent of Fortify Static Code Analyzer):

l Delete the client, and then extract the Fortify_ScanCentral_Client_<version>_
x64.zip file to any directory on the machine.
Or,
l Extract the contents of the Fortify_ScanCentral_Client_<version>_x64.zip file on
top of the existing client.
To update an embedded client that resides on the same machine as Fortify Static Code Analyzer:
1. Log on to the build machine using credentials for an account that is not an administrator
account or root.
2. Back up the following directories:
On a Windows system:
l <sca_install_dir>\bin
l <sca_install_dir>\Core\lib
l <sca_install_dir>\Core\config
On a Linux system:
l <sca_install_dir>/bin
l <sca_install_dir>/Core/lib
l <sca_install_dir>/Core/config
3. Upgrade Fortify Static Code Analyzer. For instructions on how to install and upgrade
Fortify Static Code Analyzer, see the Micro Focus or one of its affiliates Fortify Static Code
Analyzer User Guide.
4. Accept all overwrite requests.
Note: On a Linux system, you may also need to run chmod +x ScanCentral (in the
<sca_install_dir>/bin/ScanCentral directory).

Tip: After you configure a client, you can copy the configuration files and use them to create
other clients.

See Also
"(Windows only) Configuring Sensors to Offload Translation For .NET Languages" on page 42
"Configuring Sensors to Use the Progress Command when Starting on Java" on page 41

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 38 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

Creating ScanCentral SAST Sensors

To make it convenient for network administrators to isolate traffic to ScanCentral SAST sensors,
Fortify recommends that you install sensors in a separate subnet. Use the sensors only as scan
boxes. ScanCentral SAST supports only one sensor per machine.

Creating a Sensor Using Static Code Analyzer 20.2.0

The following procedure describes how to create a new sensor. For information about how to
upgrade an existing sensor, see "Upgrading ScanCentral SAST Sensors" on page 48.

Note: If you use Windows, you can install the sensor as a Windows service. For instructions,
see "Creating a ScanCentral SAST Sensor as a Service" below.

To create a sensor:
1. Log in to the build machine using an account that is not an administrator or root.
2. Install Fortify Static Code Analyzer 20.2.0. (For instructions, see the Micro Focus or one of its
affiliates Fortify Static Code Analyzer User Guide.)
3. Create a file named worker.properties in the <sca_install_dir>\Core\config
directory.
4. Add the following property to the worker.properties file:
worker_auth_token=<value_set_in_controller_configuration>
5. Specify either a clear text password, or an encrypted shared secret (password the Controller
uses to communicate with the sensor) as the worker.properties value. For information
about how to generate an encrypted shared secret, see "Encrypting the Shared Secret on a
Sensor" on page 26.
6. Save and close your worker.properties file.

Creating a ScanCentral SAST Sensor as a Service

If you use Windows services, you can install the sensor as a Windows service.
To install the sensor as a Windows service:
1. Navigate to the <sca_install_dir>\bin\ScanCentral-worker-service directory, and then
do one of the following:
l To use a clear text password, run setupworkerservice.bat <sca_version>
<full_sc_controller_url> <shared_secret>
l To use an encrypted password, run setupworkerservice.bat <sca_version>
<full_sc_controller_url> "<encrypted_shared_secret>" <path_to_
pwtool.keys_file>

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 39 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

Important! Make sure that you enclose <encrypted_shared_secret> in

quotation marks. This ensures that the encrypted shared secret does not get
corrupted when the services installer creates the worker.properties file.
For information about how to encrypt a shared secret, see "Encrypting the Shared Secret
on a Sensor" on page 26.
2. Start the service, as follows:
net start FortifyScanCentralWorkerService
The services installer creates the <sca_install_dir>\Core\config\worker.properties
file for you.
See Next
"Enabling Sensor Auto-Start on Windows as a Service" on page 63
See Also
"Fortify ScanCentral SAST Components" on page 20
"Creating ScanCentral SAST Sensors" on the previous page

Changing Sensor Expiration Time

By default, sensors expire 168 hours after they become inactive. To reset this default value:
1. Navigate to the <sc_controller_dir>/tomcat/webapps/scancentral-ctrl/WEB-
INF/classes directory, and open the config.properties file in a text editor.
2. Locate the worker_expiry_delay setting, and then change the number of hours to elapse
after inactivity before sensors expire.
See Also
"Creating ScanCentral SAST Sensors" on the previous page

Support for Multiple Fortify Static Code Analyzer Versions

To support heterogeneous environments and facilitate phased Fortify Static Code Analyzer
upgrades, the ScanCentral Controller supports scan request routing based on the Fortify Static
Code Analyzer version. For example, you can configure two different client machines, each with a
different Fortify Static Code Analyzer version, and configure the sensors with compatible
Fortify Static Code Analyzer versions. Jobs from each client are then routed to the sensor that has
the same Fortify Static Code Analyzer version installed.
If you have an existing Fortify Static Code Analyzer installation (with an included
scancentral.bat) in your path and a mixed version environment, make sure that you are
running the latest ScanCentral SAST executable when you run the client and sensor commands.
(Use explicit paths.) Adding capacity (new clients or sensors) is simple—just clone the VMs you
have already configured, or use sensor hosts with the same specifications and installation folder
structure.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 40 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

Important! If you clone VMs, you must remove the worker_persist.properties file
from sensor work directory (current directory when starting sensor) after cloning.

Note: Use sensor machines dedicated to ScanCentral SAST and run sensors under a
dedicated username. Run only one sensor instance per machine, and do not run any other
Java processes under the same username after you start the ScanCentral Controller.

If the Controller and Fortify Software Security Center run on different machines, you must check
to make sure that scancentral-ctrl\WEB-INF\classes\config.properties (ssc_
url, this_url) and the ScanCentral Controller URL set on Fortify Software Security Center
(select Administration > Configuration > ScanCentral SAST) resolve to the correct IP
addresses.
Check to make sure that the following channels of communication are not blocked by a firewall or
other tool:
l Controller to Fortify Software Security Center port (for scan uploads)
l Fortify Software Security Center to the ScanCentral Controller port (for Fortify ScanCentral
SAST administration console functionality)
l Clients to the ScanCentral Controller port
l Sensors to the ScanCentral Controller port
l Clients to the Fortify Software Security Center port (required only if Fortify Software Security
Center is in lock down mode, or if the -sscurl option is used)

Configuring Sensors to Use the Progress Command when

Starting on Java
If you plan to start your ScanCentral SAST sensors on Java, and you want to use the progress
command to check the progress of your Fortify Static Code Analyzer scans, the following sensor
configuration is required:
1. Create a JMX access file, and add the following text to it:
<user_role> readonly
where <user_role> is text that represents something like a username.
2. Create a JMX password file, and add the following text to it:
<user_role> <password> readonly
where <user_role> is the value you specified in the JMX access file.
3. Run one of the following commands:
l On Windows systems, run cacls jmxremote.password /P <username>:R
l On Linux systems, run chmod 600 jmxremote.password
4. Open the worker.properties file in a text editor, and then add the following properties to
it:

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 41 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

sca_jmx_port=<port>
sca_jxm_access_file=<path_to_access_file>
sca_jmx_password_file=<path_to_password_file>
sca_jmx_password=<password>
sca_jxm_user=<user_role>
sca_jmx_auth=true
5. Save and close the worker.properties file.
After you complete this configuration, ScanCentral SAST clients start on the specified port using
JMX password authentication. Make sure that the port is not already bound.

Important! If you use sca_jmx_auth, you can start only one sensor. Any attempt to
open a new Fortify Static Code Analyzer instance results in a bind port error. To have
multiple sensors on a machine, you must have several ScanCentral SAST instances, each
with its own worker.properties file.

(Windows only) Configuring Sensors to Offload Translation

For .NET Languages
If you plan to use your ScanCentral SAST sensors for remote translation of code written in a
.NET language, make sure that the following requirements are met.
ScanCentral SAST client machine requirements:
l Java 8
l MSBuild (version that corresponds to the version released with Visual Studio 2019, or earlier)

l NuGet (optional)

l .NET Framework, .NET Core, or .NET Standard, depending on project configuration

l Windows operating system

ScanCentral SAST sensor machine requirements:

l Java 8
l .NET Framework supported for Fortify Static Code Analyzer

l Windows operating system

Beginning with (CloudScan) version 19.2.0, remote translation and scanning for .NET and
ASP.NET projects were supported. ScanCentral SAST supports the same MSBuild versions as
Fortify Static Code Analyzer. (.NET packaging and scanning works only on Windows systems.)
The requirements for using this feature are as follows:
l Configure at least one sensor with the software required to support .NET capability.
l Clients must have the software required to build and pack .NET projects installed.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 42 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

Enabling .NET Translation Capability on Sensors

To enable remote translation of .NET, do the following:
l Install the .NET Framework version that Fortify Static Code Analyzer supports. (See the Micro
Focus Fortify Software System Requirements document.)
After you start ScanCentral SAST, it automatically detects the .NET Framework version installed
and displays a message that .NET capability is enabled for the detected .NET Framework version.
This indicates that the sensor can now translate .NET projects built with same or earlier .NET
Framework version. The rule is not applied to .NET Core or .NET Standard because any .NET
Framework version can scan this kind of project.
Remote translation of .NET is disabled if:
l .NET Framework is not installed on the sensor.
l A .NET Framework version earlier than the supported version (for Fortify Static Code
Analyzer) is installed on the sensor.
Important! To avoid Windows errors caused by too long a path during .NET translation,
Fortify strongly recommends that you start ScanCentral SAST sensors from a folder with a
short name and path. For more information, see https://docs.microsoft.com/en-
us/windows/win32/fileio/naming-a-file.

Using the MSBuild ScanCentral SAST Integration

To use MSBuild ScanCentral SAST integration, the required MSBuild version must be on the
PATH. To make sure the project is built correctly, Fortify recommends that you start ScanCentral
SAST from the Visual Studio command prompt, which sets the required .NET variables
automatically.
Some projects also require that you start NuGet to restore some dependencies. If any
dependencies are unresolved, the MSBuild would fail and the scan results might be incomplete.
For these kinds of projects, you need to install NuGet manually on the machine and make sure it is
available on the PATH. If NuGet is found, ScanCentral SAST runs it automatically.
To translate and scan a .NET project on ScanCentral SAST, run the following:

scancentral -url <scancentral_url> start --build-tool msbuild --build-

file <solution file name or path to solution file> [--save-package]
Note that --build-file is required for .NET projects because the solution name is a custom-
named file and ScanCentral does not try to detect the *.sln file.
Alternatively, you can save the project package locally, as follows:

scancentral package -o <path to package> --build-tool msbuild --build-

file <solution file>
To send the package to ScanCentral SAST, run:

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 43 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

scancentral -url <scancentral_url> start -package <package path>

ScanCentral SAST returns a job ID that you can use to track the scan.

Excluding .NET Projects from Translation

The ScanCentral SAST 20.2.0 client does not support the Fortify Static Code Analyzer flag -
exclude-disabled-projects. To exclude a .NET project from translation, you must use the
ScanCentral SAST arguments command. Invoke the arguments action and specify the -targs
flag with -exclude Src/<excluded_project> value, where excluded_project is the
project directory.
The following example shows how to exclude SubprojectB from translation and scanning:

ProjectRoot
+- MySolution.sln
+- SubprojectA
+- SubprojectA.csproj
+- ...
+- SubprojectB
+- SubprojectB.csproj
+- ...

The following command (invoked from project root folder) creates a fortify-sca.settings
file under ProjectRoot:
scancentral arguments -targs -exclude Src/SubprojectB
The following command (invoked from project root folder) starts the remote translation of the
project, with SubprojectB excluded:
scancentral -url <sc_controller_url> start -bt msbuild -bf
<MySolution.sln>

Fortify Static Code Analyzer Mobile Build Session Version

Compatibility
The Fortify Static Code Analyzer version on a ScanCentral client must be compatible with the
Fortify Static Code Analyzer version installed on the sensors. The version number format is
major.minor.patch.buildnumber (for example 19.2.0.0080). The major and minor portions
of the Fortify Static Code Analyzer version numbers on both the ScanCentral client and sensor
must match. For example, 19.2.0 works with 19.2.x.
To check the Fortify Static Code Analyzer version used, run the command
sourceanalyzer.exe –version.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 44 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

Starting the ScanCentral SAST Components

Before you begin to use ScanCentral SAST:
1. If you plan to upload your scan results to Fortify Software Security Center, make sure that
Fortify Software Security Center is up and running.
2. Wait until the Controller is up and running.
3. Check to make sure that the sensors and clients are up and running.

Starting the Controller

To start the Controller:
1. If you plan to upload your scan results to Fortify Software Security Center, check to make
sure that the Fortify Software Security Center instance is running.
2. On the machine that hosts the Controller, navigate to the Tomcat <bin> directory:
On a Windows system:

cd <sc_controller_dir>\tomcat\bin

On a Linux system:

cd <sc_controller_dir>/tomcat/bin

3. Run one of the following commands:

l On a Windows system, run startup.bat.
Note: If Tomcat is running as a service, rather than running start.bat, you can just
start the service.

l On a Linux system, run ./startup.sh.

Starting ScanCentral SAST Sensors

To start the sensors:
1. Start the Controller if it is not already running.
2. On each sensor, navigate to the <sca_install_dir> directory of the installation directory,
as follows:
l On a Windows system, cd <sca_install_dir>\bin
l On a Linux system, cd <sca_install_dir>/bin
3. Run one of the following commands:
On a Windows system:

scancentral.bat –url <sc_controller_url> worker

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 45 of 80
Installation, Configuration, and Usage Guide
Installing and Configuring the Fortify ScanCentral SAST Components

On a Linux system:

./ScanCentral –url <sc_controller_url> worker

If the sensor starts successfully, it prints messages that signal its waiting status to the console.
After you verify that the sensor is working, you can create a Startup Task in Windows Task
Scheduler or add it to your startup scripts. For more information, see "Configuring Sensor Auto-
Start" on page 63.

Note: Make sure that you run a given sensor consistently from the same directory. Otherwise,
its UUID changes and, if ScanCentral SAST is connected to Fortify Software Security Center,
Fortify Software Security Center identifies it as different sensor.

Starting Fortify Software Security Center

Start Fortify Software Security Center. If ScanCentral SAST is integrated with Fortify Software
Security Center, after you log in to Fortify Software Security Center, notice that the Fortify
header now includes the SCANS link. If you do not see the SCANS link in the header, log out, open
a new browser window, and then log in again. If the SCANS link is still missing from the header,
check to make sure that the connection between Fortify Software Security Center and
ScanCentral SAST is set up. (See "Configuring the Connection to Fortify Software Security
Center" on page 59.)

Stopping the Controller

To stop the ScanCentral SAST Controller:
1. On the machine where the Controller is installed, navigate to the Tomcat bin directory:
On a Windows system:

cd <sc_controller_dir>\tomcat\bin

On a Linux system:

cd <sc_controller_dir>/tomcat/bin

2. Type one of the following commands:

On a Windows system:

shutdown.bat
On a Linux system:
./shutdown.sh

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 46 of 80
 Chapter 3: About Upgrading ScanCentral
SAST Components
ScanCentral SAST-related functionality in Fortify Software Security Center requires an updated
ScanCentral SAST Controller and sensors. If you do not need sensor metrics, you can use sensor
versions earlier than version 16.10. You can use existing ScanCentral SAST clients without
limiting functionality (unless you want to specify that a scan request from a client target a specific
sensor pool). If you need remote translation and scan functionality, use client, sensor, and
Controller 19.1.0 or later version.

Important! You must upgrade the Controller before you upgrade the ScanCentral SAST
sensors and clients, and before you upgrade the Fortify Software Security Center server.

Caution! A version 20.2.0 sensor does not support packages generated by version 20.1.0
clients. If you want to offload translation for scan projects uploaded by CloudScan client
19.2.0, do not upgrade your sensors to ScanCentral SAST version 20.2.0.

This section contains the following topics:

Upgrading the ScanCentral SAST Controller 47
Upgrading ScanCentral SAST Sensors 48
Enabling and Disabling Auto-Updates of Clients and Sensors 50

Upgrading the ScanCentral SAST Controller

The following procedure described how to upgrade the Controller.

Caution! Before you upgrade the Controller, you must first download and configure a Java
Runtime Environment (JRE). For information about supported JRE versions, see the Micro
Focus Fortify Software System Requirements guide. For information about how to download
and configure JRE, see the Oracle documentation for the supported JRE version.

Note: The following compatibility rules apply to remote translation:

- The version 20.2.x Controller assigns jobs from ScanCentral versions 19.2.x and 20.1.x to
Fortify Static Code Analyzer 20.1.x only.
- You cannot use Fortify Static Code Analyzer 19.2.x with a version 20.2.x Controller. This
also applies to remote scans.

To upgrade your ScanCentral Controller:

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 47 of 80
Installation, Configuration, and Usage Guide
Upgrading ScanCentral SAST Sensors

1. Go to one of the following Software Licenses and Downloads Portal sites:

l https://entitlement.microfocus.com
l https://entitlement.mfgs.microfocus.com (for US Government solutions)
2. Download the Fortify_ScanCentral_Controller_<version>_x64.zip file.
Note: For detailed instructions on how to download Micro Focus Software, see
https://www.brainshark.com/mfLD/vu?pi=zFszsRA7ezW1H3z0&nodesktopflash=1.

3. (Recommended) Allow all jobs to finish.

Note: If you do not allow all jobs to finish before you shut down the Controller,
some jobs fail after the upgrade, and the failure may not be evident for some time.
(See the worker_inactive_delay configuration parameter in the <new_sc_
controller_dir>/tomcat/webapps/scancentral-ctrl/WEB-
INF/classes/config.properties file.)

4. Shut down the Controller.

5. Install the new Controller. (For information, see "Installing the Controller" on page 21.)
6. If your existing config.properties file has been modified, you must merge it with the new
config.properties file. (You cannot simply copy the existing config.properties file.)
7. Navigate to the jobFiles and cloudCtrlDb directories of the existing Controller, and then
copy these to the new Controller.
Note: To change these directories, edit the config.properties file.
8. Start the new Controller. (The database is automatically migrated.)
See Also
"About Upgrading ScanCentral SAST Components" on the previous page
"Upgrading ScanCentral SAST Sensors" below
"Enabling and Disabling Auto-Updates of Clients and Sensors" on page 50

Upgrading ScanCentral SAST Sensors

To upgrade your ScanCentral SAST sensors (on either Windows or Linux), you can either install
the latest version of Fortify Static Code Analyzer, or unzip the scancentral.zip file.
Tip: You can configure automatic upgrades of both ScanCentral SAST sensors and clients.
For details, see "Enabling and Disabling Auto-Updates of Clients and Sensors" on page 50.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 48 of 80
Installation, Configuration, and Usage Guide
Upgrading ScanCentral SAST Sensors

To upgrade sensors by installing or upgrading Fortify Static Code Analyzer:

1. Stop all sensors from running.
2. Go to one of the following Software Licenses and Downloads Portal sites:
l https://entitlement.microfocus.com

l https://entitlement.mfgs.microfocus.com (for US Government solutions)

3. Download the installer file for your operating system:
l Windows: Fortify_SCA_and_Apps_<version>_windows_x64.exe
l macOS: Fortify_SCA_and_Apps_<version>_osx_x64.app.zip
l Linux: Fortify_SCA_and_Apps_<version>_linux_x64.run
Note: For detailed instructions on how to download Micro Focus Software, see
https://www.brainshark.com/mfLD/vu?pi=zFszsRA7ezW1H3z0&nodesktopflash=1.

4. Install or upgrade Fortify Static Code Analyzer based on the instructions provided in the
Micro Focus Fortify Static Code Analyzer User Guide.
5. Check the <sca_install_dir>\Core\config directory to make sure that the
worker.property file resides there.
6. Add the following property to the worker.properties file:
worker_auth_token=<value_set_in_controller_configuration>
7. Specify either a clear text password, or an encrypted shared secret (password the Controller
uses to communicate with the sensor) as the worker.properties value. For information
about how to generate an encrypted shared secret, see "Encrypting the Shared Secret on a
Sensor" on page 26.
8. Save the worker.properties file.
9. Start the sensors.
See Also
"About Upgrading ScanCentral SAST Components" on page 47
"Enabling and Disabling Auto-Updates of Clients and Sensors" on the next page
"Upgrading the ScanCentral SAST Controller" on page 47
"Creating ScanCentral SAST Clients" on page 36
"Creating ScanCentral SAST Sensors" on page 39

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 49 of 80
Installation, Configuration, and Usage Guide
Enabling and Disabling Auto-Updates of Clients and Sensors

Enabling and Disabling Auto-Updates of Clients

and Sensors
You can have all ScanCentral SAST clients and sensors check with the Controller after a manual
update and following each startup to determine whether updates are available (the client or
sensor version is earlier than the Controller version). Then, if an update is available, the Controller
updates all sensors and clients.

Important! ScanCentral SAST clients and sensors check for updates only if you use the -
url, -sscurl, or -ssctoken options. The package command will not start the update
process.

To enable or disable automatic updates of your clients and sensors:

1. Navigate to the <sc_controller_dir>/tomcat/webapps/scancentral-ctrl/WEB-
INF/classes directory and open the config.properties file in a text editor.
2. Locate the client_auto_update property.
3. To enable auto-updates, set client_auto_update to true . To disable auto-updates, set
the value to false (the default).
4. Save and close the file.
The update process (and its resulting success or failure status) is printed to the console.

Important! If Fortify Static Code Analyzer and applications are installed in a location that
requires that a user have administrator privileges to modify them (for example, program files),
in order to update the sensor, you must start it with administrator privileges. Otherwise, the
sensor cannot write files to disk. If auto-update is enabled, the update process on sensors and
clients must finish successfully before the sensor can start.

See Also
"About Upgrading ScanCentral SAST Components" on page 47
"Upgrading the ScanCentral SAST Controller" on page 47

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 50 of 80
 Chapter 4: Submitting Scan Requests
Depending on the language used to develop your source code, you can request a scan that
offloads only the scanning phase of code analysis, or a scan that offloads both project translation
and scanning to your ScanCentral SAST sensors.

Offloading Scanning Only

To submit a scan request that offloads only the scanning phase of code analysis, run the following
command:

scancentral.bat –url <sc_controller_url> start -b <my_build_id> -scan –Xmx2G

You can pass any relevant Fortify Static Code Analyzer scan tuning option (for example, –Xmx to
specify the amount of memory for a scan) on the command line after the –scan keyword. If you
use options such as –build-label, -build-application, or –build-version, make sure
that you escape any quotes around the parameter. For example:

-scan –Xmx2G –build-label \"Application 5.4 – September 20, 2017\"

If the submission succeeds, you receive a token ID. The Fortify ScanCentral SAST sensor pulls the
scan request from the Controller, processes it, and publishes the results to the Controller.
For information about the options to use for larger scans, see the Micro Focus or one of its
affiliates Fortify Static Code Analyzer User Guide.

Note: Jobs submitted (and FPRs) can be no larger than 1GB. Before you start large scans,
review "Optimizing Scan Performance" on page 69.

Targeting a Specific Sensor Pool for a Scan

Request
To target a specific sensor pool for a scan request, you must have:
l UUID for the sensor pool
l pool_mapping_mode property set to enabled or disabled
To get the UUID for the sensor pool:
1. Log on to Fortify Software Security Center.
2. On the Fortify header, select SCANS.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 51 of 80
Installation, Configuration, and Usage Guide
Offloading Both Translation and Scanning

3. In the left panel, select Sensor Pools.

The Sensor Pools table lists the existing sensor pools.
4. In the Sensor Pools table, copy the value shown in the Pool UUID column for the sensor
pool you want to target for a scan request.
Note: All sensors that are unassigned and enabled are used, even they are not assigned
to sensor pools.

To specify a sensor pool to use for a scan request:

l From the command line on the client host, run the following:

scancentral.bat –url <sc_controller_url> start -b <mybuildid> -pool

<uuid> -scan

Offloading Both Translation and Scanning

If you use a supported language, you can offload both translation and scanning phases of code
analysis to your ScanCentral SAST sensors. If your build tool is Apache Maven, Gradle, or
MSBuild, include the -bt option.

Note: The -bt option is required for all technologies. For projects without a build tool, -bt is
set to none.
In the examples shown in the following table, ScanCentral SAST is integrated with Fortify
Software Security Center, email is configured for ScanCentral SAST, and Fortify Software
Security Center, the Controller, and sensors are up and running.

Objective Command

Start a job to scan a Gradle project scancentral.bat -url <controller_

url> start -bt gradle

Start a job to scan a Maven project with a scancentral.bat -url <controller_

non-default build file url> start -bt mvn -bf
c:\myproj\myproj-pom.xml

Start a job to scan a Gradle project, get scancentral.bat -url <controller_

email notifications from the Controller, and url> start -bt gradle -email
upload the results to Fortify Software [email protected] -upload -uptoken
Security Center <ssc_upload_token> -application
“MyProject” -version “1.0”

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 52 of 80
Installation, Configuration, and Usage Guide
Translating Python Projects

Translating Python Projects

Objective Command

Start a job to scan a Python 2 project scancentral.bat -url <controller_

url> start -bt none –python-version
2 -python-requirements <path_to_
requirements_file>

Start a job to scan a Python project under scancentral.bat -url <controller_

an active virtual environment with url> start -bt none
dependencies already installed

Start a job to scan a Python project under scancentral.bat -url <controller_

an active virtual environment without url> start -bt none --python-
project dependencies installed requirements <path_to_requirements_
file>

Start a job to scan a Python project using scancentral.bat -url <controller_

an existing Python virtual environment and url> start -bt none --python-
install project dependencies virtual-env <virtual_environment_
location> --python-requirements
<path_to_requirements_file>

You can use ScanCentral SAST to work with Python in any of three ways. You can start
ScanCentral SAST in a prepared virtual environment (see "Starting ScanCentral SAST in a Virtual
Environment" below). You can use an existing virtual environment, without activating that virtual
environment (see "Starting ScanCentral SAST in an Unactivated Virtual Environment" on the next
page). In this case, ScanCentral SAST activates the virtual environment itself. Finally, you can start
the job outside of a virtual environment (see "Starting ScanCentral SAST Outside of a Virtual
Environment" on the next page).

Starting ScanCentral SAST in a Virtual Environment

If you work in a virtual environment, all of your project dependencies are already installed. You do
not need to invoke the pip package manager before you start ScanCentral SAST, or to specify the
Python version (this is detected automatically).
To start ScanCentral SAST in a virtual environment:
1. Open a command line.
2. Activate the virtual environment.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 53 of 80
Installation, Configuration, and Usage Guide
Translating Python Projects

3. Start ScanCentral SAST.

Example: scancentral.bat -url <controller_url> start -bt none
If pip dependencies are not yet installed in the virtual environment used, ScanCentral
SAST installs them automatically using the requirements file:

scancentral.bat -url <controller_url> start -bt none --python-requirements <path_to_

requirements_file>

Starting ScanCentral SAST in an Unactivated Virtual Environment

To start ScanCentral SAST in a virtual environment (with all dependencies installed) without
activating that virtual environment:
1. Open a command line.
2. Start the Python project scan:
scancentral -url <controller_url> start -bt none --python-virtual-
env <venv_location>
or

scancentral -url <controller_url> start -bt none --python-virtual-

env <venv_location> --python-requirements <path_to_requirements_
file>
ScanCentral SAST goes to the virtual environment, determines the Python version used,
packages all required libraries, and then creates the package.

Starting ScanCentral SAST Outside of a Virtual Environment

If you plan to start ScanCentral SAST and there is no virtual environment on the client, you must
have Python installed on the client, specify the Python version, and specify the Python
requirements file. ScanCentral SAST locates the Python installation. In this case, ScanCentral
SAST creates a temporary virtual environment, installs all dependencies from the requirements
file, and then generates the package.
To start ScanCentral SAST outside of a virtual environment:
1. Open a command line.
2. Start ScanCentral SAST.
3. Run the following:

scancentral –url <controller_url> start -bt none --python-

requirements <path> --python-version <version>

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 54 of 80
Installation, Configuration, and Usage Guide
Translating Apex Projects

Translating Apex Projects

To perform remote translation of an Apex project, you must have Java 8 installed on your sensor.
In addition, you must specify an additional translation argument for the project so that Fortify
Static Code Analyzer "knows" that the CLS files are related to Apex, and not to Visual Basic 6.
To prepare for scanning, run the following:

scancentral arguments -targs "-apex"

Note: For information on using the -sargs and -targs options, see the "Arguments
Command" section in "Submitting Scan Requests" on page 51.

To scan the project using ScanCentral SAST, run the following:

scancentral -url <controller_url> start -bt none

Alternatively, you can save the project package locally, as follows:

scancentral package -o <path to package> -bt none

To send an existing package to ScanCentral SAST, run the following:

scancentral -url <controller_url> start -package <package path>

ScanCentral SAST returns a job ID that you can use to track the scan.

Translating SQL Projects

To perform remote translation of a SQL project, you must have Java 8 installed on your sensor. In
addition, you must specify an additional translation argument for the project so that Fortify Static
Code Analyzer "knows" what type of SQL (T-SQL or PL/SQL) is required. (By default, on
Windows, Fortify Static Code Analyzer uses T-SQL, but on UNIX, it uses PL/SQL.)
To prepare a SQL project for scanning, run the following:

scancentral arguments -targs "-sql-language <PL/SQL OR TSQL>"

Note: For information on using the -sargs and -targs options, see the "Arguments
Command" section in "Submitting Scan Requests" on page 51.

To scan the project, run the following command:

scancentral -url <controller_url> start -bt none

Alternatively, to save the package locally, run:
scancentral package -o <path to package> -bt none

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 55 of 80
Installation, Configuration, and Usage Guide
Using the PackageScanner Tool

To send existing package to ScanCentral SAST, run:

scancentral -url <controller_url> start -package <package path>

ScanCentral SAST returns a job ID that you can use to track the scan.
See Also
"Fortify ScanCentral SAST Command Options" on page 70
"Submitting Scan Requests" on page 51
"Submitting Scan Requests and Uploading Results to Fortify Software Security Center" on
page 60

Using the PackageScanner Tool

The packagescanner tool (packagescanner.bat on Windows and packagescanner on Linux)
takes a package generated using the ScanCentral package command, generates Fortify Static
Code Analyzer commands, and then performs a scan using a locally installed Fortify Static Code
Analyzer instance. The tool is located in the <sca_install_dir>/bin directory.
The command-line options used with the packagescanner tool are described in the following
table.

Option Description

-b <id> (Optional) Specifies the build ID. Fortify

Static Code Analyzer uses the build ID to
track which files are compiled and combined
as part of a build, and later, to scan those
files.

-fpr (Required) Path of saved FPR files

-package (Required) Path to the package generated by

the packagescanner command

-sargs, --scan-arguments Command-line options used to scan a project

-sca-path (Optional if started from Fortify Static Code

Analyzer and apps) Path to the Fortify Static
Code Analyzer executable

--sca-scan-log (Optional) Log for all scan commands. By

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 56 of 80
Installation, Configuration, and Usage Guide
Retrieving Scan Results from the Controller

Option Description

default, the log file is created in a temp folder,

which is removed after program execution.

--sca-translation-log (Optional) Log for all translation commands.

By default, the log file is created in a temp
folder, which is removed after program
execution.

-targs, --translation-arguments Command-line options used to translate a

project

(Optional) -version PackageScanner version

Retrieving Scan Results from the Controller

To retrieve scan results, run the following command:

scancentral.bat -url <sc_controller_url> retrieve -token <tokenid> -f worker.fpr

-log worker.log

Viewing Scan Request Status

To view the status of a scan request, run the following command:

scancentral.bat –url http://<Controller_Host>:8080/scancentral-ctrl status -

token <tokenid>

You can also view scan request status from the Fortify Software Security Center user interface.
For instructions, see the Micro Focus Fortify Software Security Center User Guide.

If You use the Jenkins Master / Agent Architecture

If you use the Jenkins Master / Agent architecture and the Fortify ScanCentral SAST client
(Jenkins Agent) performs the Fortify Static Code Analyzer translation, the Jenkins Agent must
know whether the Fortify Static Code Analyzer scan is completed and the FPR is correctly
uploaded to Fortify Software Security Center.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 57 of 80
Installation, Configuration, and Usage Guide
Viewing Client and Sensor Logs

Viewing Client and Sensor Logs

To view the ScanCentral client and sensor logs on a Windows system:
l Navigate to %FORTIFY_HOME%\scancentral\log, where %FORTIFY_HOME% is
${win32.LocalAppdata}\Fortify.
On Windows 10, for example, the location is C:\Users\<user>\AppData\Local\Fortify.
If you have separate installs, the log is located at: <sc_client_dir>\bin\Fortify
\log\ScanCentral.log
To view the ScanCentral client and sensor logs on a Linux system, navigate to the following
directories:
l To retrieve the ScanCentral log, navigate to
~/.fortify/ScanCentral/log/ScanCentral.log.
l To retrieve the ScanCentral Controller log, navigate to <sc_controller_
dir>\tomcat\logs\ScanCentralCtrl.log on Windows and to <sc_controller_
dir>/tomcat/logs/ScanCentralCtrl.log on Linux.
l To retrieve the Fortify Software Security Center log, navigate to <fortify.home>/<app_
context>/logs.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 58 of 80
 Chapter 5: Working with ScanCentral
SAST from Fortify Software Security
Center
While you can deploy the Controller in standalone mode, communication with Fortify Software
Security Center provides additional benefits. If Fortify Software Security Center is integrated with
ScanCentral SAST, then the Fortify Software Security Center Scans view includes the ScanCentral
SAST pages, which are described in the following table.

Scans View Page Functionality

Scan Requests View and export ScanCentral SAST scan request details
Cancel prepared scan requests

Controller View Controller information

Sensors View sensor information

Sensor Pools Create and manage groups of sensors to which you can target
scan requests.

For detailed information, see the Micro Focus Fortify Software Security Center User Guide.
See Also
"Configuring the Connection to Fortify Software Security Center" below

Configuring the Connection to Fortify Software

Security Center
While the Controller can be deployed in standalone mode, communication with Fortify Software
Security Center provides additional benefits:
l The Fortify Software Security Center user interface includes a Scans view that makes it easy to
view the status of recent scan requests.
l The Controller can upload scan results directly to Fortify Software Security Center application
versions.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 59 of 80
Installation, Configuration, and Usage Guide
Submitting Scan Requests and Uploading Results to Fortify Software Security Center

l You can create and manage ScanCentral SAST sensor pools from Fortify Software Security
Center. (For information about sensor pools, see the Micro Focus Fortify Software Security
Center User Guide.)
To integrate Fortify Software Security Center with ScanCentral SAST:
1. Log in to Fortify Software Security Center as an administrator, and then, on the Fortify
header, click ADMINISTRATION.
2. In the left panel, select Configuration, and then select ScanCentral SAST.
The ScanCentral SAST page opens.
3. To enable the polling of Controller to retrieve scan request status, select the Enable
ScanCentral SAST check box.
4. In the ScanCentral Controller URL box, type the URL for the Controller.
5. In the ScanCentral poll period (seconds) box, either select or type the number of seconds
to elapse between ScanCentral SAST polls.
6. In the SSC and ScanCentral Controller shared secret box, type the password for Fortify
Software Security Center to use when it requests data from the Controller. (If you use clear
text, this string must match the value stored in the Controller config.properties file for
the ssc_scancentral_ctrl_secret key.
Note: The ssc_cloudctrl_secret key is supported for backward compatibility with
Fortify CloudScan.

7. Click SAVE.
8. Restart the Fortify Software Security Center server.
Important! You must use the same or a later version of ScanCentral SAST as the
Fortify Static Code Analyzer version installed on your clients.

See Also
"Working with ScanCentral SAST from Fortify Software Security Center" on the previous page
"Starting the ScanCentral SAST Components" on page 45

Submitting Scan Requests and Uploading Results

to Fortify Software Security Center
To submit a scan request, the results of which you want to upload to an application version in
Fortify Software Security Center, use the fortifyclient tool to obtain the application version ID,
and access tokens from Fortify Software Security Center. You can reuse the token for future
requests. For information about how to use the fortifyclient tool, see the Micro Focus Fortify
Software Security Center User Guide.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 60 of 80
Installation, Configuration, and Usage Guide
Submitting Scan Requests and Uploading Results to Fortify Software Security Center

Note: The Fortify Software Security Center user account must have permission to upload
scan results for the application version, and must have access to the application version on
Fortify Software Security Center. A user who submits a ScanCentral SAST job for upload to a
Fortify Software Security Center application version must use a token that was obtained
using an account that has permission to upload scan results. If a Fortify Software Security
Center user is assigned to a target application version with a view-only role, and that user
requests a token and uses it to submit the job, the upload fails.

To submit a job to be uploaded to an application version:

1. Open a command prompt, and then type the following command:

fortifyclient.bat listApplicationVersions -url <ssc_url> -user <user> -

password <pwd>

Sample Output

ID Name Version

10 ScanCentral Test 1.0

12 ScanCentral Test 2.0

4 Bill Payment Processor 1.1

3 Logistics 2.5

2 Logistics 1.3

8 RWI 2.0

5 RWI 1.0

2. To generate a Controller token, run the following command:

fortifyclient.bat token -gettoken ScanCentralCtrlToken -url <ssc_url> -user

<user> -password <pwd>

Authorization Token: <..scancentralCtrlToken...>

3. To submit your job and upload your scan results to a Fortify Software Security
Center application version, run one of the following commands:

scancentral.bat -sscurl <ssc_url> -ssctoken <ScanCentralCtrlToken> start -

upload -versionid 10 -b <mybuildId> -uptoken <ScancentralCtrlToken> -scan –
Xmx2G

Note: Instead of –versionid <version id>, you can pass –-application

<application_name> --application-version <version_name>. The

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 61 of 80
Installation, Configuration, and Usage Guide
Submitting Scan Requests and Uploading Results to Fortify Software Security Center

<application_name> and <version_name> must match the values in Fortify

Software Security Center. These values are case sensitive.

Typically, the steps above are combined into a scripted flow from a build server.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 62 of 80
 Appendix A: Configuring Sensor Auto-
Start
The following procedures are designed to provide general guidance to enable sensor auto-start
and may not be appropriate in all environments. Fortify strongly recommends that you review the
instructions with your system administrator and make any changes required for your
environment.
This section contains the following topics:
Enabling Sensor Auto-Start on Windows as a Service 63
Enabling ScanCentral Sensor Auto-Start on Windows as a Scheduled Task 64
Enabling ScanCentral Sensor Auto-Start on a Linux System 67

Enabling Sensor Auto-Start on Windows as a

Service
Check to make sure the Controller is running before you perform the following procedure.
To enable sensor auto-start on Windows as a service:
1. Log in to the sensor machine as a local admin user.
Note: Sensors are dedicated machines that are meant only to run Fortify Static Code
Analyzer on behalf of ScanCentral SAST; they are not shared with any other service. To
avoid issues associated with insufficient privileges, use a fully-privileged administrative
account for the auto-start setup.
2. Open a command prompt and navigate to the <sca_install_dir>\bin\ScanCentral-
worker-service directory.
3. Run the setupworkerservice.bat script with no arguments to see the usage help.
4. Re-run the batch script with the required arguments included.
5. Open Windows Services and check to make sure that the sensor service is present.
6. Right-click the listed sensor service, and then select Start.
7. Fortify recommends that you change the startup type setting to Manual until you verify that
the sensor runs successfully. After verification, change the startup type setting to Automatic
(Delayed Start) in Windows Services.
8. Check to make sure that the sensor communicates with the Controller.
See Also

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 63 of 80
Installation, Configuration, and Usage Guide
Enabling ScanCentral Sensor Auto-Start on Windows as a Scheduled Task

"Creating a ScanCentral SAST Sensor as a Service" on page 39

Troubleshooting
Review the following logs to troubleshoot issues encountered during the configuration of sensor
auto-start as a Windows service:
l Main ScanCentral SAST sensor log:
On Windows

C:\Windows\System32\config\systemprofile\AppData\Local\Fortify\
scanCentral\scancentral.log
On Linux

.fortify/scancentral/log/scancentral.log
l Sensor temporary folders that contain MBS files, Fortify Static Code Analyzer log files, and
generated FPR files: c:\ScanCentralWorkdir\<job_token>
l Sensor stdOut and stdErr logs: c:\ScanCentralWorkdir\workerout.log and
c:\ScanCentralWorkdir\workererr.log
Note: Before you start a sensor, check to make sure that the log files are not open in an
application. Open log files prevent procrun from writing to the file.
l Commons-daemon log: c:\ScanCentralWorkdir\<year_month_day>.log

Enabling ScanCentral Sensor Auto-Start on

Windows as a Scheduled Task
1. Log on to the sensor machine as the local admin user.
Note: Sensors are dedicated machines that are meant only to run Fortify Static Code
Analyzer on behalf of Fortify ScanCentral SAST; they are not shared with any other
service. To avoid issues related to insufficient privileges, use a fully-privileged
administrator account for the auto-start setup.

2. Start the Task Scheduler.

3. In the Actions panel, select Create Task.
The Create Task window opens.
4. On the General tab, provide the following information:
a. In the Name box, type a name for the task.
b. Select the Run whether user is logged on or not option.
5. Select the Actions tab, and then click New.
The New Action dialog box opens.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 64 of 80
Installation, Configuration, and Usage Guide
Enabling ScanCentral Sensor Auto-Start on Windows as a Scheduled Task

a. From the Action list, select a program to start.

b. In the Program/script box, type the directory path to your scancentral.bat file.
Example: <sca_install_dir>\bin\scancentral.bat
c. In the Add arguments (optional) box, type the following:

–url http://<host>:<port>/scancentral-ctrl worker >taskout.txt

2>&1
d. In the Start in (optional) box, type the path to the ScanCentral sensor bin directory.
Example: <sca_install_dir>\bin\
e. Click OK.
6. Return to the Task Scheduler and select the Triggers tab.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 65 of 80
Installation, Configuration, and Usage Guide
Enabling ScanCentral Sensor Auto-Start on Windows as a Scheduled Task

7. Check to make sure that the At startup trigger is enabled, and then click OK.
8. Select the Settings tab.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 66 of 80
Installation, Configuration, and Usage Guide
Enabling ScanCentral Sensor Auto-Start on a Linux System

9. Make sure the Stop the task if it runs longer than check box is cleared, and then click OK.
10. Click Save.
11. Restart the machine.
The script output in the taskout.txt file indicates whether the sensor started successfully.
You can also start and stop the scheduled task manually from the Task Scheduler interface when
logged into the machine.

Enabling ScanCentral Sensor Auto-Start on a

Linux System
Note: The following procedure has been tested with Red Hat; there may be some variation
for other Linux varieties. Please review these steps with your system administrator before
you make any changes.

1. Log in to the machine as “root.”

2. Run the visudo command to edit the sudoers file and disable requiretty.

Defaults !requiretty

Note: You can also disable requiretty per user.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 67 of 80
Installation, Configuration, and Usage Guide
Enabling ScanCentral Sensor Auto-Start on a Linux System

3. Set auto-start, as follows:

a. Verify the command invocation from the console (modify according to your install
directory).

sudo -u <username> -- <sca_install_dir>/bin/ScanCentral -url <sc_

controller_url> worker > <sca_install_dir>/bin/workerout.txt 2>&1
&
o Add the sudo command to the end of the file (add it before the line exit 0 if it
exists).
o The ampersand (&) at the end enables the machine to boot up even if sensor startup
fails or hangs.
oThe double-dash (--) is important to separate the options for sudo from the options
for your service.
b. Make the change to the startup file.
Caution! Make sure that you do not change anything else in your bootup script.

vi /etc/rc.d/rc.local
4. Check the setup:
a. Reboot and log in to the machine as “root.”
b. To verify the processes under root, type:

ps -x | grep java
c. Verify that the output shows that the sensor is not started under root.
d. To verify the processes under the user, type:

sudo -u <username> ps x | grep java

e. Verify that the output displays the sensor process.
f. To verify the existence and contents of the script output file, type:

tail -f/opt/<sca_install_dir>/bin/workerout.txt
Example: tail -f/Fortify/Fortify_SCA_and_Apps_
<version>/bin/workerout.txt

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 68 of 80
 Appendix B: Optimizing Scan Performance
If you plan to regularly scan large applications, Fortify recommends that you run a manual test
scan on hardware that is equivalent to the hardware on which your sensor is installed.
To optimize your scan:
1. To set the Fortify Static Code Analyzer scan parameters for optimal performance, adjust the
memory settings to align with your hardware.
For information about how to tune Fortify Static Code Analyzer, see the Micro Focus or one
of its affiliates Fortify Static Code Analyzer User Guide.
2. Run the scan.
3. Note the size of the resulting FPR file and scan log. To ensure that the ScanCentral
Controller and Fortify Software Security Center can accept FPR or log files larger than 1 GB,
increase the following file size threshold:
l Navigate to the <scancentral_install_dir>\tomcat\webapps\scancentral-
ctrl directory on Windows (<scancentral_install_
dir>/tomcat/webapps/scancentral-ctrl on Linux) , open the
config.properties file, and then set the Controller threshold as follows:
max_upload_size=<max_fpr_or_logfile_size_in_MB>

The default value is 1024.

4. Check to make sure that your Fortify Software Security Center hardware and application
startup parameters are set to process very large FPR files. For more information, see the
Micro Focus or one of its affiliates Fortify Static Code Analyzer User Guide.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 69 of 80
 Appendix C: Fortify ScanCentral SAST
Command Options
This appendix provides information about the command-line options that you can use with
Fortify ScanCentral SAST.

Global Options
This section provides information about the command-line options that you can use with Fortify
ScanCentral SAST.

Global Option Use to:

-h <command> Get help for the selected command. To see all command help, type
or -h all.

--help <command>

-ssctoken <token> Specify the Fortify Software Security Center cloud authorization
token.

-sscurl <url> Specify the Fortify Software Security Center server URL.

-url <url> Specify the ScanCentral SAST Controller URL.

-version Get the product version.

Status Command
Use the status command to check the status of the Controller or a job.

Option Description

-ctrl Verify that the Controller is running.

-token, --job-token <token> Specify the job token to query.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 70 of 80
Installation, Configuration, and Usage Guide
Start Command

Start Command
Use the start command to start a remote scan.

Option Description

-application, --application Specifies the Fortify Software Security Center application

<name> name.

--application-version-id Specifies the Fortify Software Security Center

application version ID.

-bc, --build-command For use with Maven, Gradle and MSBuild. Specifies custom
<commands> build parameters for preparing and building a project. For
example, to invoke a Gradle build before packaging:
-Prelease=true clean customTask build
If you use the -bc option, and the build fails, ScanCentral
stops working on the build.

If you do not use -bc, the default command assemble is

invoked. If the build fails, ScanCentral displays a warning,
but continues to work and then displays a message to
indicate that the build procedure failed and your results
may be incomplete.

-b, --build-id <id> Specifies the build ID of the session to export.

-bf, --build-file <file> Specifies the build file, unless it has a default name such as
build.gradle or pom.xml. You cannot use this option
with the -scan option.

-block Waits for the job to complete, and then downloads the
result.

-bt, --build-tool <name> Specifies the build tool name used for the project. You
cannot use this option with the -scan option.

-exclude-disabled-projects A boolean flag. If specified on the Fortify Static Code

Analyzer command line, no disabled projects are translated.
By default (without the switch), all projects in the solution,
disabled or enabled, are translated.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 71 of 80
Installation, Configuration, and Usage Guide
Start Command

Option Description

Note: This switch is for the Fortify Static Code

Analyzer command line, not the MSBuild command
line. No environment variable is associated with this
flag, but you can get the same behavior from the
MSBuild integration by setting the
ScaExcludeDisabledProjects property to true
on the MSBuild command line.

-email <address> Specifies the email address for job status notifications.

-f, --output-file <file> Specifies the name for the local FPR file output.

-filter <file> Specifies the filter file to use during a scan (repeatable).

-hv, --php-version <version> Specifies the PHP version.

-log, --log-file <file> Specifies the name for the local log file output.

-mbs <file> Specifies the mobile build session to upload.

-o, --overwrite Overwrites the existing FPR or log with new data.

-p, --package <file> Specifies the project package file to upload.

-pool, --submit-to-pool <uuid> Specifies the sensor pool to which to submit the job.

-projroot, --project-root <dir> Specifies the project directory for the mobile build session
export.

-projtl, --project-template <file> Specifies the issue template file to include.

-pyr, --python-requirements Specifies the Python project requirements file to install and
<file> collect dependencies.

-pyv, --python-virtual-env Specifies the Python virtual environment location.

<directory>

-q, --quiet Prevents the printing of stdout from the build execution.

-rules <file/dir> Specifies custom rules file or directory to use during the

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 72 of 80
Installation, Configuration, and Usage Guide
Start Command

Option Description

scan (repeatable).

-scan Sets the point beyond which all arguments are for
sourceanalyzer. You cannot use this option with the
--build-tool or --package option.

--scan-node-modules Specifies node_modules dependencies in the package. If

you set --scan-node-modules, all third-party library
scan results are added to the resulting FPR.

Tip: Because including node_modules dependencies in

a package does not greatly improve type resolution or
dataflow, and can result in an excessive number of
false positives, Fortify recommends that you exclude
them from scans. By default, node_modules are not
applied to a package unless you apply the --scan-
node-modules option from the command line.

-skipBuild Disables the project preparation build step before

packaging.

If you use -skipBuild option, the -bc option (if used) is

ignored.

-sp, --save-package <file> Specifies the package file to save after uploading. The file
extension must be *.zip.

-t, --include-test Includes test source set (Gradle) or test scope (Maven) to
scan (for Java projects only).

-upload, --upload-to-ssc Uploads the FPR to Fortify Software Security Center upon
completion.

-uptoken, --ssc-upload token Specifies the Fortify Software Security Center file upload
<token> token.

-version, --application-version Specifies the Fortify Software Security Center application

<name> version name.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 73 of 80
Installation, Configuration, and Usage Guide
Retrieve Command

Option Description

-yv, --python-version <version> Specifies the Python version to automatically find the
installed Python. Allowed values: 2 or 3. This flag is ignored
if the ScanCentral SAST client is started under a Python
virtual environment or if -python-virtual-env is
specified.

Retrieve Command
Use the retrieve command to download the result of a remote scan job.

Option Description

-block Wait for the job to complete and download

the result.

-f, --output-file <file> Specify the file name for local FPR output.

-log, --log-file <file> Specify the file name for local log output.

-o, --overwrite Overwrite the existing FPR or log with new

data.

-token, --job-token <token> Specify the job token to query.

Cancel Command
Use the cancel command to cancel a remote scan job.

Option Description

-token, --job-token <token> Specify the job token to query.

Worker Command
Use the worker command to start or test a sensor.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 74 of 80
Installation, Configuration, and Usage Guide
Package Command

Option Description

-hello Sensor reporting for duty.

Package Command
Use the package command to create a zip package of the specified project.

Option Description

-bc, --build-command <commands> Specify custom build parameters for preparing

and building a project. For example, to invoke a
Gradle build before packaging:
-Prelease=true clean customTask
build
If you use the -bc option, and the build fails,
ScanCentral stops working on the build.

If you do not use -bc, the default command

assemble is invoked. If the build fails,
ScanCentral SAST displays a warning, but
continues.
You can use this option with Maven, Gradle
and MSBuild.

-bf, --build-file <file> Specify the build file if you are not using a
default name such as build.gradle or
pom.xml. You cannot use this option with the
-scan option.

-bt, --build-tool <name> Specify the build tool name used for the
project. You cannot use this option with the -
scan option.

-hv, --php-version <version> Specify the PHP version.

-o, --output <file> Specify the output file name. The file extension
must be *.zip.

-pyr, --python-requirements <file> Specify the Python project requirements file to

install and collect dependencies.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 75 of 80
Installation, Configuration, and Usage Guide
Package Command

Option Description

-pyv, --python-virtual-env <directory> Specify the Python virtual environment

location.

-q, --quiet Prevent the printing of stdout from the build

execution.

--scan-node-modules Specifies node_modules dependencies in the

package. If you set --scan-node-modules,
all third-party library scan results are added to
the resulting FPR.

Tip: Because including node_modules

dependencies in a package does not
improve type resolution or dataflow
results, and because they degrade
translation and scan speed, Fortify
recommends that you exclude them from
scans. By default, node_modules are not
applied to a package unless you apply the
--scan-node-modules option from the
command line.

-skipBuild Disables the project preparation build step

before packaging.

-t, --include-test Include the test source set (Gradle) or test

scope (Maven) to scan (for Java projects only).

-yv, --python-version <version> Specify the Python version to automatically

find the installed Python. Allowed values: 2 or
3. This flag is ignored if the ScanCentral SAST
client is started under a Python virtual
environment or if -python-virtual-env is
specified.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 76 of 80
Installation, Configuration, and Usage Guide
Arguments Command

Arguments Command
Use the arguments command to generate a settings file for additional Fortify Static Code
Analyzer command-line options.

Option Description

-o, --overwrite Overwrite the existing arguments file.

-p, --project-dir <directory> Specify the project directory in which to create the Fortify
Static Code Analyzer translation and scan additional
arguments file.

-sargs, --scan-args Fortify Static Code Analyzer scan arguments

(repeatable)

-targs, --translation-args Fortify Static Code Analyzer translation arguments

(repeatable)

Important! The -targs and -sargs options take a single string argument. To specify
multiple translation or scan arguments, use multiple -targs and (or) -sargs options. If the
translation or scan option has a path parameter that includes a space, enclose the path in
single quotes.

Example: The following generates a fortify-sca.settings file in the current directory.

scancentral.bat arguments -o -targs "-Xmx4G" -targs "-cp 'myProject

Dir/path to/lib/*.jar'" -targs "-exclude 'myProject Dir/path
to/src/*.js'" -sargs "-Xms256M" -sargs "-analyzers
controlflow,dataflow"
The resulting fortify-sca.settings file looks similar to the following:

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 77 of 80
Installation, Configuration, and Usage Guide
Packagescanner Command

{
"translationArgs": [
"-Xmx4G",
"-cp",
"myProject Dir/path to/lib/*.jar",
"-exclude",
"myProject Dir/path to/src/*.jar"
],
"scanArgs": [
"-Xms256M",

"-analyzers",
"controlflow,dataflow"
]

Packagescanner Command
Use the help command (-h or --help) to get the information listed in the following table.

Option Description

-b, --build-id <id> Specifies the build ID. Fortify Static Code Analyzer uses
the build ID to track which files are compiled and
combined as part of a build, and later, to scan those files.

-fpr (Required) fpr path

-package (Required) Path to the package file generated by the

ScanCentral SAST command-line interface.

-sargs, --scan-arguments (Optional) Additional Fortify Static Code Analyzer scan

options. Enclose multiple options in quotes separated by
spaces, or repeat this option for each Fortify Static Code
Analyzer option and parameter.

-sca-path (Optional if ScanCentral SAST is part of the SCA and

apps installation) Path to the Fortify Static Code
Analyzer executable file. If ScanCentral SAST is part of
SCA and Apps, the path is determined automatically.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 78 of 80
Installation, Configuration, and Usage Guide
Progress Command

Option Description

-sca-scan-log (Optional) Fortify Static Code Analyzer scan log file path

-sca-translation-log (Optional) Fortify Static Code Analyzer translation log

file path

-targs,--translation-arguments (Optional) Fortify Static Code Analyzer translation

options. Enclose multiple options in quotes separated by
spaces, or repeat this option for each Fortify Static Code
Analyzer option and parameter.

Progress Command
Use the progress command to get the progress of a Fortify Static Code Analyzer scan.
Important! If your projects are based on Java 11, and you want to use the progress
command to check the progress of your scans, some minor sensor configuration is required.
For instructions, see "Configuring Sensors to Use the Progress Command when Starting on
Java" on page 41.

Accessing Help for Command-Line Options

To access help for command-line options on a client or sensor, navigate to the <sca_install_
dir> bin, and then run one of the following:
-h
-h start
-h worker
-h <any_command_listed_with_help>
For a complete list of all command-line options, see "Fortify ScanCentral SAST Command Options"
on page 70.

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 79 of 80
Send Documentation Feedback
If you have comments about this document, you can contact the documentation team by email.

Note: If you are experiencing a technical issue with our product, do not email the documentation
team. Instead, contact Micro Focus Fortify Customer Support at
https://www.microfocus.com/support so they can assist you.

If an email client is configured on this computer, click the link above to contact the documentation team
and an email window opens with the following information in the subject line:
Feedback on Installation, Configuration, and Usage Guide (Fortify ScanCentral SAST 20.2.0)
Just add your feedback to the email and click send.
If no email client is available, copy the information above to a new message in a web mail client, and send
your feedback to [email protected].
We appreciate your feedback!

Micro Focus or one of its affiliates Fortify ScanCentral SAST (20.2.0) Page 80 of 80