About Configure Management Host Header Checking

Starting in IBM® Sterling Secure Proxy 6.0.3.0, SSP Configuration Manager validates the Host Header passed from the client in the HTTP requests it gets and uses it when sending a redirect to client/browser.

It now enforces a list of acceptable hostnames which the client may pass in their host headers, to ensure that the session is not getting spoofed.

SSPCM web sessions are rejected if the hostname in the URL https://<hostname>:<port>/SSPDashboard does not match the hostnames in the new <SSPCM>/conf/cmconfig.properties file.

To correct this, the SSP Admin should update the file to add the list of hostnames that the SSPCM machine may be known by. Update the <SSPCM>/conf/cmconfig.properties file and change the following line to add the possible hostnames that users may use to access the SSPCM GUI.

from:

#cm.alternate.hosts=

to:
cm.alternate.hosts=hostname1,hostname2.mycompany.com,localhost,10.20.30.40

Alternatively, SSPCM hostname checking can be turned off altogether by changing the following line in that same file

from:
#cm.bypass.host.header.check=false

to:
cm.bypass.host.header.check=true