Redirect HTTP to HTTPS in QRadar SOAR on Red Hat Enterprise Linux by Editing server.xml and Updating firewalld

Steps

This is a note related to redirecting http to go to Https.

WARNING: This has not been tested with all components of SOAR or SOAR apps. 

1. Backup web configuration files that will be altered:

   cp -p /usr/share/co3/conf/server.xml /usr/share/co3/conf/server.xml.org
   cp -p /usr/share/co3/conf/web.xml /usr/share/co3/conf/web.xml.org
   cp -p /etc/firewalld/zones/public.xml /etc/firewalld/zones/public.xml.org

2. Edit files that were backed-up:
   Add in the lines that are in purple:

   vi /usr/share/co3/conf/server.xml

   ... ... <Service name="Co3"> <Connector port="80" protocol="HTTP/1.1" server="Co3" redirectPort="443"/> <Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol" maxThreads="${maxThreads}" connectionTimeout="15000" ... ...

   vi /usr/share/co3/conf/web.xml

   <web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0"> <!--require HTTPS for all urls --> <security-constraint> <web-resource-collection> <web-resource-name>HTTPSOnly</web-resource-name> <url-pattern>/*</url-pattern> </web-resource-collection> <user-data-constraint> <transport-guarantee>CONFIDENTIAL</transport-guarantee> </user-data-constraint> </security-constraint> <!-- ================ Introduction ================== --> <!-- This document defines default values for *all* web applications -->

3. Restart Resilient for the changes to take effect.

   systemctl restart resilient

4. Modify Firewall rule to allow port 80

   firewall-cmd --zone=public --add-port=80/tcp --permanent

   This adds a line to /etc/firewalld/zones/public.xml:

   more /etc/firewalld/zones/public.xml <?xml version="1.0" encoding="utf-8"?> <zone> <short>Public</short> <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted .</description> <service name="ssh"/> <service name="dhcpv6-client"/> <port protocol="tcp" port="22"/> <port protocol="tcp" port="443"/> <port protocol="tcp" port="65000"/> <port protocol="tcp" port="65001"/> <port protocol="tcp" port="80"/>

5. Restart the firewall Daemon for the changes to take effect.

   systemctl reload firewalld