Encrypting the shared secret on the Controller

Values exist in the Controller configuration file as plain text. You can encrypt the passwords,

authentication tokens, and other values for the following properties:

l

client_auth_token

l

lim_license_pool_password

l

lim_proxy_password

l

lim_proxy_user

l

smtp_auth_pass

l

ssc_ctrl_account_username

l

ssc_ctrl_account_password

l

ssc_scancentral_ctrl_secret

l

swagger_password

l

swagger_username

l

worker_auth_token

To encrypt a shared secret on the Controller:

1. At the command prompt, type the following:

<controller_install_dir>/bin/pwtool <pwtool_keys_file>

2. When prompted, type the password to encode, and then press Enter.

Note: For the sake of security, make sure that the pwtool key file you use to encrypt secrets

for the Controller is different from the pwtool key file you use to encrypt secrets on sensors.

Page 47 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 3: About the Fortify ScanCentral SAST Controller

The pwtool generates a new key stored in the file on the path specified in step 1 or reuses an

existing file on the specified path.

3. Copy the encrypted secret, and paste it as the value for the property you want to encrypt in the

config.propertiesfile.

Tip: OpenText recommends that you assign separate, unique shared secrets for the

client_auth_token, smtp_auth_pass, ssc_scancentral_ctrl_secret, and worker_

auth_tokenproperties.

4. To create additional encrypted shared secrets, repeat steps 1 through 3 for each property value

you want to encrypt.

5.

Uncomment the following property in the config.propertiesfile:

pwtool_keys_file=<pwtool_keys_file>

Save and close the config.propertiesfile.

6.

See also

"Locating log files" on page 106

Configuring the Controller logging

You can configure the Controller logging settings by setting environment variables on the system

where you installed the Controller. The following table describes the environment variable settings

you can use to configure the Controller logging.

Environment

variable name

Default value

Description

CONSOLE_OUT_

FILTER_ON_

MATCH

Specifies the threshold filter for log

messages that are written to the

deny

console. By default, the setting of deny

specifies that the log messages are not

printed to the console. The valid values

for this variable are deny, neutral, and

accept. For more information about

these values, see the Apache Logging

Services Log4j manual for configuring

filters.

LOG_FILE_FILTER_

ON_MATCH

Specifies the threshold filter for log file

messages. By default, the setting of

neutral

neutralspecifies that the messages

are printed to the log file. Setting this

variable to denydisables logging to file.

Page 48 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 3: About the Fortify ScanCentral SAST Controller

Environment

variable name

Default value

Description

SCANCENTRAL_

LOG_LEVEL

Specifies the log level for Fortify

ScanCentral SAST. For more

information about log levels , see the

Apache Logging Services Log4j

website.

info

SCANCENTRAL_

SPRING_LOG_

LEVEL

Specifies the log level for Spring. For

more information about log levels , see

the Apache Logging Services Log4j

website.

warn

20MB

SCANCENTRAL_

HIBERNATE_LOG_

LEVEL

Specifies the log level for Hibernate. For

more information about log levels , go

to the Apache Logging Services Log4j

website.

SCANCENTRAL_

LOG_FILE_SIZE

Specifies the maximum size for the log

file. If the log file reaches this size, the

log file is archived and a new log file is

created.

SCANCENTRAL_

ARCHIVED_LOGS_

NUMBER

Specifies the maximum number of log

files that are archived before new log

files start replacing the oldest log files.

20

SCANCENTRAL_

LOGS_FOLDER

Specifies the location of Fortify

ScanCentral SAST Controller log folder.

${sys:catalina.base}/logs

Avoiding read timeout errors

To avoid read timeout errors that can occur during attempts to upload large log files, you can

configure the connection timeout between the Controller and Fortify Software Security Center,

between the Controller and sensors, and between the Controller and clients.

Page 49 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 3: About the Fortify ScanCentral SAST Controller

To configure the connection timeout between the Controller and Fortify Software Security Center:

1.

2.

On the Controller, open the <controller_install_dir>/tomcat/webapps/scancentral-

ctrl/WEB-INF/classes/config.propertiesfile in a text editor.

Increase the value of the ssc_restapi_connect_timeoutand ssc_restapi_read_timeout

properties to an acceptable threshold (in milliseconds).

3. Save the changes.

To configure the connection timeout between the Controller and a sensor:

1.

2.

On the sensor machine, open the <sast_install_dir>/Core/config/worker.properties

file in a text editor.

Uncomment the restapi_connect_timeoutand restapi_read_timeoutproperties, and

then set the value of each to an acceptable threshold (in milliseconds).

3. Save the changes.

To configure the connection timeout between the Controller and a client:

1.

2.

On the client machine, open the <client_install_dir>/Core/config/client.properties

file in a text editor.

Uncomment the restapi_connect_timeoutand restapi_read_timeoutproperties, and

then set the value of each to an acceptable threshold (in milliseconds).

3. Save the changes.

See also

"Configuring clients" on page 71

Configuring licensing with Fortify License and Infrastructure

Manager

Fortify ScanCentral SAST sensors can run OpenText SAST with Fortify License and Infrastructure

Manager (LIM). With a LIM managed concurrent license, multiple sensors can share a single license.

When a scan job is completed, canceled, times out, or fails, the license is released.

For information about how to set up the LIM with licenses for OpenText SAST, see OpenText™ Fortify

License and Infrastructure Manager Installation and Usage Guide. To configure the Controller to use

LIM, specify the LIM properties as described in "Configuring the Controller" on page 37.

Page 50 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 3: About the Fortify ScanCentral SAST Controller

Placing multiple standalone clients on the Controller

You can place multiple standalone clients of different supported versions on the Controller. To do

this, place any number of client ZIP files for all supported versions into the <controller_install_

dir>/tomcat/client/directory. You can use any ZIP file names. At startup, the Controller parses

the available clients.

To install a patch for a client or sensor version installed on the Controller, place the patch ZIP file into

the <controller_install_dir>/tomcat/client/directory. If automatic updates is enabled, the

clients of that version are automatically updated with the patch. For information about how to enable

automatic updates of your clients and sensors, see "Enabling automatic updates of clients and

sensors" on page 79.

Starting the Controller

You can start the Fortify ScanCentral SAST Controller manually or set it to start automatically, as a

service. For information about how to start the Controller automatically, see "Installing the Controller

as a Windows service" on page 29.

To start the Controller manually:

1. To upload your scan results to Fortify Software Security Center, make sure that the Fortify

Software Security Center instance is running.

2.

On the machine that hosts the Controller, go to tomcat/bin/.

3. At the command prompt, run one of the following commands:

l

On a Windows system, run startup.bat.

l

On a Linux system, run ./startup.sh.

If Tomcat is running as a service, rather than running the startup command, you can just start the

service.

Placing the Controller in maintenance mode

An abrupt shutdown of the Fortify ScanCentral SAST Controller can result in the loss of scans already

started on sensors. To prevent this from happening, place your Controller in maintenance mode. After

you do, the Controller accepts no new job requests from clients and assigns no queued jobs to

sensors.

After the Controller is placed in maintenance mode, sensors complete the scans they are currently

running, but accept no new scans. After the Controller is back up and running, the sensors again

become available.

Page 51 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 3: About the Fortify ScanCentral SAST Controller

Tip: If the Controller is in maintenance mode, you can manually shut down any sensor that is not

running a scan.

1. Sign in to Fortify Software Security Center as an Administrator and open the ScanCentral view.

2.

3.

On the navigation pane of the SAST page, select Controller.

Click START MAINTENANCE MODE.

The Controller receives the maintenance request from Fortify Software Security Center and, if any

sensors are running scans, the Controller mode changes from ACTIVE to WAITING_FOR_JOB_

COMPLETED. If no job is being processed, the mode changes directly from ACTIVE to

MAINTENANCE. At this point, you can safely shut down the Controller.

"Safely shutting down sensors" on page 67

"Removing the Controller from maintenance mode" below

Removing the Controller from maintenance mode

To remove the Fortify ScanCentral SAST Controller from maintenance mode:

1. Sign in to Fortify Software Security Center as an Administrator and open the ScanCentral view.

2. On the navigation pane of the SAST page, select Controller.

3.

Click END MAINTENANCE MODE.

"Stopping the Controller" below

Stopping the Controller

You can stop the Fortify ScanCentral SAST Controller immediately using the following procedure.

However, OpenText strongly recommends that you first place the Controller in maintenance mode to

preserve any scans that are running.

To stop the Controller:

1.

On the machine where the Controller is installed, go to <controller_install_

dir>/tomcat/bin/:

2. Type one of the following commands:

l

On a Windows system: shutdown.bat

l

On a Linux system: ./shutdown.sh

Page 52 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 3: About the Fortify ScanCentral SAST Controller

"Removing the Controller from maintenance mode" on the previous page

"Safely shutting down sensors" on page 67

Fortify ScanCentral SAST API

Fortify ScanCentral SAST provides a RESTful API that enables you perform tasks described in the

following table. The tasks are grouped by the grouping in the API Documentation (Swagger UI).

Tasks you can perform

Request group

Retrieve the scan requests from the Controller, report job status, and upload

artifacts

sensor-

controller

Work with scan jobs such as running a new scan or canceling a job

job-controller

Get information from the Controller such as the Fortify Software Security Center info-controller

URL

Check for client or sensor updates

update-

controller

Check to see if the Controller is running

core-controller

To use the Fortify ScanCentral SAST API, your application makes an HTTP request and parses the

response. The Fortify ScanCentral SAST API uses JSON and XML as its communication format and

the standard HTTP methods of GET, POST, and DELETE. URIs have the following structure:

The following is an example cURL:

curl -X 'GET' \

'https://my_ctrl_host:8080/scancentral-ctrl/rest/v4/job/a2f0fe34-f810-

4c76-8e0b-86dfb4f40c9c/status' \

-H 'accept: */*' \

-H 'fortify-client: my_secret'

Authentication

Authenticate your API request with a Fortify ScanCentral SAST authentication token. Use the value of

the client_auth_tokenor the worker_auth_tokenfrom the config.propertiesfile for the

Controller depending on the request. Set the same authentication token in the fortify-client

Page 53 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 3: About the Fortify ScanCentral SAST Controller

header that is set for the client_auth_token. Similarly, set the same authentication token in the

fortify-workerheader that is set for worker_auth_token. The following table lists which

authentication token is used for each request group.

Authentication token

Request group

sensor-controller

job-controller

client_auth_token worker_auth_token

x

info-controller

update-controller

core-controller

x

Accessing the Fortify ScanCentral SAST API documentation

(Swagger UI)

The documentation describes the input, output, and API endpoints. It also provides the ability to test

the endpoints before using them in production.

To access this documentation:

1. Configure the credentials for access to the documentation in the Controller

config.propertiesfile with the two properties: swagger_usernameand swagger_

password.

For more information, see "Configuring the Controller" on page 37.

2. Open a browser and visit <controller_url>/rest/swagger-ui/index.html.

Note: OpenAPI documentation in JSON format is available at <controller_url>/rest/api-docs.

Page 54 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Chapter 4: About Fortify ScanCentral SAST

sensors

Fortify ScanCentral SAST sensors are computers set up to receive scan requests and analyze code

using OpenText SAST. A sensor accepts either a project package that contains sources and

dependencies, which it translates and scans or it accepts a mobile build session (MBS) file and

performs a scan.

For MBS scans, Fortify ScanCentral SAST supports all languages that OpenText SAST supports. For

remote translation and scans of the projects, your project must be in a language supported for remote

translation. For more information, see "Languages supported for remote translation" on page 25.

Tip: As you set up your Fortify ScanCentral SAST environment, you can use subnets to segment

your build machines from the sensors. The build machines need only communicate with the

Controller, which in turn communicates with the sensors.

This section contains the following topics:

Safely shutting down sensors

Installing sensors

To make it convenient for network administrators to isolate traffic to Fortify ScanCentral SAST

sensors, OpenText recommends that you install sensors in a separate subnet. Use the sensors only as

scan boxes.

Installing a sensor using OpenText SAST

The following procedure describes how to create a new sensor. For information about how to upgrade

an existing sensor, see "Upgrading sensors" on page 77.

If you use Windows, you can install the sensor as a Windows service. For instructions, see "Installing a

sensor as a service" on the next page.

To install a sensor:

1. Use the instructions provided in the OpenText™ Static Application Security Testing User Guide

to install OpenText SAST.

Page 55 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 4: About Fortify ScanCentral SAST sensors

Make sure you select Fortify ScanCentral SAST client as a component during the OpenText SAST

installation.

2.

3.

Open the <sast_install_dir>/Core/config/worker.propertiesfile in a text editor.

Specify a value for the worker_auth_tokenproperty.

If you are using a plain text password, use the password set for the worker_auth_token

property in the Controller config.propertiesfile. For information about how to generate an

encrypted shared secret, see "Encrypting the shared secret on a sensor" on page 59.

4.

Save and close your worker.propertiesfile.

See also

"OpenText SAST and Fortify ScanCentral SAST version compatibility" on page 69

"Configuring sensor properties" on page 59

Installing a sensor as a service

If you use Windows services, you can install the Fortify ScanCentral SAST sensor as a Windows

service.

To install the sensor as a Windows service:

1.

Go to the <sast_install_dir>\bin\scancentral-worker-servicedirectory, and then do

one of the following:

l

To use a plain text password, run the following command:

setupworkerservice.bat <sast_version> <controller_url> <shared_

secret>

l

To use an encrypted password, run the following command:

setupworkerservice.bat <sast_version> <controller_url> "<encrypted_

shared_secret>" <path_to_pwtool.keys_file>

Important! Enclose <encrypted_shared_secret> in quotes. This ensures that the

encrypted shared secret does not get corrupted when the services installer creates the

worker.propertiesfile.

where <sast_version> is the <year>.<quarter> portion of the OpenText SAST version (for

example, 25.2).

Caution! The setupworkerservicecommand does not correctly handle worker_auth_

tokentokens that contain the caret character (^). If you must use the caret character as a

part of a worker_auth_token, use the following formula:

saved_caret_count = carets_used_on_command_line / 8

Page 56 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 4: About Fortify ScanCentral SAST sensors

Examples:

For a worker_auth_tokenthat contains a single caret, such as this^that, run the

following command:

setupworkerservice.bat 25.2 https://url.com this^^^^^^^^that

For a worker_auth_tokenthat contains two caret characters, such as this^^that, run the

following command:

setupworkerservice.bat 25.2 https://url.com this^^^^^^^^^^^^^^^^that

For information about how to encrypt a shared secret, see "Encrypting the shared secret on a

sensor" on page 59.

2. Start the service, as follows:

net start FortifyScanCentralWorkerService

The services installer creates the <sast_install_dir>\Core\config\worker.propertiesfile

for you.

See Next

"Enabling sensor auto-start on Windows as a service" on page 64

See also

"Installing sensors" on page 55

Configuring sensors

After you install the Fortify ScanCentral SAST sensors, you can encrypt shared secrets and configure

sensor settings such as the connection and read timeouts, sensor expiration time, job cleanup timing,

and more.

To configure a sensor:

1.

On the sensor machine, open the <sast_install_dir>/Core/config/worker.properties

file in a text editor.

2. Configure the properties described in the following table.

Sensor

property

Description

Specifies a worker authentication token string that contains no spaces or

backslashes to secure the Controller for use by authorized sensors only. Set the

worker_

auth_

token

same value for the worker_auth_tokenproperty that you set for the

worker_auth_tokenproperty on the Controller.

Page 57 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 4: About Fortify ScanCentral SAST sensors

Sensor

property

Description

If you prefer not to use plain text, you can use an encrypted shared secret as

the value for this property. For instructions on how to encrypt a shared secret,

see "Encrypting the shared secret on a sensor" on the next page.

Specifies the path to a file with pwtool keys. If encrypted passwords are used,

pwtool_

keys_file this must specify a file with the pwtool keys used to encrypt the passwords. For

more information, see "Encrypting the shared secret on a client" on page 73.

Specifies the directory where the job files are created. For more information

about customizing persistence for generating job files, see "Configuring where

jobs_dir

to generate job files and the worker_persist.properties file" on page 62.

props_dir Specifies where to save the worker_persist.propertiesfile. For more

information, see "Configuring where to generate job files and the worker_

persist.properties file" on page 62.

Specifies whether to delete the temporary working directory after a scan is

complete. This temporary directory is used to unpack the and

delete_

sca_

build_dir

project package

store temporary files. For more information, see "Preserving the OpenText

.

SAST project root directory" on page 108

Specifies the Controller connection timeout (in milliseconds). The default value

restapi_

connect_

timeout

is 10000(or 10 seconds). You can use this, and the restapi_read_timeout

property to resolve timeout errors between the Controller and the sensor.

Specifies the Controller read timeout (in milliseconds). The default value is

restapi_

read_

timeout

30000(or 30 seconds). You can use this, and the restapi_connect_timeout

property to resolve timeout errors between the Controller and the sensor.

Specifies the age (in hours) job files must be before they are removed from the

sensor working directory.

For more information, see "Configuring job cleanup timing on sensors" on

worker_

cleanup_

age

page 62.

Specifies the frequency (in hours) with which the cleanup process runs. For

more information, see "Configuring job cleanup timing on sensors" on page 62.

worker_

cleanup_

interval

OpenText™ Fortify ScanCentral SAST (25.2.0)

Page 58 of 128

Installation, Configuration, and Usage Guide

Chapter 4: About Fortify ScanCentral SAST sensors

Configuring sensor properties

In addition to setting sensor properties in the <sast_install_

dir>/Core/config/worker.propertiesfile, you can add them to the SCANCENTRAL_VM_OPTS

environment variable. A property value set in the SCANCENTRAL_VM_OPTS environment variable

overrides any equivalent property set in the worker.propertiesfile. The following example sets

the sensor authorization token and the connection timeout between the Controller and a sensor:

l

On a Windows system: set SCANCENTRAL_VM_OPTS=-Dworker_auth_token=<token>

-Drestapi_connect_timeout=10000

l

On a Linux system: export SCANCENTRAL_VM_OPTS=-Dworker_auth_token=<token>

-Drestapi_connect_timeout=10000

Note: You can also set Java system properties (such as -Djava.io.tmpdir=<path>) in the

SCANCENTRAL_VM_OPTS environment variable.

Encrypting the shared secret on a sensor

Values exist in the Fortify ScanCentral SAST sensor configuration file as plain text. You can encrypt

the worker_auth_tokenproperty value.

To encrypt a shared secret on a sensor:

1. At the command prompt, run the following command:

<sast_install_dir>/bin/pwtool <pwtool_keys_file>

2. When prompted, type the password to encode, and then press Enter.

Note: For the sake of security, make sure that the pwtool key file you use to encrypt secrets

for sensors is different from the pwtool key file you use to encrypt secrets on the Controller.

The pwtool generates a new pwtool.keysfile to <pwtool_keys_file> and prints a new

encrypted secret to the console.

3.

4.

Open the worker.propertiesfile in a text editor and update the values for the following

properties:

a.

Copy the encrypted secret and paste it as the value for worker_auth_tokenproperty.

b. Add the name of your pwtool keys file:

pwtool_keys_file=<pwtool_keys_file>

Save and close the worker.propertiesfile.

See also

"Installing sensors" on page 55

Page 59 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 4: About Fortify ScanCentral SAST sensors

Setting the maximum run time for scans

By default, a sensor can run a scan for an indefinite period of time, which prevents it from running

other scans. You can limit the amount of time scans can run on sensors for a specific job, for a specific

sensor, or globally for all sensors.

The following precedence rules apply to timeout settings:

l

Job timeout settings override any sensor-specific or global timeout settings.

l

Sensor timeout configured on the command line overrides a global timeout setting.

Configuring the maximum run time for a specific job

To configure the maximum run time of one minute for a specific job, run the following command:

scancentral -url <controller_url> start --scan-timeout 1

To configure the maximum run time of two minutes for a specific sensor, run the following:

scancentral -url <controller_url> worker --scan-timeout 2

Configuring the maximum run time for all sensors

To configure the maximum run time for all sensors:

1.

2.

3.

Open the <controller_install_dir>/tomcat/webapps/scancentral-ctrl/WEB-

INF/classes/config.propertiesfile in a text editor.

Set the scan_timeoutproperty value to the maximum number of minutes for scans to run on

sensors.

Save and close the config.propertiesfile.

Changing sensor expiration time

By default, sensors expire 168 hours after they become inactive. To change this default value:

1.

2.

3.

Open the <controller_install_dir>/tomcat/webapps/scancentral-ctrl/WEB-

INF/classes/config.propertiesfile in a text editor.

Set the worker_expiry_delayproperty value to the number of hours to elapse after inactivity

before sensors expire.

Save and close the config.propertiesfile.

Configuring sensors for remote translation of .NET languages

To use your Fortify ScanCentral SAST sensors for remote translation of code written in a

.NET language, configure at least one sensor with the software required to support .NET. Sensors on

Page 60 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 4: About Fortify ScanCentral SAST sensors

Windows or Linux can accept any package for remote translation built by MSBuild and dotnet if .NET

capability is enabled. See "Sensor software requirements" on page 22 for specific .NET version

requirements.

After you start a sensor, it automatically detects if a supported version of .NET is installed and

displays a message that .NET capability is enabled. This indicates that the sensor can now translate

.NET projects.

Important! To avoid Windows errors caused by too long a path during a .NET translation, start

sensors from a directory with a short name and path.

See also

"Installing sensors" on page 55

"Starting the sensors" on page 63

Configuring sensors to use the progress command when starting

on Java

To use the progresscommand to check the progress of your OpenText SAST scans, you must

complete the following sensor configuration:

1. Create a JMX access file, and add the following text to it:

<user_role> readonly

where <user_role> is text that represents something like a user name.

2. Create a JMX password file, and add the following text to it:

<user_role> <password> readonly

where <user_role> is the value you specified in the JMX access file.

3. Run one of the following commands:

l

On a Windows system, cacls jmxremote.password /P <username>:R

l

On a Linux system, chmod 600 jmxremote.password

4.

Open the worker.propertiesfile in a text editor, and then add the following properties to it:

sca_jmx_port=<port>

sca_jmx_access_file=<path_to_access_file>

sca_jmx_password_file=<path_to_password_file>

sca_jmx_password=<password>

sca_jmx_user=<user_role>

sca_jmx_auth=true

5.

Save and close the worker.propertiesfile.

Page 61 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 4: About Fortify ScanCentral SAST sensors

After you complete this configuration, Fortify ScanCentral SAST clients start on the specified port

using JMX password authentication. Make sure that the port is not already bound.

Caution! If you use sca_jmx_auth, you can start only one sensor. Any attempt to open a new

OpenText SAST instance results in a bind port error. To have multiple sensors on a machine, you

must have several Fortify ScanCentral SAST instances, each with its own worker.properties

file.

Configuring where to generate job files and the worker_

persist.properties file

For containerized deployments, it is useful to determine where files are generated so that you can

customize persistence. This enables you to persist the worker_persist.propertiesfile, which you

need to maintain sensor pool assignments, without having to keep all the old job files.

Note: If you choose not to configure these locations, the default locations are used. The default

location for the worker_persist.propertiesfile is <working_dir>/props. The default

location for the job files is <working_dir>/jobs.

To configure where job files and the worker_persist.propertiesfile are generated:

1.

On a sensor machine, open the <sast_install_dir>/Core/config/worker.propertiesfile

in a text editor.

2. Specify directories for the following properties:

l

The props_dirproperty specifies where the worker_persist.propertiesfile is saved.

l

The jobs_dirproperty specifies the directory where the job files are created.

3.

Save and close your worker.propertiesfile.

4. Restart the sensor.

Configuring job cleanup timing on sensors

To prevent the progressive loss of disc space as job files accumulate, Fortify ScanCentral SAST

sensors automatically clean up internal job files (packages received from the Controller, FPR files,

logs, and so on), and OpenText SAST build files related to cleaned Fortify ScanCentral SAST jobs.

Although you cannot turn off this feature, you can configure its timing.

Page 62 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 4: About Fortify ScanCentral SAST sensors

To configure the timing of job file cleanup on a sensor:

1.

Open the <sast_install_dir>/Core/config/worker.propertiesfile in a text editor.

2. Configure the following properties based on your scheduling needs.

Default

value

Property

Description

Age (in hours) job files must be before they are

removed from the sensor working directory

168

(one

week)

worker_cleanup_age

1

worker_cleanup_

interval

Frequency (in hours) with which the cleanup process

runs

3.

Save and close your worker.propertiesfile.

4. Restart the sensor.

Starting the sensors

To start the Fortify ScanCentral SAST sensors:

1. Start the Controller if it is not already running.

2.

On each sensor, go to the <sast_install_dir>/bin/directory.

3. Start the sensor by typing the following command:

scancentral –url <controller_url> worker

If the sensor starts successfully, it displays messages to signal its waiting status on the console. After

you verify that the sensor is working, you can create a Startup Task in Windows Task Scheduler or

add it to your startup scripts. For more information, see "Configuring sensor auto-start" below.

Note: Make sure that you run each sensor consistently from the same directory. Otherwise, its

UUID changes and, if Fortify ScanCentral SAST is connected to Fortify Software Security Center,

Fortify Software Security Center identifies it as different sensor.

"Configuring sensor auto-start" below

Configuring sensor auto-start

The following topics provide general guidance to enable sensor auto-start and might not be

appropriate in all environments. OpenText strongly recommends that you review the instructions

Page 63 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 4: About Fortify ScanCentral SAST sensors

with your system administrator and make any changes required for your environment.

Enabling sensor auto-start on Windows as a service

Make sure the Fortify ScanCentral SAST Controller is running before you perform the following

procedure.

To enable sensor auto-start on Windows as a service:

1. Log in to the sensor machine as a local user with administrator permissions.

Sensors are dedicated machines intended only to run OpenText SAST on behalf of Fortify

ScanCentral SAST. Do not share them with any other service. To avoid issues associated with

insufficient permissions, use a fully privileged administrator account for the auto-start setup.

2.

3.

Open a command prompt and go to the <sast_install_dir>\bin\scancentral-worker-

service/directory.

Run setupworkerservice.batwith no options to display the usage help.

4. Re-run the batch script with the required options included.

5. Open Windows Services and check to make sure that the sensor service is present.

6. Right-click the listed sensor service, and then select Start.

7. OpenText recommends that you change the startup type setting to Manual until you verify that

the sensor runs successfully. After verification, change the startup type setting to Automatic

(Delayed Start) in Windows Services.

8. Make sure that the sensor communicates with the Controller.

"Troubleshooting a sensor as a Windows service" on page 107

Enabling sensor auto-start on Windows as a scheduled task

To enable Fortify ScanCentral SAST sensor auto-start on Windows as a scheduled task:

1.

Log on to the sensor machine as a local user with administrator permissions.

Sensors are dedicated machines intended only to run OpenText SAST on behalf of Fortify

ScanCentral SAST. Do not share them with any other service. To avoid issues associated with

insufficient permissions, use a fully privileged administrator account for the auto-start setup.

2. Start the Task Scheduler.

3. In the Actions pane, select Create Task.

4. On the General tab, provide the following information:

a. In the Name box, type a name for the task.

b. Click Run whether user is logged on or not.

5. Click the Actions tab, and then click New.

The New Action dialog box opens.

Page 64 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 4: About Fortify ScanCentral SAST sensors

a. In the Action list, select Start a program.

b.

In the Program/script box, type the directory path to your scancentral.batfile (for

example, <sast_install_dir>\bin\scancentral.bat).

c. In the Add arguments (optional) box, type the following:

–url https://<host>:<port>/scancentral-ctrl worker >taskout.txt 2>&1

d.

In the Start in (optional) box, type the path to the Fortify ScanCentral SAST sensor bin

directory (for example, <sast_install_dir>\bin\).

e. Click OK.

6. Click the Triggers tab.

7. Make sure that the At startup trigger is enabled, and then click OK.

8. Click the Settings tab.

9. Make sure the Stop the task if it runs longer than check box is cleared, and then click OK.

10. Restart the machine.

The script output in the taskout.txtfile indicates whether the sensor started successfully.

You can also start and stop the scheduled task manually from the Task Scheduler when you are

logged into the machine.

Enabling sensor auto-start on a Linux system

The following procedure has been tested with Red Hat® Enterprise Linux®; there might be some

variation for other Linux varieties. Review these steps with your system administrator before you

Page 65 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 4: About Fortify ScanCentral SAST sensors

make any changes.

To enable Fortify ScanCentral SAST sensor auto-start on a Linux system:

1. Log in to the machine as “root.”

2.

Run the visudocommand to edit the sudoersfile and disable requiretty.

Defaults !requiretty

Note: You can also disable requiretty per user.

3. Set auto-start as follows:

a. Verify the command invocation from the console (modify it based on your install directory).

sudo -u <username> -- <sast_install_dir>/bin/ScanCentral -url

<controller_url> worker > <sast_install_dir>/bin/workerout.txt 2>&1

&

o

Add the sudocommand to the end of the file (add it before the line exit 0if it exists).

o

The ampersand (&) at the end enables the machine to start up even if sensor startup fails

or hangs.

o

The double-dash (--) is important to separate the options for sudo from the options for

your service.

b. Make the change to the startup file.

Caution! Make sure that you do not change anything else in your bootup script.

vi /etc/rc.d/rc.local

4. Check the setup:

a. Reboot and log in to the machine as “root.”

b. To verify the processes under root, type:

ps -x | grep java

c. Verify that the output shows that the sensor is not started under root.

d. To verify the processes under the user, type:

sudo -u <username> ps x | grep java

e. Verify that the output displays the sensor process.

f. To verify the existence and contents of the script output file, type:

tail -f /opt/<sast_install_dir>/bin/workerout.txt

Page 66 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 4: About Fortify ScanCentral SAST sensors

For example:

tail -f /opt/Fortify/OpenText_SAST_Fortify_25.2.0/bin/workerout.txt

Safely shutting down sensors

This topic describes how to safely shutdown Fortify ScanCentral SAST sensors from Fortify Software

Security Center.

Important! If the Controller is in maintenance mode, you cannot shut down sensors from Fortify

Software Security Center.

To shut down active sensors:

1. Sign in to Fortify Software Security Center as an Administrator and select the ScanCentral view.

2.

On the navigation pane of the SAST page, select Sensors.

3. In the sensors table, do one of the following:

l

Expand the row for a sensor you want to shut down, and then click SHUT DOWN.

l

Select the check boxes for one or more sensors you want to shut down, and then click

SHUT DOWN.

If the SHUT DOWN button is not enabled, it can mean that:

l

The Controller is in maintenance mode.

l

The sensor is already shut down.

l

The sensor is inactive or disabled.

If a sensor you shut down is running a scan, the State value for the sensor changes from Active to

Shutdown scheduled. After the scan is complete, the state then changes to Inactive.

Page 67 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Chapter 5: About Fortify ScanCentral SAST

clients

A Fortify ScanCentral SAST client can generate packages with sources and dependencies, which are

uploaded to the Controller for remote translation and scan on sensors. You can use this functionality

independent of OpenText SAST.

A Fortify ScanCentral SAST client can also run on a build machine where OpenText SAST translates

code and generates mobile build sessions (MBS). The translated source code, along with optional and

required data, such as custom rules and OpenText SAST command-line options, are uploaded to the

Controller for analysis by sensors.

This section contains the following topics:

Embedded clients and standalone clients

OpenText SAST and Fortify ScanCentral SAST version compatibility

Embedded clients and standalone clients

A client can be either an embedded client, which is part of the OpenText SAST distribution or a

standalone client, which is independent of OpenText SAST. The interface for issuing Fortify

ScanCentral SAST commands is installed on your client. You use this interface to set the options for

the scan and communicate your intentions to the Controller.

Within an OpenText SAST installation, the files used to create Fortify ScanCentral SAST sensors and

embedded clients are the same. The only difference is how you invoke the functionality from the

command line. To use Fortify ScanCentral SAST as a sensor, you run Fortify ScanCentral SAST using

the workercommand. To use Fortify ScanCentral SAST as an embedded client to start a scan, invoke

it using the startcommand. Sensor functionality depends on OpenText SAST. So, you can have a

standalone client, but not a standalone sensor. You can use an embedded client for either local

translation and remote scan or remote translation and scan.

A standalone client does not require the installation of OpenText SAST. You can use it to create a

package of the code with its dependencies to send to the Controller for remote translation and scan.

Page 68 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 5: About Fortify ScanCentral SAST clients

OpenText SAST and Fortify ScanCentral SAST

version compatibility

The OpenText SAST version on a Fortify ScanCentral SAST client must be compatible with the

OpenText SAST version installed on the sensors. The version number format is

<year>.<quarter>.<patch>.<buildnumber> (for example 25.2.0.0.0068). By default, the <year> and

<quarter> portions of the OpenText SAST version numbers on both the client and sensor must

match. For example, version 25.2.0 works with version 25.2.1. For other options of supported version

compatibility, see the Controller configuration property sensor_version_for_all_jobsin

"Configuring the Controller" on page 37.

To determine the OpenText SAST version, run the command sourceanalyzer -version.

Installing clients

Unless you use a language that supports offloading the translation phase of analysis to your sensors,

you must have a licensed copy of OpenText SAST on each machine you plan to use as Fortify

ScanCentral SAST clients. If you use a language supported for remote translation, you can install

standalone clients, independent of OpenText SAST. For a list of languages that Fortify ScanCentral

SAST supports, see "Languages supported for remote translation" on page 25.

In this guide, <client_install_dir> refers to the Fortify ScanCentral SAST client installation directory.

"Installing an embedded client" below

"Installing a standalone client" on the next page

Installing an embedded client

Use an embedded client (client included with OpenText SAST) to perform a local translation before

submitting the remote scan to your sensors.

To install an embedded client:

1. Log on to a build machine using credentials for an account that is not an administrator or root

account.

2. Use the instructions provided in the OpenText™ Static Application Security Testing User Guide

to install OpenText SAST on your build machine.

Make sure you select Fortify ScanCentral SAST client as a component during the OpenText SAST

installation.

Page 69 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 5: About Fortify ScanCentral SAST clients

3.

4.

Go to the <sast_install_dir>/Core/config/directory, and then open the

client.propertiesin a text editor.

Set the same value for the client_auth_tokenproperty that you set for the client_auth_

tokenproperty on the Controller (in the <controller_install_

dir>/tomcat/webapps/scancentral-ctrl/WEB-INF/classes/config.propertiesfile).

For information about how to generate an encrypted shared secret, see "Encrypting the shared

secret on a client" on page 73.

5.

Save and close the client.propertiesfile.

See also

"Installing a standalone client" below

"Configuring client properties" on page 72

Installing a standalone client

To submit scan requests for remote translation and remote scan to your Fortify ScanCentral SAST

sensors, you can use standalone clients. A standalone client is independent of an OpenText SAST

installation.

To install a standalone client:

1. Copy the Fortify ScanCentral SAST client files to your machine by doing one of the following:

l

Install from a Fortify ScanCentral SAST client ZIP file:

i.

Extract the contents of the Fortify_ScanCentral_Client_<version>_x64.zipfile

to any directory on your machine.

Important! Make sure that the installation path contains no spaces.

ii.

On Linux systems, give the scancentral, pwtool, and packagescannerfiles execute

permission.

iii.

Add <client_install_dir>/binto your PATH environment variable.

The <client_install_dir> is the directory where you extracted the Fortify ScanCentral

SAST client ZIP.

iv.

Set the SCANCENTAL_JAVA_HOMEenvironment variable to point to a Java version that

Fortify ScanCentral SAST client supports, and make sure that you add the Java

executable to the PATHenvironment variable.

l

Install the Fortify ScanCentral SAST client as a component of an OpenText™ Application

Security Tools installation.

For instructions, see the OpenText™ Application Security Tools Guide.

2.

Open the <client_install_dir>/Core/config/client.propertiesfile in a text editor.

Page 70 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 5: About Fortify ScanCentral SAST clients

3.

Set the same value for the client_auth_tokenproperty that you set for the client_auth_

tokenproperty on the Controller (in the <controller_install_

dir>/tomcat/webapps/scancentral-ctrl/WEB-INF/classes/config.propertiesfile).

For information about how to generate an encrypted shared secret, see "Encrypting the shared

secret on a client" on page 73.

4.

Save and close the client.propertiesfile.

"Configuring client properties" on the next page

"Upgrading a client" on page 78

Configuring clients

After you install the Fortify ScanCentral SAST client, you can encrypt shared secrets and configure

client settings such as connection and read timeouts, proxy settings, and more.

To configure the Fortify ScanCentral SAST client:

1.

On the client machine, open the <client_install_dir>/Core/config/client.properties

file in a text editor.

2. Configure the properties described in the following table.

Client property

Description

Specifies a client authentication token string that contains no

spaces or backslashes to secure the Controller for use by

client_auth_token

authorized clients only. Set the same value for the client_

auth_tokenproperty that you set for the client_auth_token

property on the Controller.

If you prefer not to use plain text, you can use an encrypted

shared secret as the value for this property. For instructions on

how to encrypt a shared secret, see "Encrypting the shared secret

on a client" on page 73.

Specifies the path to a file with pwtool keys. If encrypted

passwords are used, this must specify a file with the pwtool keys

used to encrypt the passwords. For more information, see

pwtool_keys_file

restapi_connect_

"Encrypting the shared secret on a client" on page 73.

Specifies the Controller connection timeout (in milliseconds). The

Page 71 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 5: About Fortify ScanCentral SAST clients

Client property

Description

timeout

default value is 10000(or 10 seconds). You can use this, and the

restapi_read_timeoutproperty to resolve timeout errors

between the Controller and the client.

Specifies the Controller read timeout (in milliseconds). The

restapi_read_timeout

use_system_gradle

debricked_cli_dir

default value is 30000(or 30 seconds). You can use this, and the

restapi_connect_timeoutproperty to resolve timeout errors

between the Controller and the client.

If set to true, Fortify ScanCentral SAST uses the Gradle included

in the PATH environment variable. By default, Fortify

ScanCentral SAST uses the Gradle wrapper included in the

project being analyzed.

(OpenText Core Application Security users only) Specifies a

custom location for the Debricked CLI installation.

For a description of the proxy-related properties for clients, see "Configuring proxies for clients

and sensors" on the next page.

3.

Save and close the client.propertiesfile.

"Installing clients" on page 69

Configuring client properties

In addition to setting client properties in the <client_install_

dir>/Core/config/client.propertiesfile, you can add them to the SCANCENTRAL_VM_OPTS

environment variable. A property value set in the SCANCENTRAL_VM_OPTS environment variable

overrides any equivalent property set in the client.propertiesfile. The following example sets

the client authorization token and the connection timeout between the Controller and a client:

l

On a Windows system: set SCANCENTRAL_VM_OPTS=-Dclient_auth_token=<token> -

Drestapi_connect_timeout=10000

l

On a Linux system: export SCANCENTRAL_VM_OPTS=-Dclient_auth_token=<token> -

Drestapi_connect_timeout=10000

Note: You can also set Java system properties (such as -Djava.io.tmpdir=<path>) in the

SCANCENTRAL_VM_OPTS environment variable.

Page 72 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 5: About Fortify ScanCentral SAST clients

Encrypting the shared secret on a client

Passwords exist in the Fortify ScanCentral SAST client configuration file as plain text. You can encrypt

the client_auth_tokenproperty value.

To encrypt a shared secret on a client:

1. At the command prompt, run one of the following commands:

l

For an embedded client installed with OpenText SAST, run:

<sast_install_dir>/bin/pwtool <pwtool_keys_file>

l

For a standalone client, run:

<client_install_dir>/bin/pwtool <pwtool_keys_file>

2. When prompted, type the password to encode, and then press Enter.

The pwtool generates a new key in the file on the specified path or reuses an existing file and

prints the encrypted password.

3.

Open the client.propertiesfile in a text editor and update the values for the following

properties:

a.

Copy the new encrypted secret, and paste it as the value for the client_auth_token

property.

b. Add the name of your pwtool keys file:

pwtool_keys_file=<pwtool_keys_file>

Save and close the client.propertiesfile.

4.

See also

Configuring proxies for clients and sensors

If all your outbound traffic must go through a proxy, you can configure one for your Fortify

ScanCentral SAST clients.

To configure proxies for clients and sensors:

1.

Go to the <client_install_dir>/Core/config/directory, and, in both the

client.propertiesand worker.propertiesfiles, uncomment, and then set values for the

properties listed in the following table.

Property

Description

ctrl_proxy_host

Type the name of the Controller proxy host.

Page 73 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 5: About Fortify ScanCentral SAST clients

Property

Description

ctrl_proxy_port

ctrl_proxy_user

Type the Controller proxy port number.

If authentication is required, type a user name.

ctrl_proxy_password If authentication is required, type the password for the proxy user.

ssc_proxy_host

ssc_proxy_port

ssc_proxy_user

Type the name of the Fortify Software Security Center proxy host.

Type the number of the Fortify Software Security Center proxy port.

If authentication is required, type the proxy user name.

ssc_proxy_password If authentication is required, type the password for the proxy user.

2.

3.

Save and close the client.propertiesand worker.propertiesfiles.

To enable proxy authentication when the Controller is running under HTTPS, add the -

Djdk.http.auth.tunneling.disabledSchemesJava property to the SCANCENTRAL_VM_

OPTS environment variable by typing one of the following commands:

l

On a Windows system: set SCANCENTRAL_VM_OPTS=-

Djdk.http.auth.tunneling.disabledSchemes

l

On a Linux system: export SCANCENTRAL_VM_OPTS=-

Djdk.http.auth.tunneling.disabledSchemes

Page 74 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Chapter 6: Upgrading Fortify ScanCentral

SAST components

Fortify ScanCentral SAST-related functionality in Fortify Software Security Center requires updated

Fortify ScanCentral SAST components.

Important! You must upgrade the Controller before you upgrade the Fortify ScanCentral SAST

sensors and clients. Also, make sure that your Controller version is the same as your Fortify

Software Security Center version.

This section contains the following topics:

Supporting multiple OpenText SAST versions

Upgrading the Controller

Enabling automatic updates of clients and sensors

Supporting multiple OpenText SAST versions

To support heterogeneous environments and facilitate phased OpenText SAST upgrades, the

Controller supports scan request routing based on the OpenText SAST version. For example, you can

configure two different client machines, each with a different OpenText SAST version, and configure

the sensors with compatible OpenText SAST versions. By default, jobs from each client are then

routed to the sensor that has the same OpenText SAST version installed. You can change this

behavior and specify a specific sensor version for all jobs (see "Configuring the Controller" on

page 37).

If you have an existing OpenText SAST installation (that includes the Fortify ScanCentral SAST client

executable file in your path and a mixed version environment, make sure that you are running the

latest Fortify ScanCentral SAST executable when you run the client and sensor commands. (Use

explicit paths.) To add capacity (new clients or sensors), you can clone the VMs you have already

configured or use sensor hosts with the same specifications and installation directory structure.

Important! If you clone VMs, then after cloning, you must remove the worker_

persist.propertiesfile from the directory specified for the props_dirproperty (see

"Configuring where to generate job files and the worker_persist.properties file" on page 62).

Use sensor machines dedicated to Fortify ScanCentral SAST and run sensors under a dedicated user

name. Run only one sensor instance per machine.

Page 75 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 6: Upgrading Fortify ScanCentral SAST components

If the Controller and Fortify Software Security Center run on different machines, make sure that the

ssc_urland this_urlproperties in the scancentral-ctrl/WEB-

INF/classes/config.propertiesfile, and the Controller URL set on Fortify Software Security

Center (select Administration > Configuration > ScanCentral SAST) resolve to the correct IP

addresses.

Make sure a security system or other tool does not block the following channels of communication:

l

Controller to Fortify Software Security Center port (for uploads of scan results)

l

Fortify Software Security Center to the Fortify ScanCentral SAST Controller port (for Fortify

ScanCentral SAST administration console functionality)

l

Clients to the Controller port

l

Sensors to the Controller port

l

Clients to the Fortify Software Security Center port (required only if Fortify Software Security

Center is in lockdown mode, or if you use the -sscurloption)

Upgrading the Controller

To upgrade your Fortify ScanCentral SAST Controller:

1. (Recommended) Allow all jobs to finish.

Place the Controller in maintenance mode so that sensors complete all currently running scans.

2. Shut down the Controller.

3. Back up the existing Controller directories.

4. Install the new Controller in a different location from the existing Controller directories.

If you plan to install the Controller as a Windows or Linux service, make sure that you install the

Controller in a directory where the local service (Windows) or the user or group using the service

(Linux) has access.

5.

If your existing config.propertiesfile has been modified, you must manually apply any

changes you made to the new config.propertiesfile.

You cannot simply copy the existing config.propertiesfile.

6. If (and only if) you are upgrading your Controller from version 23.1.x to version 25.2.0, run the

migration script as follows:

a. Open a command prompt and go to the new 25.2.0 Controller installation directory.

b.

c.

At the command prompt, enter cd db-migrate.

Identify the cloudCtrlDband Controller directories for the existing Fortify ScanCentral

SAST version. In the following example, the existing Controller is installed on a Windows

system in the C:\scancentral23.1.0directory:

C:\scancentral23.1.0\tomcat\cloudCtrlDb

C:\scancentral23.1.0\tomcat\webapps\scancentral-ctrl

Page 76 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 6: Upgrading Fortify ScanCentral SAST components

d. Run the following command.

This command example includes the example directories shown in the preceding step.

migrate C:\scancentral23.1.0\tomcat\cloudCtrlDb

C:\scancentral23.1.0\tomcat\webapps\scancentral-ctrl

The migration script generates the cloudCtrlDbdirectory in the current working directory.

7.

Go to the jobFilesand cloudCtrlDbdirectories of the existing Controller, and then copy them

to the corresponding directories for the new Controller.

Important! If you migrated the database (step 6), make sure that you copy the migrated

database (cloudCtrlDbdirectory) to the new Controller installation directory.

The process owner must have write permission for the database file in the cloudCtrlDb

directory. If you run the Fortify ScanCentral SAST Controller as a Windows service, make sure

that the LOCAL SERVICE account has write permission to the database file.

To change these directories, edit the job_file_dirand db_dirproperties in the

config.propertiesfile (see "Configuring the Controller" on page 37).

8. Start the new Controller.

The database is automatically migrated.

9. (Optional) Remove the Controller directories for the previous version.

See also

"Installing the Controller" on page 28

"Upgrading Fortify ScanCentral SAST components" on page 75

"Upgrading sensors" below

"Enabling automatic updates of clients and sensors" on page 79

Upgrading sensors

Important! If OpenText SAST is installed in a location that requires that you have administrator

permissions to modify it (for example in Program Files), then to update a sensor you must

start it with administrator permissions. Otherwise, the sensor cannot write files to disk. If

automatic updates is enabled, major updates on standalone clients must finish successfully

before the sensor can start. With automatic updates enabled, patch updates allow sensors and

clients to start unless the upgrade fails.

To upgrade your Fortify ScanCentral SAST sensors (on Windows or Linux), you can either install the

latest version of OpenText SAST, or unzip the Fortify_ScanCentral_Client_<version>_

x64.zipfile. You can use the client-only approach if you plan only to use remote translation and

analysis workflows. Local translation requires a local OpenText SAST installation. You can also find

the Fortify ScanCentral SAST client inside the Fortify_ScanCentral_Controller_<version>_

x64.zipfile in the tomcat/client/scancentral.zipdirectory.

Page 77 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 6: Upgrading Fortify ScanCentral SAST components

Tip: You can configure automatic upgrades of both sensors and clients. For details, see "Enabling

automatic updates of clients and sensors" on the next page.

To upgrade sensors by installing or upgrading OpenText SAST:

1. Stop all sensors from running.

2.

Install or upgrade OpenText SAST using the instructions provided in the OpenText™ Static

Application Security Testing User Guide.

3.

Check the <sast_install_dir>/Core/config/directory to make sure that the

worker.propertiesfile resides there.

4. specify either a plain text password, or an encrypted shared secret (password the Controller uses

to communicate with the sensor) as the worker.propertiesvalue.

worker_auth_token=<value_set_in_Controller_configuration>

For information about how to generate an encrypted shared secret, see "Encrypting the shared

secret on a sensor" on page 59.

5.

Save the worker.propertiesfile.

6. Start the sensors.

"Starting the sensors" on page 63

"Configuring sensors to use the progress command when starting on Java" on page 61

"Upgrading the Controller" on page 76

Upgrading a client

Important! OpenText recommends that your standalone Fortify ScanCentral SAST clients and

your OpenText SAST installation be the same version.

To upgrade a standalone client (independent of OpenText SAST), do one of the following:

l

Delete the existing client, and then extract the Fortify_ScanCentral_Client_<version>_

x64.zipfile to any directory on the machine.

l

Extract the contents of the Fortify_ScanCentral_Client_<version>_x64.zipfile on top of

the existing client.

To upgrade an embedded client, which resides on the same machine as OpenText SAST:

1. Log on to the build machine using credentials for an account that is not an administrator account

or root.

Page 78 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 6: Upgrading Fortify ScanCentral SAST components

2. Back up the following directories:

l

<sast_install_dir>/bin/

l

<sast_install_dir>/Core/lib/

l

<sast_install_dir>/Core/config/

3. Upgrade OpenText SAST.

For instructions on how to install and upgrade OpenText SAST, see the OpenText™ Static

Application Security Testing User Guide.

4. Accept all overwrite requests.

On a Linux system, you might also need to run chmod +x ScanCentralin the <sast_

install_dir>/bin/ScanCentral/directory.

Tip: After you configure a client, you can copy the configuration files and use them to create

other clients.

"Installing an embedded client" on page 69

Enabling automatic updates of clients and sensors

You can have all Fortify ScanCentral SAST clients and sensors check with the Controller after a

manual update and following each startup to determine whether updates are available (meaning the

client or sensor version is earlier than the Controller version). Then, if an update is available, the

Controller updates all sensors and clients.

The upgrade paths for clients and sensors are as follows:

l

You can update standalone clients to a major or a patch version (for example from 24.4.0 to 25.2.0,

or from 24.4.0 to 24.4.1).

l

If automatic updates are enabled and a major update of standalone clients fails, the clients do not

start any jobs until they are updated.

l

If automatic updates are enabled and a patch update of standalone clients fails, the clients continue

to work, and a warning is displayed.

l

You can only update embedded clients and sensors to a patch version (for example, from 24.4.0 to

24.4.1 or 24.4.2, but not to 25.2.0). Automatic updates for major versions is not available for

embedded clients and sensors.

l

If automatic updates are enabled and a patch update of an embedded client fails, the clients and

sensors continue to work, and a warning is displayed.

To update sensors and embedded clients to the next version, you must install the latest OpenText

SAST version.

Page 79 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 6: Upgrading Fortify ScanCentral SAST components

Important! Fortify ScanCentral SAST clients and sensors check for updates only if you use the

-urlor -sscurloptions. The packagecommand does not start the update process.

To enable automatic updates of your clients and sensors:

1.

Open the <controller_install_dir>/tomcat/webapps/scancentral-ctrl/WEB-

INF/classes/config.propertiesfile in a text editor.

2.

To enable automatic updates, set client_auto_updateto true.

3. Save and close the file.

The update process (and its resulting success or failure status) is written to the console.

Important! If you have OpenText SAST installed in a location that requires that you have

administrator permissions to modify it (for example in Program Files), then to update a sensor,

you must start it with administrator permissions. Otherwise, the sensor cannot write files to disk.

If automatic updates is enabled, major updates on standalone clients must finish successfully

before the sensor can start. With automatic updates enabled, patch updates allow sensors and

clients to start unless the upgrade fails.

"Upgrading the Controller" on page 76

Page 80 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Chapter 7: Submitting scan requests

You can request a scan that performs remote translation and scan or one that performs a remote scan

for a project that is already translated to your Fortify ScanCentral SAST sensors. This chapter

describes how to submit scan requests (including special considerations for some project languages),

how to upload your scan results to Fortify Software Security Center in your scan request, and how to

prepare a Fortify ScanCentral SAST package to be scanned without sending it to a Controller.

This section contains the following topics:

Submitting local translation and remote scan requests

Submitting remote translation and scan requests

Targeting a specific sensor pool for a scan request

Requesting job status email notifications for scan requests

Scanning .NET projects

Scanning older version Java projects

Scanning JavaScript and TypeScript code

Scanning Python projects

Scanning Go projects

Scanning PHP projects

Scanning COBOL projects

Scanning SQL projects

Uploading results to Fortify Software Security Center

Optimizing scan performance

Generating a Fortify ScanCentral SAST package

Using the PackageScanner tool

Submitting local translation and remote scan requests

You can submit a project that OpenText SAST has already translated to your Fortify ScanCentral

SAST sensors for remote scanning. To submit a scan request to perform only the scan phase, use the

startcommand with either the --build_id(-b) or the -mbsoption to identify the local translation

or an existing mobile build session file together with the -scanoption. The following is an example of

a scan request to submit a remote scan:

scancentral -sscurl <ssc_url> -ssctoken <token> start -b <build_id> -scan

Page 81 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 7: Submitting scan requests

You can include supported OpenText SAST scan options in the scan request (see "Options accepted

for -sargs (--scan-args)" on page 123). You must include only the OpenText SAST analysis options

after the –sca n option. If the parameter for the option you specify includes a space, you must enclose

it in quotes. For example:

-scan –build-label "Application 5.4 June 8, 2025"

Note: You can also perform a local translation and remote scan using the Fortify ScanCentral

SAST packagecommand and the PackageScanner tool. For more details and an example, see

"Using the PackageScanner tool" on page 100.

If the scan request is successful, you will receive a job token. The Fortify ScanCentral SAST sensor

pulls the scan request from the Controller, processes it, and publishes the results to the Controller.

By default, jobs submitted and scan results (FPR files) cannot be larger than 1 GB. Before you start

large scans, review "Optimizing scan performance" on page 96.

Submitting remote translation and scan requests

If you use a supported language, you can submit your project to your Fortify ScanCentral SAST

sensors for a complete remote analysis (both translation and scan phases). To submit a scan request

that performs both the translation and scan phases, use the startcommand. For more information,

see "Languages supported for remote translation" on page 25.

Fortify ScanCentral SAST automatically detects the build tool you are using based on the project files

being scanned. For example, if Fortify ScanCentral SAST detects a pom.xmlfile, it automatically sets

-btto mvn. If it detects a build.gradlefile, it sets -btto gradle. If Fortify ScanCentral SAST

detects a *.slnfile, it sets -btto msbuild(Windows) or to dotnet(Linux) and sets -bfto the

xxx.slnfile. If Fortify ScanCentral SAST detects multiple file types (for example, pom.xmland

build.gradle), it prioritizes the build tool selection as follows: Maven > Gradle > MSBuild and prints

a message to indicate which build tool was selected based on the multiple file types found. For a list of

supported build tools, see "Build tools supported for remote translation" on page 26.

The following table provides example scan request commands for different tasks. The examples

assume that the command is run from the project's working directory. The build tool option --build-

tool(-bt) shown in these example commands is not required.

Task

Example command

Start a job to scan a

scancentral -sscurl <ssc_url> -ssctoken <token>

start

Page 82 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 7: Submitting scan requests

Task

Example command

.NET application.

Start a job to scan a dotnet project

on Windows.

scancentral -sscurl <ssc_url> -ssctoken <token>

start -bt dotnet -bf mySolution.sln

Start a job to scan an Apache

Maven™ Software project that

includes the test scope.

scancentral -sscurl <ssc_url> -ssctoken <token>

start -bt mvn --include-test

or

scancentral -sscurl <ssc_url> -ssctoken <token>

start -t

Start a job to scan a Maven project

with a non-default build file.

scancentral -sscurl <ssc_url> -ssctoken <token>

start -bt mvn -bf c:\myproj\myproj-pom.xml

Start a job to scan a

scancentral -sscurl <ssc_url> -ssctoken <token>

JavaScript/TypeScript project.

start

Start a job to scan a PHP version

8.2 project.

scancentral -sscurl <ssc_url> -ssctoken <token>

start -hv 8.2

Start a job to scan an ABAP

project.

scancentral -sscurl <ssc_url> -ssctoken <token>

start

Start a job to scan a Java project

and exclude test source files.

scancentral -sscurl <ssc_url> -ssctoken <token>

start -exclude src/test/**/*

Start a job to scan only the

distribution files for a JavaScript

project.

scancentral -sscurl <ssc_url> -ssctoken <token>

start -include ./dist/**/*.*

Start a job to scan all the beta files

except for JSON files

scancentral -sscurl <ssc_url> -ssctoken <token>

start -include ./beta/*.* -exclude

./beta/*.json

Start a job to scan a Go project

with a build tag.

scancentral -sscurl <ssc_url> -ssctoken <token>

start -targs "-gotags release"

Start a job to scan a Ruby project.

Start a job to scan a Gradle project.

scancentral -sscurl <ssc_url> -ssctoken <token>

start

scancentral -sscurl <ssc_url> -ssctoken <token>

start -bt gradle

Page 83 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 7: Submitting scan requests

Task

Example command

Start a job to scan a Gradle project,

get email notifications from the

Controller, and upload the results

to Fortify Software Security

Center.

scancentral -sscurl <ssc_url> -ssctoken <token>

start -email username@domain.com -upload -

application "MyProject" -version "1.0"

Fortify ScanCentral SAST returns a job token that you can use to track the scan.

"Uploading results to Fortify Software Security Center" on page 92

Targeting a specific sensor pool for a scan request

To target a specific sensor pool for a scan request, you must have:

l

The name or the UUID for the sensor pool

l

The pool_mapping_modeproperty set to enabled or disabled

To get the sensor pool name or the UUID for the sensor pool:

1. Sign in to Fortify Software Security Center and select ScanCentral.

2. On the navigation pane of the SAST page, select Sensor Pools.

3. In the Sensor Pools table, copy the value shown in the Name or UUID column for the sensor pool

you want to target for a scan request.

Note: All unassigned and enabled sensors are used, even if they are not assigned to sensor

pools.

To specify a sensor pool to use for a scan request:

l

At the command prompt on the client host, run one of the following commands:

scancentral -sscurl <ssc_url> -ssctoken <token> start -pool <pool_name>

scancentral -sscurl <ssc_url> -ssctoken <token> start -pool <uuid>

Page 84 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 7: Submitting scan requests

Requesting job status email notifications for scan

requests

To request delivery of email notifications with the status of a scan request, include the -emailoption

in the scan request. This is available for both local translation and remote scan and remote translation

and scan requests. The following is an example of a remote translation and scan request that will send

job status notifications to two email addresses:

scancentral -sscurl <ssc_url> -ssctoken <token> start -email

userA@example.com:userB@example.com

By default, the subject in the email notification includes the following information:

ScanCentral SAST job <job_status>: <job_token>

If the scan request includes an upload of scan results to Fortify Software Security Center, then the

subject also includes the application name and application version:

ScanCentral SAST job <job_status>: <job_token> (<app_name> - <app_version>)

To control whether the job status is included in the email subject, use the include_job_status_

in_email_subjectproperty in the Controller configuration.

See also

"Viewing the scan request status" on page 103

Scanning .NET projects

Fortify ScanCentral SAST MSBuild integration is available on Windows only. Fortify ScanCentral SAST

dotnet integration is available on Windows and Linux.

To translate and scan .NET projects, the client machine must have the software required to build and

package .NET projects installed:

l

MSBuild or dotnet

For supported versions of MSBuild and dotnet, see "Build tools supported for remote translation"

on page 26.

l

NuGet (optional)

l

.NET Framework, .NET Core, or .NET Standard as required for the project configuration

Page 85 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 7: Submitting scan requests

To use Fortify ScanCentral SAST MSBuild integration, the required MSBuild version must be included

in the PATH environment variable. To make sure the project is built correctly, OpenText recommends

that you start Fortify ScanCentral SAST from the Developer Command Prompt for Visual Studio,

which sets the required .NET environment variables automatically. To use Fortify ScanCentral SAST

dotnet integration, the required dotnet version must be included in the PATH environment variable.

Some projects also require that you start NuGet to restore some dependencies. If any dependencies

are unresolved, the build fails and the scan results might be incomplete. For these types of projects,

you must install NuGet manually on the machine and make sure it is included in the PATH

environment variable. If NuGet is found, Fortify ScanCentral SAST runs it automatically.

The following are command-line examples to translate and scan a .NET project:

scancentral -sscurl <ssc_url> -ssctoken <token> start --build-tool msbuild

--build-file <sln_file_or_path_to_sln_file>

scancentral -sscurl <ssc_url> -ssctoken <token> start --build-tool dotnet

The following command uses MSBuild integration on a Windows client and dotnet integration on a

Linux client because no build tool option is specified:

scancentral -sscurl <ssc_url> -ssctoken <token> start --build-file <sln_

file_or_path_to_sln_file>

Note: To use the dotnet integration on a Windows client, you must include -bt dotnet.

If no build tool is specified, Fortify ScanCentral SAST client tries to automatically detect the build

tool for *.sln, *.csproj, *.vbproj, and dirs.proj.

Fortify ScanCentral SAST returns a job token that you can use to track the scan.

Excluding .NET Projects from analysis

To exclude a .NET project from Fortify ScanCentral SAST analysis, you must create a build

configuration to exclude the project, and then specify the build configuration with the --build-

commandoption.

For example, the solution MySolution.slnincludes two projects: ProjectA and ProjectB. The

<build_config> file, created in Visual Studio excludes ProjectB from the builds. To exclude ProjectB

from Fortify ScanCentral SAST analysis, run the following from the directory where the solution file

resides:

scancentral -sscurl <ssc_url> -ssctoken <token> start --build-tool msbuild

--build-file MySolution.sln --build-command "/t:Rebuild

/p:Configuration=<build_config>"

Page 86 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 7: Submitting scan requests

Scanning older version Java projects

Set the SCANCENTRAL_JAVA_HOMEenvironment variable to a version of Java that Fortify ScanCentral

SAST supports. For the supported Java versions, see "Client software requirements" on page 23.

Note: This is only required if the JAVA_HOME environment variable is set to Java version that

Fortify ScanCentral SAST client does not support.

Scanning JavaScript and TypeScript code

By default, any NPM dependencies (node_modules directory) that exists in your project is included in

the project package only for translation. This improves the analysis results by including type

resolution information from the JavaScript and TypeScript code. However, OpenText SAST excludes

the files in node_modules from the analysis and no vulnerabilities are reported for these

NPM dependencies in the scan results.

To prevent Fortify ScanCentral SAST from automatically restoring dependencies, include the -

skipBuildoption in the scan request command. Note that any existing node_modules directory is

still included in the project package that is sent to the Controller unless you explicitly exclude it.

To exclude the node_modules directory from your project package, use the -excludeoption in the

startor packagecommand. For example:

scancentral -sscurl <ssc_url> -ssctoken <token> start -exclude node_modules

To include the NPM dependencies in the scan results, see the OpenText™ Static Application Security

Testing User Guide for information about translating JavaScript and TypeScript code.

Scanning Python projects

Fortify ScanCentral SAST clients can work with Python® projects in three ways:

l

Submit a scan request in a prepared virtual environment (see "Submitting a scan request in a

virtual environment" on the next page).

l

Use an existing virtual environment, without activating that virtual environment (see "Submitting a

scan request in an unactivated virtual environment" on page 89). In this case, Fortify ScanCentral

SAST activates the virtual environment.

l

Start the job outside of a virtual environment (see "Submitting a scan request outside of a virtual

environment" on page 89).

Page 87 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 7: Submitting scan requests

The following table provides examples of different ways to submit scan requests for Python code.

Task

Example command

Start a job to scan a Python 3 project

scancentral -sscurl <ssc_url> -ssctoken

<token> start --python-requirements

<requirements_file_path>

Start a job to scan a Python 2 project

scancentral -sscurl <ssc_url> -ssctoken

<token> start –-python-version 2

--python-requirements <requirements_

file_path>

Start a job to scan a Python project under an

scancentral -sscurl <ssc_url> -ssctoken

active virtual environment with dependencies <token> start

already installed

Start a job to scan a Python project under an

active virtual environment without project

dependencies installed

scancentral -sscurl <ssc_url> -ssctoken

<token> start --python-requirements

<requirements_file_path>

Start a job to scan a Python project using an

existing Python virtual environment and

install project dependencies

scancentral -sscurl <ssc_url> -ssctoken

<token> start --python-virtual-env

<venv_location>

Submitting a scan request in a virtual environment

If you work in a virtual environment, all your project dependencies are already installed. You do not

need to invoke the pip package manager before you start the job. Fortify ScanCentral SAST

can detect the Python version automatically.

To start the scan job in a virtual environment:

1. At the command prompt, activate the virtual environment.

2. Start a job to scan the Python project as shown in the following example:

scancentral -sscurl <ssc_url> -ssctoken <token> start

If pip dependencies are not yet installed in the virtual environment used, Fortify ScanCentral SAST

installs them automatically using the requirements file with the following example:

scancentral -sscurl <ssc_url> -ssctoken <token> start --python-requirements

<requirements_file_path>

Page 88 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 7: Submitting scan requests

Submitting a scan request in an unactivated virtual environment

To start the scan job in a virtual environment (with all dependencies installed) without activating that

virtual environment:

l

At the command prompt, start the Python project scan as shown in the following examples:

scancentral -sscurl <ssc_url> -ssctoken <token> start --python-virtual-

env <venv_location>

or

scancentral -sscurl <ssc_url> -ssctoken <token> start --python-virtual-

env <venv_location> --python-requirements <requirements_file_path>

Fortify ScanCentral SAST goes to the virtual environment, determines the Python version used,

packages all required libraries, and then submits the scan job to the Controller.

Submitting a scan request outside of a virtual environment

To start the scan job if there is no virtual environment on the client, you must have Python installed

on the client. If the Python version is not specified in the command, then Fortify ScanCentral SAST

uses the first working version from PATH environment variable. Fortify ScanCentral SAST locates the

Python installation. In this case, Fortify ScanCentral SAST creates a temporary virtual environment,

installs all dependencies from the requirements file, and then submits the job to the Controller.

To start the scan job outside of a virtual environment:

l

At the command prompt, start the scan job as shown in the following example:

scancentral -sscurl <ssc_url> -ssctoken <token> start --python-version 3

To prevent Fortify ScanCentral SAST from automatically restoring dependencies using pip install,

include the -skipBuildoption in the scan request command. If dependencies were already restored

before running Fortify ScanCentral SAST, they are included in the project package that is sent to the

Controller.

Scanning Go projects

To enable Fortify ScanCentral SAST clients to package Go projects for remote translation and scan,

the following requirements must be met:

l

The Go compiler must be installed on the client to resolve project dependencies.

l

The Go compiler executable location must be available in the PATH variable.

Page 89 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 7: Submitting scan requests

l

Configure the Go environment variables. For example, to use a specific Go proxy, configure it as

follows:

set GOPROXY=.... (Windows)

export GOPROXY=... (Linux)

Note: Sensors do not require a connection to a Go proxy website to resolve dependencies

because they run Go translation with GOPROXY=offconfigured. Also, the vendor directory

under the project root has all the required dependencies. The sensor rewrites the GOFLAGS

system variable with GOFLAGS=-mod=vendorwhen it runs an OpenText SAST translation.

l

The Go project must include a go.modfile.

l

OpenText recommends that the Go project includes a go.sumfile to ensure that dependencies

restored with go mod vendorworks successfully.

To prevent Fortify ScanCentral SAST from automatically restoring dependencies using go mod

vendor, include the -skipBuildoption in the scan request command. If dependencies were already

restored before running Fortify ScanCentral SAST, they are included in the project package that is

sent to the Controller.

Scanning PHP projects

If your PHP project uses the Composer dependency manager and you want to include dependencies

in the analysis, then do the following on the client machine:

l

Install PHP and Composer

l

Configure the php.inito run Composer for your project

This enables Fortify ScanCentral SAST client to invoke Composer to restore the dependencies before

packaging the project for analysis. To prevent Fortify ScanCentral SAST from automatically restoring

dependencies, include the -skipBuildoption in the scan request command. If Composer already

restored the dependencies before running Fortify ScanCentral SAST, they are included in the project

package that is sent to the Controller. If Composer is not configured for your project, then Fortify

ScanCentral SAST packages the project without restoring the dependencies.

Scanning COBOL projects

Fortify ScanCentral SAST clients can package COBOL projects for remote translation and scan. For

detailed information about the requirements and options available for COBOL analysis, see the

OpenText™ Static Application Security Testing User Guide.

You must have a sensor with the Windows operating system. Fortify ScanCentral SAST automatically

assigns COBOL scans to a Windows sensor. If no Windows sensor is available, then the scan job is

created but cannot be started.

Page 90 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 7: Submitting scan requests

Make sure the copybook files are in a separate directory from the COBOL source code files. OpenText

recommends that you place your COBOL source code files in a directory called sources and your

copybook files in a directory called copybooks. Create these directories at the same level.

Note: To analyze a COBOL project on Linux and to use Legacy COBOL translation, you must

perform a local OpenText SAST translation:

scancentral -sscurl <ssc_url> -ssctoken <token> start -b <build_id>

The following example command submits a scan request for a COBOL project where the copybooks

files are in the local copybooksdirectory:

scancentral -sscurl <ssc_url> -ssctoken <token> start -targs "-copydirs

copybooks -dialect COBOL390"

The following example command submits a scan request for a COBOL project that contains source

code files with a non-standard file extension mfcbl:

scancentral -sscurl <ssc_url> -ssctoken <token> start -targs "-copydirs

MyCopydir1;MyCopydir2 -Dcom.fortify.sca.fileextensions.mfcbl=COBOL"

The following example command submits a scan request for a COBOL project that contains source

code files without file extensions:

scancentral -sscurl <ssc_url> -ssctoken <token> start -targs "-copydirs

MyCopyDir -noextension-type COBOL"

Scanning SQL projects

On Windows (and Linux for .NET projects only), OpenText SAST assumes that files with the .sql

extension are T-SQL rather than PL/SQL. To perform a remote translation of a SQL project, you might

need to specify what type of SQL your project uses.

To scan the project, run one of the following commands:

scancentral -sscurl <ssc_url> -ssctoken <token> start -targs "-sql-language

PL/SQL"

or

scancentral -sscurl <ssc_url> -ssctoken <token> start -targs "-sql-language

TSQL"

Page 91 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 7: Submitting scan requests

Uploading results to Fortify Software Security Center

To submit a scan request and upload the scan results to an application version in Fortify Software

Security Center, you must have an authentication token of type ScanCentralCtrlToken. You can create

an authentication token with the fortifyclient utility or in Fortify Software Security Center. You can

reuse the token for future requests. The fortifyclient utility is provided with Fortify Software Security

Center and the OpenText Application Security Tools installation. For more information about creating

authentication tokens with the fortifyclient utility or in Fortify Software Security Center, see the

OpenText™ Application Security User Guide.

There are two options for providing upload permission, which depend on the permissions you want to

give to your Fortify Software Security Center users:

l

The user assigned a role that has Run ScanCentral SAST scans, View ScanCentral SAST, View

application versions, and Upload analysis results permissions generates the token.

l

The user assigned a role that has the Run ScanCentral SAST scans and View ScanCentral SAST

permissions (and does not have the Upload analysis results permission) generates the token and

the Controller is configured with a Fortify ScanCentral SAST Controller service account.

Use this option to upload the scan results to Fortify Software Security Center using the Controller

service account.

To configure a Fortify ScanCentral SAST Controller service account:

a. In Fortify Software Security Center, create a Fortify ScanCentral SAST Controller service

account that has the ScanCentral SAST Controller role.

For instructions on how to create Fortify Software Security Center user accounts, see the

OpenText™ Application Security User Guide.

b.

c.

Open the <controller_install_dir>/tomcat/webapps/scancentral-ctrl/WEB-

INF/classes/config.propertiesfile in a text editor.

Specify the credentials for the Fortify ScanCentral SAST Controller service account in the ssc_

ctrl_account_usernameand ssc_ctrl_account_passwordproperties.

d.

Save and close the config.propertiesfile.

e. To apply the change, restart the Controller.

Note: The Run ScanCentral SAST scans permission and the ScanCentral SAST Controller role

are available in Fortify Software Security Center version 24.4.0 and later. To use an earlier version

of Fortify Software Security Center, you must do one of the following:

l

Ensure that the account of the user that generates the token has a role that includes the

Upload analysis results and View ScanCentral SAST permissions.

l

Configure the Controller (steps b-e in the previous procedure) with a Fortify ScanCentral SAST

Controller service account created in Fortify Software Security Center that has a role that

includes the View ScanCentral SAST, View application versions, and Upload analysis

results permissions.

Page 92 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 7: Submitting scan requests

Examples of scan requests that upload scan results

The following example scan requests perform a remote translation and scan and upload the scan

results:

scancentral -sscurl <ssc_url> -ssctoken <token> start -upload -versionid

<app_version_id>

scancentral -sscurl <ssc_url> -ssctoken <token> start -upload -application

<app_name> -version <app_version>

The following example scan request performs a local translation and remote scan and uploads the

scan results:

scancentral -sscurl <ssc_url> -ssctoken <token> start -upload -versionid

<app_version_id> -b <build_id> -scan

"Submitting remote translation and scan requests" on page 82

"Submitting local translation and remote scan requests" on page 81

Specifying a scan results (FPR) file name

You can specify the name of the scan results (FPR) file you upload to Fortify Software Security Center

using the -fprsscoption with the startcommand. The file name must not exceed 128 characters

in length and must not contain the following characters:

l

colon (:)

l

backslash (\)

l

forward slash (/)

l

asterisk (*)

l

question mark (?)

l

vertical bar or pipe (|)

l

less than (<)

l

greater than (>)

l

double quote (")

Page 93 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 7: Submitting scan requests

The following example scan request performs a remote translation and scan and specifies a name for

the FPR file to upload:

scancentral -sscurl <ssc_url> -ssctoken <token> start -upload -versionid

<app_version_id> -fprssc <my_fpr>.fpr

The following example scan request performs a remote scan and specifies a name for the FPR file for

upload:

scancentral -sscurl <ssc_url> -ssctoken <token> start -upload -versionid

<app_version_id> -fprssc <my_fpr>.fpr -b <build_id> -scan

See also

Preventing replacement of duplicate scan requests

A duplicate scan request occurs if you have more than one scan request that uploads scan results to

the same application version in Fortify Software Security Center. By default, the Controller is

configured to replace duplicate scan jobs (replace_duplicate_scansproperty). You can prevent

the replacement for specific scan requests with the --disallow-replacement(-dr) option in a

scan request.

Consider the following scenario:

1. Submit a scan for upload to AppA 1.0, scan job 1 is added to the queue.

2. Submit a scan for upload to AppA 1.0, scan job 1 is canceled and scan job 2 is added.

3.

Submit a scan for upload to AppA 1.0 with the -droption, scan job 2 is canceled and scan job 3

is added to the queue.

4.

Submit a scan for upload to AppA 1.0 with or without the -droption, scan job 3 remains in the

queue and scan job 4 is added to the queue.

The following example scan request performs a remote translation and scan, uploads the results to

the application version AppA, 1.0 on Fortify Software Security Center, and overrides a duplicate

replacement to ensure the scan job is not removed from the queue by future scan requests uploaded

to the same application version:

scancentral -sscurl <ssc_url> -ssctoken <token> start -upload -application

AppA -version 1.0 --disallow-replacement

See also

"Uploading results to Fortify Software Security Center" on page 92

Page 94 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 7: Submitting scan requests

Retrying failed uploads to Fortify Software Security Center

If a job configured to upload scan results to Fortify Software Security Center fails, the Controller

retries to upload (up to five attempts by default) and, if the next attempt fails, waits two minutes

before it tries again.

If the Controller fails to upload an FPR file, you can use the upload command as follows to resend the

FPR:

scancentral -sscurl <ssc_url> -ssctoken <token> upload -token <job_token>

where <job_token> is the token for original job that failed to upload the FPR.

Configuring upload to Fortify Software Security Center retry

attempts

To configure the number of times the Controller can retry to upload scan results, and the amount of

time the Controller waits after a failed upload before it tries again:

1.

2.

Open the <controller_install_dir>/tomcat/webapps/scancentral-ctrl/WEB-

INF/classes/config.propertiesfile in a text editor.

To set the maximum number of upload retry attempts, locate the ssc_upload_retry_count

property, and replace the default value of 5with any integer value from 1to 10.

Note: If the specified value is outside of the valid range or is invalid, Fortify ScanCentral

SAST applies the default value.

3.

To set the interval between upload retry attempts, locate the ssc_upload_retry_interval

property, and replace the default value of 120(seconds) with any integer value from 60(1

minute) to 900(15 minutes).

Note: If the specified value is outside of the valid range or is invalid, Fortify ScanCentral

SAST applies the default value.

4.

Save and close the config.propertiesfile.

"Retrying failed uploads to Fortify Software Security Center" above

Page 95 of 128

OpenText™ Fortify ScanCentral SAST (25.2.0)

Installation, Configuration, and Usage Guide

Chapter 7: Submitting scan requests

Optimizing scan performance

If you plan to regularly scan large applications, OpenText recommends that you run a manual test

scan on hardware that is equivalent to the hardware on which your sensor is installed.

To optimize your scan:

1. Set the OpenText SAST scan parameters for optimal performance by adjusting the memory

settings to align with your hardware.

For information about how to tune OpenText SAST, see the OpenText™ Static Application

Security Testing User Guide.

2. Run a scan.

3. Note the size of the resulting FPR file and scan log.

4. To ensure that the Controller and Fortify Software Security Center can accept FPR or log files

larger than 1 GB, increase the maximum upload size threshold by doing the following:

a.

Open the <controller_install_dir>/tomcat/webapps/scancentral-

ctrl/classes/config.propertiesfile.

b. Set the Controller threshold to the maximum size in megabytes as follows:

max_upload_size=<max_size_in_megabytes>

The default value is 1024.

5. Make sure that OpenText SAST is configured to process large FPR files.

For more information, see the OpenText™ Static Application Security Testing User Guide.

See also