[KB6750] Install Apache HTTP Proxy in ESET Security Management Center (7.x)

Issue

ESET business product no longer supported

This content applies to an ESET product version that is currently in End of Life status and is no longer supported. This content is no longer updated.

For a complete list of supported products and support level definitions, review the ESET End of Life policy for business products.

Upgrade ESET business products.

Required user permissions

This article assumes that you have the appropriate access rights and permissions to perform the tasks below.

If you use the default Administrator user or are unable to perform the tasks below (the option is unavailable), create a second administrator user with all access rights.

ESET PROTECT users: Create a second administrator user in ESET PROTECT
ESET PROTECT Cloud users: Create a second administrator user in ESET PROTECT Cloud
ESET Security Management Center (ESMC) users: Create a second administrator user in ESET Security Management Center 7.x

Use Apache HTTP Proxy to distribute detection engine and program module updates to client workstations and reduce internet traffic generated by your network.
Use Apache HTTP Proxy to distribute ESET product installation packages to the ESET Management Agent.
Apache HTTP Proxy replaces the mirror server functionality from version 5.x ESET Remote Administrator. Mirror Tool is available in ESMC 7.x as an alternative, especially for offline environments.

Install using ESMC All-in-one installer | Install manually | Configure policy settings for client computers

Details

Install Apache HTTP Proxy on your network to automatically distribute detection engine updates and program component updates to client workstations. This arrangement allows for an additional layer of security—clients that are protected by a firewall and/or cannot download updates directly from ESET servers can download normal updates from a protected server configured to communicate securely with ESET servers. This arrangement limits exposure to threats for client workstations. For client computers on your network to receive updates from Apache HTTP Proxy, their update settings must be edited.

It is recommended to install Apache HTTP Proxy when more than 37 workstations are managed on your network by ESET Security Management Center.

Currently, setting up Apache HTTP Proxy is the primary method for caching detection engine update files. Users who attempt to set up a local repository on the ESET Security Management Center Server may receive the following error:

"Error: CRepositoryModule [Thread d4c]: GetFile: Object 'https://plgli2sm01/Repo//info.meta'not found".

Solution

Before you begin

If you already have ESET Security Management Center (ESMC) Server installed, follow the instructions below, and then create a policy for clients.

The steps shown here will install Apache HTTP Proxy. To create an ESET Mirror on an individual client, perform these steps on a client workstation.

We recommend using the All-in-one installer for most users. Install manually if you prefer this method or if the All-in-one installer fails.

Install Apache HTTP Proxy using All-in-one installer

Visit the ESET Security Management Center Download Page and download the appropriate all-in-one installer for your system architecture and save it in your preferred location.
Double-click the installer file to run the All-in-one installer.
Select Install/Upgrade Apache HTTP Proxy and click Next.

Figure 1-1
Click the image to view larger in new window

Click Next if you agree to the terms of the license agreement.

Click Install. The message "Apache HTTP Proxy installation was successful" will be displayed. Click Finish to close the installer.

Figure 1-2
Click the image to view larger in new window

Make sure, your proxy configuration (httpd.conf) contains a ProxyMatch for your server host.
Configure policy settings for client computers.

Install Apache HTTP Proxy manually

Click to see the instructions to manually upgrade Apache HTTP Proxy

Additional documentation available

Before you install Apache HTTP Proxy, we recommend that you review the text documentation (INSTALL.txt) that is included when you download Apache HTTP Proxy. You can find this documentation in the ApacheHttp folder after you have extracted it.

On the server where you want to install Apache HTTP Proxy, click the link below to download the Apache HTTP Proxy installer file:
Download Apache HTTP Proxy
Use a tool such as WinZip or 7Zip to extract the .zip file that you downloaded in step 1 to the directory C:\Program Files\Apache HTTP Proxy\.

Open an administrative command prompt and type the following commands in the order shown below to install Apache HTTP Proxy:

CD C:\Program Files\Apache HTTP Proxy\bin httpd.exe -k install -n ApacheHttpProxy

Navigate to C:\Program Files\Apache HTTP Proxy\conf\, locate the httpd.conf file and open it using a text editor such as Notepad.

When upgrading, the original httpd.conf configuration cannot be applied because of the presence of new settings. To apply custom changes (if any), open your original, backed-up httpd.conf file and append the custom changes to the new httpd.conf manually.

At the bottom of the .conf file, add the following lines:

ServerRoot "C:\Program Files\Apache HTTP Proxy"
DocumentRoot "C:\Program Files\Apache HTTP Proxy\htdocs"

Options Indexes FollowSymLinks
AllowOverride None
Require all granted

CacheRoot "C:\Program Files\Apache HTTP Proxy\cache"

Open an administrative command prompt and type the following command to start the Apache HTTP Proxy service.

sc start ApacheHttpProxy

To verify that the Apache HTTP Proxy service is running, press the Windows key + R, type Services.msc and make sure that the ApacheHttpProxy service is started. Select the service and click Stop before you continue to the next step.

Figure 2-1
Click the image to view larger in new window

If you want to configure a username and password, navigate back to C:\Program Files\Apache HTTP Proxyconf, open httpd.conf using a text editor such as Notepad, and then follow the steps below to configure a username and password for Apache HTTP Proxy.
1. Verify the presence of the following modules loaded in httpd.conf:
```
LoadModule authn_core_module modules/mod_authn_core.dll
LoadModule authn_file_module modules/mod_authn_file.dll
LoadModule authz_groupfile_module modules/mod_authz_groupfile.dll
LoadModule auth_basic_module modules/mod_auth_basic.dll
```
2. Add the following lines to httpd.conf under <‎Proxy *>:
```
AuthType Basic
AuthName "Password Required"
AuthUserFile password.file
AuthGroupFile group.file
Require group usergroup
```
3. Open an administrative command prompt and type the following commands to define your password for Apache HTTP Proxy:
  
  CD C:\Program Files\Apache HTTP Proxy\bin
  htpasswd.exe -c ..\password.file username
  
  You will be prompted to define the password that you want to use for Apache HTTP Proxy. Type your new password into the command prompt and press Enter.
4. In the folder C:\Program Files\Apache HTTP Proxy\, create a new text file named group.file with the following contents:
```
usergroup:username
```
Make sure, your proxy configuration (httpd.conf) contains a ProxyMatch for your server host.
Press the Windows key + R, type Services.msc select the ApacheHttpProxy service and click Start.
Test the connection to HTTP Proxy by accessing the following URL in your browser:

http://localhost:3128/index.html

When troubleshooting, see the following file to find errors:

C:\Program Files\Apache HTTP Proxy\logs\error.log

Create a policy that will configure client computers and ESET Management Agent to download updates and other files from Apache HTTP Proxy.

Manual upgrade of Apache HTTP Proxy

Back up the following files:
- C:\Program Files\Apache HTTP Proxy\conf\httpd.conf
- C:\Program Files\Apache HTTP Proxy\password.file
- C:\Program Files\Apache HTTP Proxy\group.file
Stop the ApacheHttpProxy service by opening an administrative command prompt and executing the following command:

sc stop ApacheHttpProxy
Download the Apache HTTP Proxy installer file and extract its content to the directory of C:\Program Files\Apache HTTP Proxy\ overwriting the existing files.

Download Apache HTTP Proxy
Navigate to C:\Program Files\Apache HTTP Proxy\conf\, right-click httpd.conf, from the context menu select Open with → Notepad.

Add the following code at the bottom of that .conf file:

ServerRoot "C:\Program Files\Apache HTTP Proxy"
DocumentRoot "C:\Program Files\Apache HTTP Proxy\htdocs"
Options Indexes FollowSymLinks
AllowOverride None
Require all granted
CacheRoot "C:\Program Files\Apache HTTP Proxy\cache"

If you set username / password authentication to access your Apache HTTP Proxy earlier (step number 8 in the installation section above), then replace the following block of code:
```
Deny from all
```
with the following (it can be found in your backed-up httpd.conf file):
```
AuthType Basic
AuthName "Password Required"
AuthUserFile password.file
AuthGroupFile group.file
Require group usergroup
Order deny,allow
Deny from all
Allow from all
```
If you had any other custom modifications in the httpd.conf file of your previous installation of Apache HTTP Proxy, then you can copy over those modifications from the backed-up httpd.conf file to the new (upgraded) httpd.conf file.Save the changes and Start the the ApacheHttpProxy service by executing the following command in an administrative command prompt:
sc start ApacheHttpProxy
Test the connection to HTTP Proxy by accessing the following URL in your browser:

http://localhost:3128/index.html
Configure policy settings for client computers.

Configure policy settings for client computers

Policy settings can be applied in existing policies

These instructions demonstrate creating new policies that define the location of Apache HTTP Proxy for client computers and ESET Management Agents to ensure that settings are applied to all client computers.
If you have existing policies that apply to all agents and computers, you can make the changes in your existing policies rather than create new ones. For example, if you selected Apache HTTP Proxy using the ESMC Installation Wizard, you can apply the ESET Management Agent - HTTP Proxy Usage policy.

Open ESET Security Management Center Web Console (ESMC Web Console) in your web browser and log in.
Click Policies → New Policy.

Figure 3-1
Click the image to view larger in new window

Type a Name and optional Description for your new policy in the appropriate fields.

Figure 3-2
Click the image to view larger in new window

Click Settings and select ESET Management Agent from the drop-down menu.

Figure 3-3
Click the image to view larger in new window

Expand Advanced Settings, under HTTP Proxy select one of the following options:

Global Proxy - If you want to use the proxy server for both the Agent replication and for caching of ESET services. Then click Edit next to Global Proxy (Figure 3-4 shows this option).
Different Proxy Per Service - If you want to use one proxy for Agent replication and another for caching of ESET services (for example, updates). Then click Edit next to Replication or ESET Services (depending on your intended use of HTTP Proxy).
See also the configuration of Apache HTTP Proxy with ESMC 7.

Figure 3-4
Click the image to view larger in new window

In the Global Proxy window, click the toggle next to Use proxy server to enable it and type the IP address or fully qualified domain name (FQDN) of the server where Apache HTTP proxy is installed in the Host field. Type the username and password that you created above (Method II. step 8) in the appropriate fields. Click the toggle next to Use direct connection if HTTP proxy is not available to enable it. Click Save.

Figure 3-5
Click Finish.

Select the policy that you just created and click Assign Group(s).

Figure 3-6
Click the image to view larger in new window
Select the checkbox next to All (or next to each group that should receive updates from Apache HTTP Proxy) and click OK.

Figure 3-7

Repeat steps 1-3 and then expand Settings and select ESET Endpoint for Windows or ESET Endpoint for macOS (OS X) and Linux (depending on which products are installed on your client computers).
Click Tools → Proxy Server and configure the proxy settings.
Click Finish.

Figure 3-8
Click the image to view larger in new window

After the policy is applied, the managed computers will start using the Apache HTTP Proxy.

Last Updated: Apr 19, 2023