[KB7088] Install ESET PROTECT Web Console using JDK

Alert: Use the latest ESET product versions. Find out if your ESET product is affected by End of Life (EoL)

Alert: Information regarding the Log4j 2 vulnerability

[KB7088] Install ESET PROTECT Web Console using JDK

Issue

Supported versions
Install Amazon Corretto 8 (JDK)
Migrate your existing ESMC / ESET PROTECT Web Console to use JDK
Migration scenario for Tomcat version 7.0.90 and later
Migration scenario for Tomcat version 7.0.88 and earlier

Details

Click to expand

Starting January 2019, Oracle JAVA SE 8 public updates for business, commercial, or production use require a commercial license. If you do not purchase a JAVA SE subscription, you can use this guide to transition to a no-cost alternative. Only installations on Windows are affected.

Beginning in version 8, ESET Security Management Center is renamed to ESET PROTECT.

Solution

Supported versions

Recommended versions by ESET

Only long-term support (LTS) Java/JDK versions are supported:

Supported Java/JDK version	ESET product
8	ESMC, ESET PROTECT
11	ESMC, ESET PROTECT
17	ESET PROTECT 9.0 ESET PROTECT 8.x with additional manual settings described in the expander below

ESET PROTECT 8.0 with JDK 17 settings

Restart Apache Service after every change

You need to restart Apache Service after every change in the .exe or .bat files.

Press the Windows key on your keyboard and type Service.
Right-click it Apache Tomcat from the list on the right side.
Click Restart.

Option 1

Navigate to Apache Tomcat folder and in the bin folder, locate tomcat9w.exe.
Run the tomcat9w.exe file. Click the Java tab and add following values into the Java 9 Options field:

--add-opens=java.base/java.util=ALL-UNNAMED
--add-opens=java.base/java.util.concurrent=ALL-UNNAMED

The Java 9 Options field now includes following values:

--add-opens=java.base/java.lang=ALL-UNNAMED
--add-opens=java.base/java.io=ALL-UNNAMED
--add-opens=java.base/java.util=ALL-UNNAMED
--add-opens=java.base/java.util.concurrent=ALL-UNNAMED
--add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED

Click OK.

Option 2

Navigate to Apache Tomcat folder and in the bin folder, locate and edit catalina.bat.
Change the values in section rem Configure JAVA 9 specific start-up parameters

set "JDK_JAVA_OPTIONS=%JDK_JAVA_OPTIONS% --add-opens=java.base/java.lang=ALL-UNNAMED"
set "JDK_JAVA_OPTIONS=%JDK_JAVA_OPTIONS% --add-opens=java.base/java.io=ALL-UNNAMED"
set "JDK_JAVA_OPTIONS=%JDK_JAVA_OPTIONS% --add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED"

into

set "JDK_JAVA_OPTIONS=%JDK_JAVA_OPTIONS% --add-opens=java.base/java.lang=ALL-UNNAMED"
set "JDK_JAVA_OPTIONS=%JDK_JAVA_OPTIONS% --add-opens=java.base/java.io=ALL-UNNAMED"
set "JDK_JAVA_OPTIONS=%JDK_JAVA_OPTIONS% --add-opens=java.base/java.util=ALL-UNNAMED"
set "JDK_JAVA_OPTIONS=%JDK_JAVA_OPTIONS% --add-opens=java.base/java.util.concurrent=ALL-UNNAMED"
set "JDK_JAVA_OPTIONS=%JDK_JAVA_OPTIONS% --add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED"

Option 3

Navigate to Apache Tomcat folder and in the bin folder, locate and edit service.bat.
Navigate to the line s --JvmOptions9 and edit it in the following way:

--JvmOptions9 "--add-opens=java.base/java.lang=ALL-UNNAMED#--add-opens=java.base/java.io=ALL-UNNAMED#--add-opens=java.base/java.util=ALL-UNNAMED#--add-opens=java.base/java.util.concurrent=ALL-UNNAMED#--add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED" ^

Apache Tomcat:
- (ESMC 7.1, 7.2, ESET PROTECT). We recommend that you install the latest Apache Tomcat 9.x.
- 7.0.90 and 7.0.92 (ESMC 7.0).
JDK
- JDK 11 (LTS) – Oracle account is required to download the installer
- JDK 17 (LTS)

No-cost alternative options (these are examples, you can also use openJDK from other vendors):
- Amazon Corretto 8, 11, or 17 - See the installation instructions below.
- OpenJDK 8 (LTS)
- OpenJDK 11 (LTS) – Use the .msi installer and include the Set JAVA_HOME variable feature to ensure that the path to the JAVA environment gets registered in Windows.

If you have multiple Java versions installed on your system, we recommend that you uninstall the earlier Java versions and only keep the latest one.

Ensure that Java, ESMC or ESET PROTECT, and Apache Tomcat have the same bitness (32-bit or 64-bit for ESMC 7.0 and 64-bit for later versions).

MDM enrollment not working on some versions

MDM mobile device enrollment using a QR code is not functional for JDK 11.0.1 and OpenJDK 11.0.1. MDM mobile device enrollment using a QR code is only functional for Amazon Corretto 8u192. All other MDM enrollment methods are functional.

I am installing the ESET PROTECT Server from an All-in-one installer.

Install Amazon Corretto 8 (JDK)

Click to expand

Amazon Corretto 11 and 17 (JDK)

A similar procedure can be applied when installing other supported versions of Amazon Corretto.

Download the Windows .msi installation file.
Double-click the .msi file to start the Installation Wizard.
Follow the steps in the wizard.

You have the option of setting a custom installation path. By default, Amazon Corretto 8 is installed at C:\Program Files\Amazon Corretto\. If you set a custom path, make a note of it for the next step.
When the Installation Wizard is finished, set the JAVA_HOME and PATH environment variables.

Set JAVA_HOME to the installation location, noting that the directory contains the currently installed version. For example, if the default directory is used for 8u242, then set JAVA_HOME as C:\Program Files\Amazon Corretto\jdk1.8.0_242.

Add %JAVA_HOME%\bin to the current PATH variable.
Verify the installation by running java -version in a command prompt. You should see the following output.

openjdk version "1.8.0_242"
OpenJDK Runtime Environment Corretto-8.242.07.1 (build 1.8.0_242-b07)
OpenJDK 64-Bit Server VM Corretto-8.242.07.1 (build 25.242-b07, mixed mode)

Migrate your existing ESMC / ESET PROTECT Web Console to use JDK

You can migrate your existing Web Console from Oracle Java JDK to an alternative one. Choose one of the migration scenarios below based on your current Apache Tomcat version.

Migration scenario for Tomcat version 7.0.90 and later

This migration scenario does not require the reinstall of Apache Tomcat.

Navigate to the Apache Tomcat location (for example, C:\Program Files\Apache Software Foundation\Tomcat 7.0\bin\Tomcat7w.exe)
In the Apache Tomcat 7 Properties window, click the General tab and click the Stop button to stop the Apache Tomcat service.
Uninstall your current JDK.
Install your desired JDK.
Go back to the Apache Tomcat Properties window and click the Java tab.
Under the Java Virtual Machine path, select the correct path to the jvm.dll file based on the JDK. (for example, for Amazon Corretto, C:\Program Files\Amazon Corretto\jdk11.0.7\bin\jvm.dll)
Go back to the General tab, and click Start to start the Apache Tomcat service.
Verify that you can log in to your Web Console.

Migration scenario for Tomcat version 7.0.88 and earlier

This migration scenario requires the reinstall of Apache Tomcat.

Back up the necessary files:
C:\Program Files\Apache Software Foundation\Tomcat 7.0\.keystore C:\Program Files\Apache Software Foundation\Tomcat 7.0\conf\Server.xml C:\Program Files\Apache Software Foundation\Tomcat 7.0\conf\Tomcat-users.xml C:\Program Files\Apache Software Foundation\Tomcat 7.0\conf\Serverinfo.properties C:\Program Files\Apache Software Foundation\Tomcat 7.0\webapps\era\WEB-INF\classes\sk\eset\era\g2webconsole\server\modules\config\EraWebServerConfig.properties
Download and run the JDK installer.
To change which JDKis used by Apache Tomcat, you need to reinstall the Apache Tomcat.
If you are running more than Web Console on your instance of Apache Tomcat, we recommend that you check the official Apache Tomcat upgrade/migration documentation.
If you use a custom SSL certificate store in the Tomcat folder, back up the certificate.
Uninstall the current version of Apache Tomcat.
Delete the following folder if it is still present in your system:

C:\Program Files\Apache Software Foundation\Tomcat 7.
Run the Apache Tomcat installer from the ESET PROTECT All In One installers folder. During the installation, select the path to your JDK you intend to use instead of the Java SE. (for example, C:\Program Files\Amazon Corretto\jre8).
When you are finished, deselect the check box next to Run Apache Tomcat.
Verify that the Apache Tomcat Service is not running.
Copy the era.war file from the installers folder to the Apache Tomcat web applications folder: click Start → Apache Tomcat → Tomcat Program Directory and open the webapps folder (on most Windows operating systems - C:\Program Files\Apache Software Foundation\Tomcat 7.0\webapps
Allow a few minutes for the file extraction and Web Console installation. The installation will run silently, but you can verify a successful installation by the presence of the era folder inside the webapps folder.
If you run the Web Console (Apache Tomcat) on a different computer than the Server component, restore the backed up EraWebServerConfig.properties file to its original location.
Verify that the Apache Tomcat is using the JDK you selected. To do so, click Start → All Programs → Apache Tomcat → Monitor Tomcat. In the Java tab under Java Virtual Machine, there should be the path to the JDK you selected.
You can now start the Apache Tomcat service and verify that the Web Console is running without issues.

Last Updated: Oct 28, 2021