The VM Access Proxy is used to provide users outside your corporate firewall access to VMs inside the firewall. As such,  and because Commander supports multiple VM Access Proxies at once, Flexera recommends that you deploy a new VM Access Proxy alongside any that will be decommissioned for being a legacy version. In doing so you prevent any expected or unexpected downtime for users who rely on the VM Access Proxies to connect to their VMs. Deploying a new VM Access Proxy may also be faster than upgrading in some circumstances. 

However, if you decide to upgrade an existing VM Access Proxy to version 3.8, there are some additional steps that must be performed that supplement the published instructions. These steps are required to make sure that security improvments in the server.xml file are active in production. 

1. Follow the upgrade instructions. 
2. Stop the remoteaccess Docker container:

docker stop remoteaccess

3. Back up the server.xml file allowing the VM Access Proxy to install the new server.xml:

sudo mv /var/data/conf/server.xml /var/data/conf/server.xml.pre_3.8

4. Start the remoteaccess Docker container: 

docker start remoteaccess

5. Check if the keystore password is present in server.xml.pre_3.8:

sudo grep 'keystorePass=' /var/data/conf/server.xml.pre_3.8

6. The output of the previous step displays the keystore password like so:

keystorePass="myKeystorePassword"

7.   Working from /var/data/conf open the server.xml file using the nano editor: 

 sudo nano server.xml

8. In the Connector section, locate the element that contains the keystorefile attribute. Add the following line, with the keystore password recorded in step 6. For example:

<!-- Define a SSL HTTP/1.1 Connector on port 443 -->

  <Connector SSLEnabled="true" clientAuth="false" keystoreFile="${catalina.home}/conf/keystore"

  keystorePass="myKeystorePassword"

  maxThreads="150" port="8443" protocol="HTTP/1.1" scheme="https" secure="true"

  sslProtocol="TLS"

  sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2"

  ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"

  />

9. Restart the remoteaccess Docker container to pick up the keystore password: 

docker stop remoteaccess; docker start remoteaccess

Give the VM Access Proxy a few minutes to initialize, and then confirm the console connections are successful.