This article is about customizing the default Apache HTTP Server configuration that comes with lmadmin.exe of FlexNet Publisher. If you do not distribute lmadmin to your customers, this article may not be of relevance.

Lmadmin allows customization of default Apache HTTP Server configurations (that comes bundled with lmadmin) and extend the httpd.conf.

Why customize?

Lmadmin does come with security hardened httpd.conf to the extent possible. But some configuration changes require us to notify customers before the changes are released.

As such,  some customers would want to harden their security beyond what is shipped with lmadmin by default. For example, some customers might want to disable certain Ciphers, while some customers might want to add some secure headers.

How to customize?

To accommodate the difference in customer preferences, customizations can be done by adding a file httpConfExtra.conf in lmadmin configuration folder. And then changing server.xml file to add element includeHttpdConfigFile= conf\httpConfExtra.conf under webserver element.

What if one changes the default httpd.conf?

If customizations are done on the httpd.conf that comes along lmadmin as a default file they’ll be applied. However, when they restart the server customizations will be overwritten back to the default form. Taking the route of httpd.conf is not recommended and it’s not a workable solution.

Recommended Practice

To keep up with security hardening that’s done within FlexNet Publisher’s lmadmin.exe, follow Security Updates section in Release Notes.