Issue:

After creating or modifying a Branding template, when adding the Title -information and clicking Save, the saving request keeps hanging (Saving… Please wait) and the Title -information is not being saved.

Resolution:

This happens if you are using empty spaces in the Title and also possibly when using different special characters, which are not supported. To resolve the issue, you will need to remove the spaces and the special characters. 

Issue:

A warning message is being displayed when installing Linux Security 64 on the Linux server, which warns that the current version of the installer is about to become obsolete at the end of 2024 and asks to update the version as soon as possible.

Resolution:

This warning message is expected if you have created the installation package of Linux Security 64 using the older installer (JAR file), which is meant for the older versions (15.xx) of Policy Manager.  

Currently, Policy Manager version 15.xx has reached its End-of-Life in September 2024 (refer to https://www.withsecure.com/en/support/product-updates/eol-reminder-business-suite-15) and newer Linux Security 64 components require the new content package (withsecure-updates.zip) to be used instead of the old one (f-secure-updates.zip) in case of isolated environment.

For a new product installation in the isolated environment, there is a need to create an installation package of Linux Security 64 using the new installer (JAR file) that is meant for Policy Manager version 16.xx, together with the new content package of "withsecure-updates.zip".

New installer (JAR file) for Policy Manager version 16.xx:
https://download.withsecure.com/corpro/ls64/current/wsls64-5.0.10.jar

You may recreate a new installation package using the new installer (JAR file) above and install Linux Security 64 using the content package of "withsecure-updates.zip".

Issue:

The latest Linux Security 64 update 2024-03-18 fails to install
 

Resolution:

The following error is visible in the update.log file:

Update /aquarius/1710768883 installed successfully.
>>> Installing /hydra/1710775746 (Tue Mar 19 15:15:24 EET 2024) >>>
Update /hydra/1710775746 installed successfully.
>>> Installing /linuxsecurity/1710768478 (Tue Mar 19 15:15:28 EET 2024) >>>
Installing pinned certificates
2024-03-19 15:15:34 fsguts2.c:1636[6] empty updates section
2024-03-19 15:15:34 fsguts2.c:1150[6] channel 'pinned-certificates-unix' not found
2024-03-19 15:15:34 src/guts2download.c:203[7] downloading the channel failed, error 207 (item not found)
2024-03-19 15:15:34 src/guts2download.c:88[7] downloading the channel content from http://pms.local:80/guts2 failed, error 207 (item not found)
2024-03-19 15:15:59 net/fsaddrinfo.c:423[7] getaddrinfo() returned error -2 (EAI_NONAME; name does not resolve)
2024-03-19 15:15:59 net/fssocket.c:2395[7] name resolution failed, error 210 (unable to resolve host)
2024-03-19 15:15:59 net/fssocket.c:370[7] fs_socket_tcp_connect_next() returned 210 (unable to resolve host)
2024-03-19 15:15:59 net/fshandle_tcp.c:282[7] failed to connect guts2.sp.f-secure.com tcp port 80, error 210 (unable to resolve host)
2024-03-19 15:15:59 fshttps.c:686[7] connection failed, error 210 (unable to resolve host)
2024-03-19 15:15:59 fsguts2.c:3047[7] unable to perform the HTTP operation, error 210 (unable to resolve host)
2024-03-19 15:15:59 fsguts2.c:1027[7] unable to fetch update information from the server, error 210 (unable to resolve host)
2024-03-19 15:15:59 src/guts2download.c:164[7] unable to fetch the list of updates, error 210 (unable to resolve host)
2024-03-19 15:15:59 src/guts2download.c:88[7] downloading the channel content from http://guts2.sp.f-secure.com failed, error 210 (unable to resolve host)
setup: failed to install pinned certificates (exit status 2)
/opt/f-secure/baseguard/bin/update: Failed to install /linuxsecurity/1710768478

Also, the following alert is visible in Policy Manager Console.

Could not install the following update: linuxsecurity 2024-03-18 (fsbg-pmd).

The alert reproduces with both Policy Manager 15.xx and 16.xx installations that are isolated that is, they do not have internet connectivity.

The latest version of Linux Security 64 introduces a new dependency on the pinned-certificates-unix channel. If you have a high security installation of Policy Manager, without connectivity to the internet and rely on archives to update the policy manager, a minor modification is needed.

The process for using archives to update the Policy Manager Server is described here: 

– https://community.withsecure.com/en/kb/articles/5638-using-archives-to-update-malware-definitions

To fix this particular issue, add the missing 'pinned-certificates-unix' channel to the tool configuration by editing the channels.json file available in the conf-folder. 
Once the change is in place, rerun the tool and import the new databases to the Policy Manager Server. 

Ref: How to add new channel to "channels.json" in conf-folder.

[
  <other channels>

 "atlant-100-linux-x86_64",
  "swup-win",
  "swup-win-db",
  "hydra-macos",
  "pinned-certificates-win"
  "pinned-certificates-unix"
]

The issue with the missing channel pinned-certificates-unix channel will be resolved in the upcoming Service Release of WithSecure Policy Manager (16.02). 

To verify if pinned-certificates-unix has been installed on the Linux Security 64 host, you may refer to the update.log which contains:

Update /pinned-certificates/1667822601 installed successfully.

and

Update /linuxsecurity/1712740227 installed successfully.

Issue:

The user is unable to launch F-Secure Policy Manager Console

Resolution:

To try to resolve this issue, try the following troubleshooting steps in order.

1. If the Policy Manager Console settings-file gets corrupted, Policy Manager Console might fail to start. To fix this issue, try deleting the following file.

C:\Program Files (x86)\F-Secure\Administrator\lib\Administrator.properties

This file can be deleted and PMC will recreate the file at next startup. 

2. Verify if the following F-Secure services are started:

• F-Secure Policy Manager Server
• F-Secure Policy Manager Update Server

If the services are not running, start the services manually and launch the F-Secure Policy Manager Console. If the F-Secure Policy Manager Server service refuses to start, make sure the HTTP and HTTPS ports used by the service are not in use already. 

3. If necessary, you can reinstall Policy Manager Server on top of the existing installation.

4. In the event that this still fails a recovery of the H2DB should be attempted, to do so please follow the instructions from here  – https://community.withsecure.com/en/kb/articles/5639-using-the-policy-manager-for-windows-database-recovery-tool-version-10-00-and-later

Issue:

When trying to connect to the Policy Manager Server, Policy Manager Console prompts an error message: "Cannot connect to the server: localhost:8080. Check that the host name and port number are correct. Port number 8080 is used by default."

Policy Manager Server doesn't start and checking the Status Monitor, all ports are shown with red color, signifying a problem.

End-points cannot connect to the Policy Manager Server to download policies or database updates.

Resolution:

Ensure that Policy Manager Console and Policy Manager Server are running the same version.

For Policy Manager for Windows:

• Follow this Knowledge base Article
• You can also check in the log files if WebUI-Deamon is working. If not, start it first and then try again to connect to the Policy Manager Console.

If the problem still persist

1. Make sure that there is not a port conflict:

• Run command prompt (cmd.exe) as an administrator
• Enter the command "netstat -a -b > C:\port.txt"
• Check in port.txt the ports set in the F-Secure Policy Manager are not used. If the listening port configured for Policy Manager Server service is active and listening, also ensure the port returns the Policy Manager home page when you access the relevant page locally or over the network (use a browser e.g. locally -> http:\\localhost).

Note: if you find a conflict, you can solve it changing the ports or by uninstalling / deactivating the service causing the conflict.

If the problem still persist, maybe is the WithSecure Policy Manager installation broken, in this case contact our WithSecure Support directly.

2. Invalid startup parameters in registry can also prevent Policy Manager Server from starting. Please review the settings:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Data Fellows\F-Secure\Management Server 5
additional_java_args

Valid configuration settings for the additional_java_args are listed and available in WithSecure Community.

This is an example of valid settings:

-DmaxUploadedPackageSize=10485760 -DforbidDownloadingPublicKey=false -Dh2ConsoleEnabled=true -DallowUnsignedWithRiwsAndMibs=true

Below are some examples of invalid settings:

D:\f-secure\backup-folder

-maxUploadedPackageSize=10485760

DmaxUploadedPackageSize=10485760

3. Re-install WithSecure Policy Manager on top of the current installation .

For Policy Manager for Linux:

Edit the /etc/opt/f-secure/fspms/fspms.conf configuration file as below.

Issue:

I downloaded the Atlant VMware image, deployed it and went through all the points based on the manual.
In Policy Manager, under Virtual security, I enabled Offload Scanning and set the IP address of the server.
The client says that it cannot connect to the reputation server.
What could be the problem?

Resolution:

Firstly, you need to check the connectivity status from Client Security to Atlant to make sure that it is not caused by a connectivity issue. If you see some other error besides "400", you may need to check your network settings and the firewall configuration.

To check that the client can connect to the Scanning and Reputation Server, follow these steps:

1. Open the web browser on the client.
2. Browse to:
   • the host name or IP address of Scanning and Reputation Server and
   • the port number that the server is configured to accept connections on (by default, 1344).

If the server replies 400 Bad Request, the connection with the server is working.

If the connectivity is OK , check if you have entered a subscription key at Virtual security > Atlant scanning service > Atlant subscription > Subscription key setting mistakenly, which should be left empty.

This setting should be blank because it is meant for the future implementation of advanced features in Atlant (currently these are not available yet), which requires a separate subscription key in order to enable them.

If you had entered the subscription key on Policy Manager Console to the setting and distributed the policy previously, perform the following steps to solve the issue and check if there is any improvement after that.

1. Clear the value of Virtual security > Atlant scanning service > Atlant subscription > Subscription key setting (leave it empty)
2. Distribute the policy to Atlant instance
3. Wait for a few minutes

After this, Atlant should get its licensing setup working again.

Issue:

A user has forgotten their password to Secure Reader and there is no direct way to reset it.

Resolution:

For internal users, the password can be reset through the appliance webGUI:

1. Log in to the appliance webGUI
2. Go to the System-tab
3. Navigate to User Management->Users on the right
4. Search for the users email-address
5. Click the email address to bring up the user details
6. Go to the Authentication-tab
7. Click the Reset-button next to the password
8. The user will get a welcome email with a temporary password and a link to the end user services that is valid for 30 minutes

For external users, the recommendation from Proofpooint is to remove the user and have them re-register:

1. Log in to the appliance webGUI
2. Go to the System-tab
3. Navigate to User Management->Users on the right
4. Search for the users email-address
5. Check the box to the left of the account that needs to be removed
6. Click the Delete-button on top of the user list
7. The next time the user tries to access the Secure Reader, they will be prompted to create a new account

Removing a user has no impact on how the user can access mails in the future. After the re-registering they will be able to access all their secure mails as before, as long as they are still stored on the appliance.
Although the temporary password sent by the welcome-email will work for an external user to access the Secure Reader, the link in the mail to the end user services will not. As this might cause unwanted confusion the better solution is to remove the current user completely.

Issue:

When executing /opt/f-secure/fspms/bin/fspms-config to configure the Policy Manager proxy, an error message stating the port is already in use is printed:

Specify the details for communication with F-Secure Policy Manager. Enter the server’s IP address or its DNS name.
Server address []: 192.168.1.100
HTTPS port [443]: 443
Port is already in use. Please enter another one.

Based on investigation, the port (here 443) is not is use.
 

Resolution:

The proxy config-script requires and uses the netcat command to check the availability of the port. If netcat is not installed or available, you will receive the above mentioned error message.

To resolve the issue, install netcat. In Debian, this can be installed using the following command:
 

# apt install netcat-traditional

Issue:

• When trying to register a Policy Manager Server, we are getting this error:  The registration cannot be validated. WithSecure Policy Manager Server could not connect to the WithSecure registration server (https://corp-reg.fsapi.com)

Resolution:

What should I do if registration fails, saying that my customer number could not be validated?

The first thing you shoul do, if you get this error message, is to check that you are running a supported version of Policy Manager Server. Check that the Policy Manager version you are running on your server isnot listed as end-of-life: https://www.withsecure.com/en/support/product-lifecycle-announcements

If your Policy Manager Server is supported, check your network configuration to make sure that Policy Manager Server is able to access the registration server.

• version 15: https://corp-reg.f-secure.com
• version 16: https://corp-reg.fsapi.com

Steps to test the connectivity from the same host where Policy Manager Server is installed:

• You need Command Prompt and curl.exe to run the following command:
  curl https://corp-reg.fsapi.com
  • Connection can be treated as successful if you get the html output containing the following: 
    <title>Error 404 Not Found</title>
    <body><h2>HTTP ERROR 404 Not Found</h2>
  • If you use a HTTP proxy, test the connectivity via this proxy: 
    curl https://corp-reg.fsapi.com –proxy [protocol://]proxy_address[:port]
  • If you cannot use curl, try to access https://corp-reg.fsapi.com via Browser
  • Make sure that TLSv1.2 has been enabled. If yes, check and remove the value from additionalJavaArgs and restart fspms service
    • -DhttpsExcludedProtocols=TLSv1.2
• If the connection is blocked, make sure you have allowed the DNS names *. f-secure.com and*. fsapi.com to your firewall, as described here.
• If the browser test is showing that the site is not trusted, it would mean that your host does not trust Amazon Root CA 1 root certificate or intermediate ones.
• If you are using a HTTP proxy, please configure it in the fspms.proxy.config. After the configuration, restart the Policy Manager Service. Depending on the Policy Manger versions and operating system the config file is located at:
  • Windows:
    • version 15: C:\Program Files (x86)\F-Secure\Management Server 5\data\fspms.proxy.config
    • version 16: C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\fspms.proxy.config
  • Linux: /var/opt/f-secure/fspms/data/fspms.proxy.config

Issue:

Unable to change Management Server Address on Client Security or Server Security hosts because the public and private admin keys do not match.
Need to migrate hosts between two Policy Manager Servers without having to do a re-installation of the software client side. 
How can the management key file (admin.pub) on WithSecure clients be replaced in case the original Policy Manager server is no longer available?
How can the Policy Manager Server management address on WithSecure clients be changed when the original Policy Manager server is no longer available?
After upgrading or installing WithSecure Client Security/Server Security 14.x or newer, you encounter issues with communication. Symptoms include:

• the host is unable to connect to WithSecure Policy Manager Server
• the host is not visible on the "Import host" list in WithSecure Policy Manager Console.

Resolution:

As starter, please make sure that the WithSecure Policy Manager Server address is correct and that the host communication ports (default: TCP 80 and 443) are listening.

Test the connectivity between the clients and Policy Manager:

1. Try to connect to the WithSecure Policy Manager Server's address via a web browser from one of the hosts (http://pms-server.local:80 and https://pm-server.local:443). If the connection is set up correctly, you will receive a web page from the WithSecure Policy Manager Server indicating so. If there is no page loaded, check that the host communication ports to the Policy Manager Server are allowed in your firewall.
2. Make sure that you have configured the WithSecure Policy Manager Server IP address and/or hostname correctly and that the ports configured for host modules are correct. 

Below is an example of a failed connection:
 

I: Connecting to wait.pmp-selector.local
I: Update check failed, error=210 (unable to resolve host)
I: Connection failed
W: ServerFinder::Ping: Ping to {host: 10.10.10.10, http: 82, https: 443} aborted. There are no valid certificates
I: UpdatablePmCertVerifier::RenewCertificates: Renewing certificates from 10.10.10.10
E: UpdatablePmCertVerifier::RenewCertificates: Failed to download certificate bodies. AsyncSendRequest failed: 12002
W: CosmosUpdater::Run: No servers responded. Policy Manager unavailable.

Error 12002 means ERROR_WINHTTP_TIMEOUT > Client Security/Server Security cannot connect to Policy Manager to fetch this list.
A complete list of Microsoft Windows HTTP Services errors is available here. 

Below is an example of a working connection:

I: UpdatablePmCertVerifier::RenewCertificates: Renewing certificates from 10.11.10.10
I: UpdatablePmCertVerifier::RenewCertificates: 2 certificate(s) renewed successfully; expire in 86170 seconds

If you have confirmed the communication to work between the client computer and the Policy Manager Server, and you have made sure that the Policy Manager address and ports are configured correctly, make sure that the date and time are configured correctly on the client device.

If the date and time are incorrectly set, the certificate download from the Policy Manager Server will fail. The date and time can be easily incorrectly set in an offline environment, since the Network Time Protocol (NTP) can't be used to set the date and time. 

Check the PmpSelectorPlugin.log again for the following:

W: ServerFinder::Ping: Ping aborted: there are no valid certificates
I: UpdatablePmCertVerifier::RenewCertificates: Renewing certificates from 192.168.1.100:443 with HTTP proxy ''
W: UpdatablePmCertVerifier::StoreCertificates: Certificates renewal yielded no fresh certificates

In the above example the client tries to download the certificate from the Policy Manager Server, but since the client's date and time are in the future compared to the Policy Manager Server, the client thinks no fresh certificate is available.

If the issue still persists after performed all the above steps, you can look at the following log on the host with WithSecure Client Security/Server Security. It shows the connection status with the WithSecure Policy Manager Server. You can use the Keyreplacer to solve the connection issues.

C:\ProgramData\F-Secure\Log\BusinessSuite\PmpSelectorPlugin.log.

From PmpSelectorPlugin.log, this may indicate that the admin.pub on the problematic client, does not match with the admin.prv on the Policy Manager Server:

2022-03-28 18:20:20.977 [18e8.2b48] *E: UpdatablePmCertVerifier::ParseCertificates: Certificate bodies signature invalid. Error is 1  

You can create a keyreplacer file yourself with a tool that can be provided to you by support. The tool comes with instructions on how to create the keyreplacer-file. Please open a support case to WithSecure support and request for the keyreplacer tool. 

Supported products

• Client Security 14 and later
• Server Security 14 and later

Some common uses cases for using this tool are listed below

1. The Policy Manager Server is not accessible and a new Policy Manager management key admin.pub file and the address to the new Policy Manager server needs to be provided to the WithSecure client.
2. The Policy Manager Server is not accessible and a new, changed address to the a Policy Manager server needs to be provided to the WithSecure client.
3. The Policy Manager Server accessible but the Policy Manager management key admin.pub file has changed and needs to be provided to the WithSecure client.

Step-1: Creating the keyreplacer package:

To create the package, you need some prerequisite information-

1. The new Policy Manager hostname or IP-address. Simply use the IP-address and or the hostname or FQDN (fully qualified domain name). Examples: 

• policy-manager-server.acme.com
• 192.168.0.10
• hostname.local

2. The host module HTTP and HTTPS ports the Policy Manager server listens to. The default ports for Policy Manager are port 80 for HTTP and 443 for HTTPS.  If you are not sure which ports are used by the Policy Manager Server, launch  the application "Status monitor" available in the "F-Secure Policy Manager" program group. 

(On Linux systems the port information can be found in the following log:
/var/opt/f-secure/fspms/logs/fspms-stderrout.log )

3. Export the admin.pub file:

• Log on to your Policy Manager Console. 
• From the top menu panel, select Tools > Server Configuration
• Select the Keys tab. Under "Export signing keys", select the button Export
• Enter the private key passphrase

Step-2 Creating the keyreplacer JAR-file

1. Contact the WithSecure Support for the keyreplacer_2021.zip file
2. Once you have the Keyreplacer_2021.zip. you can now extract the ZIP-file that containing the keyreplacer files.
3. Copy the admin.pub file exported from Policy Manager Console in the same folder.
4. Run the following command to create the JAR-file keyreplacer.jar. 

iuupd.exe –create-keyreplacer-package -o keyreplacer.jar –pm-host "10.132.4.214" –pm-port-http 80 –pm-port-https 443 -i admin.pub

Note: the commands should be provided as one, single command. In the example, Policy manager Server IP-address is 10.132.4.214 and the HTTP and HTTPS ports are 80 and 443, respectively. Adjust these values to reflect your own configuration.

Step-3: Instruction to deploy the Key Replacer fix

To install the keyreplacer.jar package created earlier, two installation options are available.

         a) policy based or push installation using Policy Manager
         b) local installation using MSI-file exported from Policy Manager Console.

Note: policy-based installation will only work, if the management key admin.pub has not been changed and therefore can only be used to change the Policy Manager Server address. 

a) Installing the keyreplacer package – policy based installation

1. On the Policy Manager Server, import the registry-file Allow_unsigned_jars_on_PM.reg file included inside the keyreplacer_2021.zip file. To import the file, right-click the file and select option "Merge". This imports the registry changed and enables importing of unsigned packages to Policy Manager Server
2. To activate previous setting, restart the Policy Manager Server using a command prompt:
   • net stop fsms
   • net start fsms
3. Import the file keyreplacer.jar to the Policy Manager Console using Tools > Installation packages. When prompted, select "Yes" to the "not signed by WithSecure" warning message.
4. Perform a push or policy based installation to a target machine.
5. Alternatively, you can also export the previously imported keyreplacer.jar to an MSI-file using Tools > Installation packages. This option is recommended for a local installation of the package.

The same works for Linux, but you need to use config file /etc/opt/f-secure/fspms/fspms.conf instead of the registry. Create a new line with parameter additional_java_args and specify Java system properties in its value in quotes in the following format: -DpropertyName=value. Multiple properties can be specified using space as a delimiter. Property names and values are case sensitive.

Example: additional_java_args=-DallowUnsignedWithRiwsAndMibs=true -Dh2ConsoleEnabled=true -DmaxSynchronousPackageRetrievalRequests=100

4. Start the Policy Manager Server service and open the Policy Manager Console
5. Go to the Installation-tab and click Installation packages
6. Click Import to import "KeyReplacer_unsigned.jar" file to the Policy Manager Console as an Installation package
7. Deploy the KeyReplacer file to all clients, for example using a policy-based installation

After the deployment is finished import the hosts in the Policy Manager Console by going to the Installation tab and clicking "Import new hosts".

b) Installing the keyreplacer package – local installation 

You can export the previously imported keyreplacer.jar to an MSI-file using Tools > Installation packages in your Policy Manager and launch the MSI-package exported using Policy Manager Console. This was created in the previous section "Installing the keyreplacer package – policy based installation". This option is recommended for a local installation of the package.