Issue:

Linux Security 64 "Master-Switch" command cannot stop/start the process/service since after update, Linux Security 64 (12.0.222), BaseGuard (1.0.532) and FSBG (1.0.508).
This problem is not happening in PSB mode/Standalone mode.

Resolution:

This problem is happening due to policy setting in LS64.  

1. Login to Policy Manager.
2. Change "Allow users to unload products" to "Allowed always"
3. Deploy new policy to LS64.

Issue:

Linux Security 64: Installation failure with error "activate: No such file or directory" when mounted "/var/opt/f-secure" as separate filesystem

# bash f-secure-linuxsecurity/f-secure-linuxsecurity-installer
f-secure-linuxsecurity/f-secure-linuxsecurity-installer: line 68:
/opt/f-secure/linuxsecurity/bin/activate: No such file or directory
Failed to activate the product!

[df.txt]
/dev/mapper/cl-var                 2.0G  513M  1.5G   26% /var
/dev/mapper/cl-var_opt_f–secure   3.0G  164M  2.9G    6% /var/opt/f-secure

Resolution:

Mounting "/var/opt/f-secure directory" on a separate filesystem is not supported, thus failed to install Linux Security 64.
But alternatiely can consider to mount the whole "/var" directory on a separate filesystem, which is supported.
 

Issue:

How to check schedule scanning log message's "Severity" and "Facility"?

lspmd-start: alert [source=schedule scan]: path=/root/download/eicar.txt.malware; action=rename; infection=EICAR_Test_File
 

Resolution:

If you run journalctl with "-o verbose" you can see priority and facility for each log message.
For lspmd's log, you can run command below:
 

journalctl -o verbose -u f-secure-linuxsecurity-lspmd | egrep 'PRIORITY|FACILITY' | sort -u

Example:
[root@centos7test ~]# journalctl -o verbose -u f-secure-linuxsecurity-lspmd | egrep 'PRIORITY|FACILITY' | sort -u
    PRIORITY=6
    SYSLOG_FACILITY=3

Issue:

Linux Security 64: How to configure daily schedule scan using lsctl command? 

Resolution:

Run the following commands to enable schedule scan on everyday.

# /opt/f-secure/linuxsecurity/bin/lsctl set ods schedule weekly_schedule monday true
# /opt/f-secure/linuxsecurity/bin/lsctl set ods schedule weekly_schedule tuesday true
# /opt/f-secure/linuxsecurity/bin/lsctl set ods schedule weekly_schedule wednesday true
# /opt/f-secure/linuxsecurity/bin/lsctl set ods schedule weekly_schedule thursday true
# /opt/f-secure/linuxsecurity/bin/lsctl set ods schedule weekly_schedule friday true
# /opt/f-secure/linuxsecurity/bin/lsctl set ods schedule weekly_schedule saturday true
# /opt/f-secure/linuxsecurity/bin/lsctl set ods schedule weekly_schedule sunday true

Run the following command to configure the time to start a schedule scan on the set days. 
The value is a 24-hour time value (HH:MM) in the endpoint's time zone.

# /opt/f-secure/linuxsecurity/bin/lsctl set ods schedule weekly_schedule time_of_day 14:00

Refer to help page for details:
https://help.f-secure.com/product.html#business/linux-security-64/latest/en/concept_4CDB54E11FDF4560B87FE6C3C8935385-latest-en
・ods schedule schedule_type
・ods schedule weekly_schedule
・ods schedule weekly_schedule [monday|​tuesday|​wednesday|​thursday|​friday|​saturday|​sunday]
・ods schedule weekly_schedule time_of_day

Issue:

How to configure DKIM and DMARC in Messaging Security Gateway?

Resolution:

To configure DKIM:

1. Navigate to Email Protection > Email Authentication > DKIM > General
2. For Enable, select On. A Policy Routes section appears
3. Enable Restrict processing to selected policy routes…
4. Confirm that the policy route default_inbound is present in the Require Any Of-list
5. Add any other required inbound policy routes to the Require Any Of-list
6. Click Save Changes

To enable DKIM signing:

DKIM signing is not required for authenticating incoming email, but needs to be set up if you want others to be able to authenticate emails coming from your organization.

1. Navigate to Email Protection > Email Authentication > DKIM Signing> General
2. For Enable, select On
3. Set the DKIM Signing Error to Reject the message temporarily
   1. Click Edit Rule…
   2. Make sure Delivery Method is set to Retry
   3. Click Save Changes
4. Navigate to Email Protection > Email Authentication > DKIM Signing> Keys
5. Click Generate Key
6. Set Domain to the domain that the key should be signing
7. Set Selector to any alphanumeric string, at your discretion. The important thing is to NOT leave the field empty
8. Set Scope to either Any, Domain Including Sub-Domains or Exact Domain
9. Tick the Disable processing for selected policy routes…-checkbox
10. Add all inbound policy routes to the Disable For Any Of-list

Once the key is generated, a DNS text record is also generated which will need to be published to your DNS servers. Click View in the DNS Text Record column to see the record for a specific key.

To enable DMARC:

1. If SPF is not enabled:
   1. Navigate to Email Protection > Email Authentication > SPF > General
   2. For Enable, select On. A Policy Routes section appears
   3. Enable Restrict processing to selected policy routes…
   4. Confirm that the policy route default_inbound is present in the Require Any Of-list
   5. Add any other required inbound policy routes to the Require Any Of-list
   6. Click Save Changes
2. If DKIM is not enabled:

• Refer back to the instructions above, "To configure DKIM", regarding how to set up DKIM

1. Enable DMARC:
   1. Before you enable DMARC, ensure that you have also enabled the SPF and DKIM modules
   2. Navigate to Email Protection > Email Authentication > DMARC > General
   3. For Enable, select On. A Policy Routes section appears
   4. Enable Restrict processing to selected policy routes…
   5. Confirm that the policy route default_inbound is present in the Require Any Of-list
   6. Add any other required inbound policy routes to the Require Any Of-list
      • Important: Ensure that the same inbound policy routes that you selected for the SPF and DKIM modules are also on the Require Any Of–list
   7. Click Save Changes

Issue:

Is it possible to create a read-only account to login into Policy Manager Console? How to create an account to login to Policy Manage Console?
 

Resolution:

If you want to limit a user's access, you can add users with either admin or read-only access to Policy Manager. The process is described in this user guide: https://www.withsecure.com/userguides/product.html#business/policy-manager/16.00/en/task_A0E9BD3FFD504E28A2B04B8689CFF649-16.00-en

Issue:

New updates for some software such as Citrix Receiver appear on the Software Updates list in Policy Manager console Software Updater. Whenever I try to download and install them, I receive the following status message: The update package must be downloaded manually.

What does it mean and how can I install the newest updates?

Resolution:

The message means that the updates must be downloaded directly from the Citrix Receiver official website. After downloading the updates, install them manually as it is not possible to do it via the Policy Manager console or by using Software Updater. 

The reason why it is not possible is that more and more sites require authentication (e.g. "I'm not a robot" captcha). 

In those cases where Software Updater cannot download the updates, it advises that an update is available and can be installed manually to ensure security.

Issue:

Is it possible to install Policy Manager Console silently? 

Resolution:

The WithSecure  Policy Manager management console is typically only installed on admin computers and thus an unattended installation is a rare use case. We recommend installing the console manually for the administrators who need it.

The WithSecure  Policy Manager installer does not feature the possibility to install either the Policy Manager Server or the Policy Manager Console silently. 

If you want to install the Policy Manager Console for several computers without any visible user interface. You can simply copy the contents of C:\Program Files (x86)\F-Secure\Administrator\ to the desired host. Fspmc.exe can be run to start the Policy Manager Console.

Issue:

Internet Gatekeeper blocks(or slowdown) some specific web sites, although other web site are no problem.

Resolution:

When specific web sites are blocked(or slowdown) through Internet gatekeeper, Internet Gatekeeper needs to be configured as below.
 

HTTP/1.0 requests relayed by the Internet Gatekeeper may not be processed due to the setting of the destination Web server, etc., such as when there is a problem with connection only when accessing a specific Web site, although it does not occur with other Web site access I will.

In cases where such a version of HTTP is a problem, there is a possibility that improvement can be expected by trying the following procedure.

1.) Set use_http11 = yes for Linux gateway expert option (default: no setting)

By default, the Linux gateway converts to HTTP / 1.0 for HTTP / 1.1 requests and sends it to the server, but there is a possibility that improvement can be expected by using the HTTP / 1.1 transparent function by the following procedure.

In addition, since this feature has been improved from time to time by version upgrade, we recommend you update to the latest version.

Insert a description of use_http 11 = yes in the entry of [http] in <installation directory> /conf/fsigk.ini

use_http 11 = yes

Then, please restart the HTTP proxy process.

# <Installation directory> /rc.fsigk_http restart

2.) Change settings on the Windows browser side.

Exclude the check box for the Internet Options Advanced tab "Use HTTP 1.1" "Use HTTP 1.1 for proxy connection". Please restart the browser after setting.

3.) Set keepalive = yes setting of Linux gateway to no.

After that, to reflect the setting

# <Installation directory> /rc.fsigk_http restart

Please restart the HTTP proxy process.

4.) Add ipv6 = no setting to the Linux gateway.

　(It is set not to perform name resolution in IPV 6)

<Installation directory> /conf/fsigk.ini

[http]

ipv6 = no

After that, please restart the HTTP proxy process.

# <Installation directory> /rc.fsigk_http restart

####For connection problems, various factors such as server load, Ethernet MTU value, name resolution failure, etc. can be considered, so strictly specify the cause by collecting packet log etc.

* The normal installation directory is /opt/f-secure/ fsigk.

Issue:

Can I verify if WithSecure Policy Manager is affected by the vulnerability, CVE-2021-42392?

Resolution:

The H2 Console is not enabled in the Policy Manager Server by default.

Even if the H2 Console has been enabled through the advanced configuration for the Policy Manager Server, there is no way to inject the database URL into it.

Hence, the Policy Manager Server is not affected by this vulnerability.