Issue:

How do you set up the WithSecure Policy Manager Server to communicate via HTTP proxy?

Resolution:

Steps for Policy manager 16.00 and below :

How to enable:

1. Navigate to folder C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\ on the Policy Manager server
2. Open the fspms.proxy.config file
3. Remove the # before the http_proxy line and add your password and proxy address
4. Save the config file
5. Restart the Policy Manager Server -service

Steps for Policy Manager 16.01 and WithSecure Policy Manager Proxy 16.01

If the Policy Manager or Policy Manager Proxy host does not have a direct internet connection, specify the HTTP proxy configuration as 'PROXY_SERVER' MSI argument for example by running an MSI file from the command line and passing the arguments to it:

msiexec /i policy-manager.msi PROXY_SERVER=http://proxy.example.com:8080

Use percent encoding for any reserved URI characters in the user name or password. For example, if the password is ab%cd, you need to enter it as follows:http://user:ab%25cd@proxy.example.com:8080

May refer more details from this changelog article : Business Suite Policy Manager Changelog — WithSecure Community

How to disable:

1. Navigate to folder C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\ on the Policy Manager server
2. Open the fspms.proxy.config file
3. Add a # before the http_proxy line. The # means that the line is a comment and the setting will not be taken into use

Issue:

User wants to exclude a specific software update from WithSecure Software Updater automatic installation.

Resolution:

You can create a rule to exclude a certain software update from Software Updater automatic installation in Policy Manager Console by following these steps:

1. Log in to Policy Manager Console 
2. Select the host or domain from the Domain tree 
3. Select the Settings tab
4. Go to the Software Updater page
5. Click Add from the right side of Exclude software from automatic installation table
6. Enter software name and/or bulletin ID 
7. Distribute policy to the hosts 

Now the selected domain or hosts will have an exclusion for the software updates you have created a rule for. 

Just a note that the the Automatic Exclusions created will only apply for installations done automatically. It will not include manual installations. 

Also if you wish to completely exclude a certain software from any installation, you need to exclude that software from Software Updater scan itself. 

Issue:

How can we retrieve a list of missing updates per hosts for Software Updater (SWUP)?  The Policy Manager Web Reporting tool has a "MISSING UPDATES" report. This report lists how many computers have missing software updates but not the names of these computers.

Resolution:

As a workaround, the following SQL query can be used to list the missing updates including the computer/server hostnames. To activate the setting, consult the "Policy Manager Advanced configurations settings" -page

– https://community.f-secure.com/discussion/11869/policy-manager-advanced-configuration-settings

The setting to activate is -Dh2ConsoleEnabled=true. To start the H2 console, open the URL https://localhost:8080 on the Policy Manager Server and click the link visible in the screenshot below.

Issue:

In WithSecure Policy Manager Console, how do you enable or turn on the Offload file scanning functionality for WithSecure Client Security 15 or 16 that are in virtual environments?

Resolution:

Starting from WithSecure Client Security version 14 onwards, the Offload Scanning Agent (OSA) is activated through the policy. 
This policy setting may or may not be included in the installation package.

In order to enable or disable the functionality, you can change it under the following setting using the Policy Manager Console: 

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Navigate to Virtual security > Offload Scanning Agent
5. Enable Offload file scanning

Issue:

In case Atlant/Linux Security 64 is managed by Policy Manager which is not version 16, the following error is output in journal/syslog after updating Atlant 1.0.319/Linux Security 64 12.0.482. Is the component installed properly?

Failed to complete update installation due to Policy Manager version. Please update to WithSecure Policy Manager 16 or greater.

Resolution:

The component is installed successfully, it can be ignoered the warning.
This message to suggest upgrade PM version 16, before PM15 will be EOL.

Issue:

How do I uninstall / remove WithSecure Linux Security 11.xx?

Resolution:

You can follow the steps below to fully remove the WithSecure Linux Security 11.xx: 

1. Execute the following script as root: 

   # /opt/f-secure/fsav/bin/uninstall-fsav

2. Check if any of the following three directories exist:

   # /etc/opt/f-secure
   # /opt/f-secure
   # /var/opt/f-secure

3. If any of those directories still exist, execute the following command to manually remove them:

   # rm -rf /etc/opt/f-secure
   # rm -rf /opt/f-secure
   # rm -rf /var/opt/f-secure

4. This will remove all parts of the Linux Security 11.xx product

Note: A reboot is not required for this uninstallation.

Note: If other Linux products are installed in the same server, please don't delete folders manually.

Issue:

After upgrading or installing WithSecure Client Security/Server Security 16, you encounter issues with communication. Symptoms include:

• the host is unable to connect to WithSecure Policy Manager Server
• the host is not visible on the "Import host" list in WithSecure Policy Manager Console.

However, the hosts might be able to download updates.

Resolution:

Note: Make sure that the WithSecure Policy Manager Server address is correct and that the host communication ports (default: TCP 80 and 443) are listening.

Test the connectivity between the clients and Policy Manager:

1. Try to connect to the WithSecure Policy Manager Server's address via a web browser from one of the hosts (http://pms-server.local:80 and https://pm-server.local:443). If the connection is set up correctly, you will receive a web page from the WithSecure Policy Manager Server indicating so. If there is no page loaded, check that the host communication ports to the Policy Manager Server are allowed in your firewall.
2. Make sure that you have configured the WithSecure Policy Manager Server IP address and/or hostname correctly and that the ports configured for host modules are correct. 

On the host running WithSecure Client Security/Server Security, the following log contains details on the connection status with the WithSecure Policy Manager Server. You can use it to troubleshoot connection issues:

C:\ProgramData\F-Secure\Log\BusinessSuite\PmpSelectorPlugin.log

Below is an example of a failed connection:
 

I: Connecting to wait.pmp-selector.local
I: Update check failed, error=210 (unable to resolve host)
I: Connection failed
W: ServerFinder::Ping: Ping to {host: 10.10.10.10, http: 82, https: 443} aborted. There are no valid certificates
I: UpdatablePmCertVerifier::RenewCertificates: Renewing certificates from 10.10.10.10
E: UpdatablePmCertVerifier::RenewCertificates: Failed to download certificate bodies. AsyncSendRequest failed: 12002
W: CosmosUpdater::Run: No servers responded. Policy Manager unavailable.

Error 12002 means ERROR_WINHTTP_TIMEOUT > Client Security/Server Security cannot connect to Policy Manager to fetch this list.
A complete list of Microsoft Windows HTTP Services errors is available here. 

Below is an example of a working connection:

I: UpdatablePmCertVerifier::RenewCertificates: Renewing certificates from 10.11.10.10
I: UpdatablePmCertVerifier::RenewCertificates: 2 certificate(s) renewed successfully; expire in 86170 seconds

If you have confirmed the communication to work between the client computer and the Policy Manager Server, and you have made sure that the Policy Manager address and ports are configured correctly, make sure that the date and time are configured correctly on the client device.

If the date and time are incorrectly set, the certificate download from the Policy Manager Server will fail. The date and time can be easily incorrectly set in an offline environment, since the Network Time Protocol (NTP) can't be used to set the date and time. 

Check the PmpSelectorPlugin.log again for the following:

W: ServerFinder::Ping: Ping aborted: there are no valid certificates
I: UpdatablePmCertVerifier::RenewCertificates: Renewing certificates from 192.168.1.100:443 with HTTP proxy ''
W: UpdatablePmCertVerifier::StoreCertificates: Certificates renewal yielded no fresh certificates

In the above example the client tries to download the certificate from the Policy Manager Server, but since the client's date and time are in the future compared to the Policy Manager Server, the client thinks no fresh certificate is available.

Issue:

How to configure or change the default server failover time for clients to fetch the updates from the WithSecure Update Server when they are unable to reach the Policy Manager Server?

Resolution:

Changing the failover time requires the use of "advanced mode" in the Policy Manager Console:

1. Open the Policy Manager Console
2. Click on Tools > Preferences 
3. In the Appearance tab, enable Make advanced mode available for Settings and Status pages
4. Click OK

Follow these steps to change the server failover time:

1. Highlight a host or policy domain from the Domain Tree
2. Go to the Settings tab and select 13.x and older hosts
3. Navigate to F-Secure Automatic Update Agent > Settings > Communications > Intermediate Server failover time
4. Change the time accordingly (default is 1 hour)

Note: Minimum is 1 hour, Maximum is 256 days.

Issue:

When I run the command fsav [path/file] the command returns "ERROR: Password protected file" 

Resolution:

"Treat password-protected files as safe" setting on WEBUI has been disabled. This means that a message of "Password protected file" will be output every time such files are being scanned. 

By default, the setting is enabled which means that any password protected files are considered to be safe and the scan result will always show as "clean". To revert;

1. Login to WEBUI 
2. Click on "Advanced mode"
3. Go to "Virus Protection" > "Real-time Scanning" 
4. Enable the "Treat password protected archives as safe" setting
5. Click on the "Save" button at the right bottom of the page.
6. For Manual Scans, go to  "Virus Protection" > "Manual Scanning" 
7. Enable the "Treat password protected archives as safe" 
8. Click on "Save" button

Issue:

F-Secure Baseguard services f-secure-baseguard-orspgw and f-secure-baseguard-update services are gone for Linux Security 64 and Atlant after FSBG 1.0.907 update.

Resolution:

This is an intended change for Linux Security 64 and Atlant from FSBG version 1.0.907 onwards. These services were removed since they are no longer required. 

Details of these changes can be checked from change logs listed below:

New Linux Security 64 update has been released (2024-09-02)
https://community.withsecure.com/discussion/117646/linux-agent-ls64-changelog-elements-business-suite-standalone/p3
※LNX-299: Removed obsolete BaseGuard update service.

New Atlant update has been released (2024-09-02)
https://community.withsecure.com/discussion/120778/atlant-changelog/p3
※LNX-299: Removed obsolete BaseGuard update service.