Issue:

I need to update Client Security 15 or older in an offline or isolated environment, where internet is not available.  I used to use f-secure-updates.zip to do that, but it is no longer created when the fspm-definitions-update-tool.bat is ran. 

Resolution:

Client Security 15 or older versions are no longer supported.  Client Security 15 and older versions connect to old f-secure.com update servers which are no longer online. You will need to upgrade to Client Security 16 or later so that you can use the withsecure-updates.zip. 

Issue:

Why do Client Security and Server Security host devices send the following alert to the Policy Manager Consoler Alerts tab?

Access to file was blocked.
Application path: C:Example\Example.exe
Path: C:\ProgramData\Example\Example\

Resolution:

This type of block is the function of the Tamper Protection functionality. The alerts you are seeing are expected behaviour and not a cause for alarm.

Tamper protection functionality sees that some process tries to open a protected file with write access rights. Tamper protection blocks this operation, so the application gets ACCESS_DENIED error. Importantly, this block does not affect the normal operation of either third party application or Client Security itself, it is a cosmetic alert.

To stop the flood of alerts without reducing your protection level, you can create an alert sending exclusion in Policy Manager Console for that specific alert type:

1. Log in to Policy Manager Console
2. Select a host or policy domain from the Domain Tree
3. Go to the Settings tab
4. Go to the Alert sending page
5. Scroll down to the Alert sending exclusions list and click Add
6. Select Source as Tamper protection
7. Select the Type, Action and Alert shown in the security event
8. Click OK to finish adding rule
9. Distribute policy (Ctrl + D)

Issue:

I need the download link to an older version of Policy Manager / Server Security / Client Security. Can you send me the download link?

Resolution:

Previous versions of WithSecure products can be found in Partner Portal. If the version required is not there, please contact WithSecure and provide which product and version is needed, along with the reasons.

Gentle reminder to always use the latest version, as older versions may contain bugs and vulnerabilities that has been fixed in the latest version. End of Life versions may eventually no longer receive virus definition updates, and ineligible to receive support if there are any issues. 

Issue:

Offline computers in an isolated environment running Business Suite Client Security 16.01 and Server Security 16.01 are not able to be updated because when applying the zip-file using fsaua-update_32.exe, the following error message is displayed: "ERROR: Update archive file is broken" 

Resolution:

This is a known issue in the 16.01 version of Business Suite Client Security and Server Security. The issue will be fixed in client version 16.02. You can follow the Business Suite change log to know when 16.02 has been released: Business Suite Client Security and Server Security 16.x Changelog — WithSecure Community

As a workaround, you can copy the fsaua-update_32.exe file from version 16.00 and use it with the 16.01 version of Client Security or Server Security. The fsaua-update_32.exe file can be downloaded from https://download.withsecure.com/corpro/cs/cs16.01/fsaua-update_32.zip

Simply copy the file from version 16.00 and drop it in the same folder and overwrite the fsaua-update_32.exe file that came with version 16.01. 

Issue:

• Windows Firewall status is red with error message: "Windows Defender Firewall is using settings that make the device unsafe"
• The Windows Firewall state is set to: ON
• Both Inbound and Outbound unknown connections is set to: Allow

Resolution:

If Windows Firewall is showing its status as a red white cross, and the message: "Windows Defender Firewall is not using the recommended settings to protect your computer". This could be if both of the following settings have been set to allow:

• Inbound connections that do not match a rule are allowed
• Outbound connections that do not match a rule are allowed

Unknown inbound connections should not be allowed. This setting can have been changed either from the WithSecure firewall profile or by using GPO. 

In Policy Manager Console make sure that the setting has not been set using the WithSecure firewall profile:

1. Open the Policy Manager console
2. Select the host or domain from the Domain Tree
3. Click on the Settings tab
4. Go to the Firewall settings page
5. Ensure the value under  "Profile being edited" is the current profile in use
6. Set the value of Unknown inbound connections to Block
7. Distribute the profile (ctrl +D) 

In Elements Security Center make sure that the setting has not been set using the WithSecure firewall profile:

1. Login to Elements Security Center: https://elements.withsecure.com/
2. Go to Security Configurations
3. Click on Profiles
4. Choose the Profile in use
5. Click on the Firewall tab in the left sidebar
6. Choose the Firewall in use
7. Check that Allow unknown inbound connections and Allow unknown outbound connections are not both set to ON

Once the host receives the new profile the firewall should stop displaying the message and the status should turn to green.
If the Windows Firewall would still show "Inbound connections that do not match a rule are allowed", make sure that the setting has not been forced using GPO.

Issue:

Linux Security 64 servers display real-time scanning status as "Disabled" in Policy Manager console status page. Policy for these servers is set to real time scanning as "on" and users are not allowed to change this setting.

Why does the status show real-time scanning as disabled even if it should be enabled? 

Resolution:

With the latest release of Linux Security 64, it checks now if the real time scanning is configured to scan anything.

It is a product design that there is a need to add the files and folders to scan after the product installation in case of real time scanning.

By default nothing is scanned, so you need to add some paths (for example, root directory of "/" for scanning all files) to the "Files and folders to scan" configuration in order to make the real time scan working.

For safety reasons, we do not start scanning things by default but it is up to the user to configure the real time scanning as they see fit.

This behavior is totally different from Windows product and even the old unsupported Linux Security 11.xx product, where all files are scanned by default after the installation.

If you have not configured it yet, you could perform the following steps to change the configuration for the real time scanning and distribute the policy.

1. Login to Policy Manager Console
2. Select the Linux Security 64 host on the domain tree
3. Go to "Settings" tab > "Linux" > "Real-time scanning"
4. Enter root directory (/) at "Files and folders to scan" setting
5. Click on "Distribute Policies" button at the top left corner of Policy Manager Console screen
6. Click on "Distribute" button to proceed with the policy distribution
7. Check if the correct status is shown now

1. Open the Terminal
2. Run the following command as root user
   • /opt/f-secure/linuxsecurity/bin/fsdiag.sh
3. Check the diagnostic file (fsdiag-linuxsecurity-yyyymmddxxxxxx.tar.gz) in the "/var/opt/f-secure/linuxsecurity" directory

Issue:

I have renewed my WithSecure Messaging Security Gateway (MSG) license but the appliance still states the license is expired, how can I fix this issue?

Resolution:

Despite renewing your WithSecure Messaging Security Gateway (MSG) license, there is a possibility the license expiry date is not updated in our system. Proceed to contact your F-Secure reseller or sales contact. If you are unable to reach your point of contact in WithSecure, proceed to report the issue by contacting support.

Issue:

I have WithSecure Linux Security 64 installed and there is a lot of fstrace.lock.xxx files created in /tmp/. What are those files and what do I do with them?

Resolution:

The fstrace.lock.* files are temporary files created by WithSecure Linux Security 64 (LS 64). The files are generated by various services of LS 64 when the service starts or restarts. We have changed many of the services that they no longer generate these files under /tmp but there are still some services that have either not been released or changed yet (for example fsbg-pmd and fsbg-updated). Those files can be ignored. 

Issue:

WithSecure Linux Security 64 is not connecting to the Policy Manager Server and it is not visible in the "Import new hosts" tab in Policy Manager Console.

Resolution:

Check the "/var/opt/f-secure/fspms/logs/request.log" file of Policy Manager server whether there is any request from that Linux client by searching for its IP address in the log file.

Issue:

After installing WithSecure Linux Security 64 the following error messages related to the missing dependencies is returned.

Do you accept this license agreement? The license agreement text is available at /opt/f-secure/linuxsecurity/doc/LICENSE
/var/opt/f-secure/linuxsecurity/download/linuxsecurity-1200-linux-x86_64/1562587205/content/setup: package 'fuse-libs.x86_64' is not installed
2019-07-19 13:11:56 src/fsbootstrap.c:417[7] executing '/var/opt/f-secure/linuxsecurity/download/linuxsecurity-1200-linux-x86_64/1562587205/content/setup' failed, result 256
2019-07-19 13:11:56 src/fsbootstrap.c:209[7] install failed
Failed to activate the product!

Resolution:

You need to install the necessary dependencies.

1. Uninstall the current WithSecure Linux Security 64 installation

   rpm -e f-secure-linuxsecurity
   

2. Install the missing dependencies (example fuse-libs and libcurl)

   yum install -y  fuse-libs libcurl

3.  Re-install WithSecure Linux Security 64 by using the following commands.

   bash f-secure-linuxsecurity/f-secure-linuxsecurity-installer 2>&1 | tee ls64_install_2.log