Issue:

What are the main differences between WithSecure Linux Security 64 and WithSecure Linux Security 11.x?
 

Resolution:

Linux Security 64 is a native 64-bit application, however there are some differences compared to the previous released version Linux Security 11.x, most notably:

• no support for Protection Service for Business (PSB) installation mode
• no firewall
• no web user interface (for remote management with browser)
• no support for unattended (scripted) installations

The list of supported Linux distributions is also different with some legacy distributions only being supported by Linux Security 11.x. 
Also note, that while the installer for Linux Security 64 is created / exported in Policy Manager Console, neither Linux Security 11 nor Linux Security 64 can be deployed / pushed to hosts using Policy Manager Console.

Issue:

Where can I find the WithSecure Policy Manager Server's management public key (admin.pub) used by clients to verify the validity of distributed policies?

Resolution:

You can export the public key (admin.pub) from the Policy Manager Console. To do so, follow the steps below:

Method A – Export the key with the WithSecure Policy Manager Console

1. Log on to your WithSecure Policy Manager Console.
2. From the top menu panel, select Tools > Server Configuration….
3. Select the Keys tab.
4. Under "Export signing keys", select the button Export….

Method B – Downloading the key from the WithSecure Policy Manager Server

From any of the managed hosts:

1. Open a web browser.
2. In the address bar type in the address of the WithSecure Policy Manager Server that this host is connected to, for example:

   https://fspms-local.example:443

3. If the connection to your WithSecure Policy Manager Server is successful, a web page indicating that the Policy Manager Server is operating correctly is shown.
4. Find the paragraph about the "WithSecure Policy Manager Server's public key".
5. Download the key from the highlighted download button/hyperlink (here) in that paragraph.

Issue:

Where can I find the key code for the latest version of my Business Suite software?

• Client Security for Windows or Mac
• Server Security 
• Email and Server Security 
• Linux Security 64

Resolution:

You can find all the key codes of my Business Suite products in your license certificate.

If you do not have the latest version of the license certificate that includes the license keys for the latest version, request a new license certificate from your reseller or distributor.

Partner can find the latest Business Suite license keys from the Partner Portal:

1. Log in to the Partner Portal: https://partnerportal.withsecure.com/
2. Go to the Downloads tab
3. Go to the KeyCodes tab
4. Click on the download here button

This will download a .pdf document with all the license keys available for Business Suite products. 
 

Issue:

What are the default ports used by Policy Manager Server and Policy Manager Proxy?

This article lists the network ports that WithSecure Policy Manager Server and WithSecure  Policy Manager Proxy uses. If you use any port filtering devices or software, verify that the required ports are available. Port filtering devices and software include firewalls, routers, proxy servers or IPsec.
 

Resolution:

Default TCP-Ports: WithSecure Policy Manager: 

• 8080 Default https-port used for Admin module used for communication with Policy Manager Console.
• 8081 Default https-port for WithSecure Policy Manager Web Reporting, the graphical reporting system included in Policy Manager Server.
• 443 Default https-port used for the host module used for communication with the hosts, excluding client database-updates.
• 80 Default http-port used for the host module used for communication with the hosts (legacy F-Secure clients). All WithSecure  clients by default download database updates using this port.

Default TCP-Ports: WithSecure Policy Manager Proxy:

• 443 Default https-port used for the host module used for communication with the hosts, excluding client database-updates.
• 80 Default http-port used for the host module used for communication with the hosts (legacy F-Secure clients). All WithSecure clients by default download database updates using this port.

Note: WithSecure Web Reporting might not be enabled in your configuration. The Policy Manager Server admin module is not by default exposed to other network interfaces than localhost. Software Updater (SWUP) updates are downloaded on port 80.
 

Issue:

What is the recommendation for Windows/Windows SQL server scanning settings? Should the SQL databases and logs be excluded in the virus scanning settings?

Resolution:

As a general rule we always advise to follow Microsoft's official recommendations from their KB base about exclusions on Microsoft corporate software.

You can read more about this subject here: https://support.microsoft.com/en-my/help/822158/virus-scanning-recommendations-for-enterprise-computers-that-are-runni.

More information for SQL Servers: https://support.microsoft.com/en-us/help/309422/choosing-antivirus-software-for-computers-that-run-sql-server

Check our community article for details on how to exclude files and folders from Real Time Scanning. 

How to exclude a file or folder from Real-Time Scanning or DeepGuard for Elements Endpoint Protection? – WithSecure Community

Issue:

The file conf\channels.json contains a list of the channels to be updated for a closed environment. For additional information related to channels.json, see this page:Updating malware definitions on isolated Client Security hosts | Policy Manager | 16.00 | WithSecure User Guides

Which updates are needed for different WithSecure clients?

Resolution:

You can define the needed updates in the channels.json file, it is located here:
<fspm-definitions-update-tool root directory>\conf\channels.json

You can open it using Notepad, and content looks like this:

Updates for version 15 and 16:
[
"capricorn-win32",
"deepguard-db",
"hydra-win32",
"lynx-win32",
"nifcore-win32",
"nifweb-win32",
"sccore-win32",
"sensor-win32",
"ulcore-win32",
"ulupdater-win32",
"uss-win32",
"virgo-win32",
"capricorn-win64",
"hydra-win64",
"lynx-win64",
"nifcore-win64",
"nifweb-win64",
"sccore-win64",
"sensor-win64",
"ulcore-win64",
"ulupdater-win64",
"uss-win64",
"virgo-win64",
"swup-win",
"swup-win-db", 
"pinned-certificates-win"
]

Updates for version 12:
[
"avmisc",
 "gemdb", 
"hipscfg", 
"hydrawin", 
"hydralinux",
 "mlcwin", 
"capricorn-win32", 
"orsp-win-v2", 
"css_720_bin", 
"aqualnx32", 
"commtouchunix", 
"fmlibunix", 
"fsav_1100_bin", 
"hipsn", 
"nifbin", 
"fsoftupd", 
"sidegrade", 
"ASPAM"
]

Updates for version 13 and newer:

64bit:
[
"ulupdater-win64",
"hydra-win64",
"virgo-win64",
"uss-win64",
"nif-win64",
"ulcore-win64",
"ols-win64",
"capricorn-win64",
"lynx-win64",
"swup-win-db"
]

32bit:
[
"ulupdater-win32",
"hydra-win32",
"virgo-win32",
"uss-win32",
"nif-win32",
"ulcore-win32",
"ols-win32",
"capricorn-win32",
"lynx-win32",
"swup-win-db"
]

Sidegrade:
"sidegrade"

Deepguard:
"deepguard-db"

If you have pure closed Windows enviroment, without Anti-Virus for Exchange, Anti-Virus for Sharepoint, and no Software Updater. Then it is enough to have these on the list:

Updates for version 12:
"avmisc",
 "gemdb", 
"hipscfg", 
"hydrawin",
"mlcwin", 
"capricorn-win32", 
"orsp-win-v2",
"fsav_1100_bin", 
"hipsn", 
"nifbin", 
"sidegrade",

Updates for version 13 and newer:
"ulupdater-win64" or/and "ulupdater-win32"
"hydra-win64" or/and "hydra-win32"
"virgo-win64" or/and "virgo-win32"
"uss-win64" or/and "uss-win32"
"nif-win64" or/and "nif-win32"
"ulcore-win64" or/and "ulcore-win32"
"ols-win64" or/and "ols-win32"
"capricorn-win64" or/and "capricorn-win32"
"lynx-win64" or/and "lynx-win32"

These are for Linux Security 11 and MAC OS:
"hydralinux",
"aqualnx32", 
"commtouchunix", 
"fmlibunix",

These are for Linux Security 64:
"fsbspamd-100-linux-x86_64",
"aqualnx64",
"capricorn-linux64",
"fmlibunix64",
"hydra-linux64",
"baseguard-100-linux-x86_64",
"fsbg-100-linux-x86_64",
"linuxsecurity-1200-linux-x86_64", 
"pinned-certificates-unix"

 
This one is for Anti-Virus for Exchange and Anti-Virus for Sharepoint:
"css_720_bin",
 
Anti-Virus for Exchange spam database:
"ASPAM"
 
Software Updater Database:
"fsoftupd",
"swup-win",
"swup-win-db"

Issue:

Why are some Policy Manager Proxy (PMP) hosts not connecting or showing up in the Policy Manager Console (PMC)?

Resolution:

The cause for this can be that the Policy Manager Proxy cannot report to the Policy Manager due to the fact that its certificate is missing. To resolve the issue follow these steps:

1. Run the certificate enrollment tool located at: c:\Program Files (x86)\F-Secure\Management Server 5\bin\fspmp-enroll-tls-certificate.bat 
2. Restart the Policy Manager proxy
   • Other than this, in case you have Policy Manager Proxy Server 15.20 in use, we recommend to upgrade to version 15.21 or later.
3. Double-check that admin.pub used for Policy Manager Proxy deployment matches the one used at the Policy Manager. 

Easiest way is to redownload the admin.pub from the Policy Manager welcome page via HTTP browser https://<PMaddress>/fsms/fsmsh.dll?FSMSCommand=GetPublicKey

Issue:

After creating or modifying a Branding template, when adding the Title -information and clicking Save, the saving request keeps hanging (Saving… Please wait) and the Title -information is not being saved.

Resolution:

This happens if you are using empty spaces in the Title and also possibly when using different special characters, which are not supported. To resolve the issue, you will need to remove the spaces and the special characters. 

Issue:

A warning message is being displayed when installing Linux Security 64 on the Linux server, which warns that the current version of the installer is about to become obsolete at the end of 2024 and asks to update the version as soon as possible.

Resolution:

This warning message is expected if you have created the installation package of Linux Security 64 using the older installer (JAR file), which is meant for the older versions (15.xx) of Policy Manager.  

Currently, Policy Manager version 15.xx has reached its End-of-Life in September 2024 (refer to https://www.withsecure.com/en/support/product-updates/eol-reminder-business-suite-15) and newer Linux Security 64 components require the new content package (withsecure-updates.zip) to be used instead of the old one (f-secure-updates.zip) in case of isolated environment.

For a new product installation in the isolated environment, there is a need to create an installation package of Linux Security 64 using the new installer (JAR file) that is meant for Policy Manager version 16.xx, together with the new content package of "withsecure-updates.zip".

New installer (JAR file) for Policy Manager version 16.xx:
https://download.withsecure.com/corpro/ls64/current/wsls64-5.0.10.jar

You may recreate a new installation package using the new installer (JAR file) above and install Linux Security 64 using the content package of "withsecure-updates.zip".

Issue:

The latest Linux Security 64 update 2024-03-18 fails to install
 

Resolution:

The following error is visible in the update.log file:

Update /aquarius/1710768883 installed successfully.
>>> Installing /hydra/1710775746 (Tue Mar 19 15:15:24 EET 2024) >>>
Update /hydra/1710775746 installed successfully.
>>> Installing /linuxsecurity/1710768478 (Tue Mar 19 15:15:28 EET 2024) >>>
Installing pinned certificates
2024-03-19 15:15:34 fsguts2.c:1636[6] empty updates section
2024-03-19 15:15:34 fsguts2.c:1150[6] channel 'pinned-certificates-unix' not found
2024-03-19 15:15:34 src/guts2download.c:203[7] downloading the channel failed, error 207 (item not found)
2024-03-19 15:15:34 src/guts2download.c:88[7] downloading the channel content from http://pms.local:80/guts2 failed, error 207 (item not found)
2024-03-19 15:15:59 net/fsaddrinfo.c:423[7] getaddrinfo() returned error -2 (EAI_NONAME; name does not resolve)
2024-03-19 15:15:59 net/fssocket.c:2395[7] name resolution failed, error 210 (unable to resolve host)
2024-03-19 15:15:59 net/fssocket.c:370[7] fs_socket_tcp_connect_next() returned 210 (unable to resolve host)
2024-03-19 15:15:59 net/fshandle_tcp.c:282[7] failed to connect guts2.sp.f-secure.com tcp port 80, error 210 (unable to resolve host)
2024-03-19 15:15:59 fshttps.c:686[7] connection failed, error 210 (unable to resolve host)
2024-03-19 15:15:59 fsguts2.c:3047[7] unable to perform the HTTP operation, error 210 (unable to resolve host)
2024-03-19 15:15:59 fsguts2.c:1027[7] unable to fetch update information from the server, error 210 (unable to resolve host)
2024-03-19 15:15:59 src/guts2download.c:164[7] unable to fetch the list of updates, error 210 (unable to resolve host)
2024-03-19 15:15:59 src/guts2download.c:88[7] downloading the channel content from http://guts2.sp.f-secure.com failed, error 210 (unable to resolve host)
setup: failed to install pinned certificates (exit status 2)
/opt/f-secure/baseguard/bin/update: Failed to install /linuxsecurity/1710768478

Also, the following alert is visible in Policy Manager Console.

Could not install the following update: linuxsecurity 2024-03-18 (fsbg-pmd).

The alert reproduces with both Policy Manager 15.xx and 16.xx installations that are isolated that is, they do not have internet connectivity.

The latest version of Linux Security 64 introduces a new dependency on the pinned-certificates-unix channel. If you have a high security installation of Policy Manager, without connectivity to the internet and rely on archives to update the policy manager, a minor modification is needed.

The process for using archives to update the Policy Manager Server is described here: 

– https://community.withsecure.com/en/kb/articles/5638-using-archives-to-update-malware-definitions

To fix this particular issue, add the missing 'pinned-certificates-unix' channel to the tool configuration by editing the channels.json file available in the conf-folder. 
Once the change is in place, rerun the tool and import the new databases to the Policy Manager Server. 

Ref: How to add new channel to "channels.json" in conf-folder.

[
  <other channels>

 "atlant-100-linux-x86_64",
  "swup-win",
  "swup-win-db",
  "hydra-macos",
  "pinned-certificates-win"
  "pinned-certificates-unix"
]

The issue with the missing channel pinned-certificates-unix channel will be resolved in the upcoming Service Release of WithSecure Policy Manager (16.02). 

To verify if pinned-certificates-unix has been installed on the Linux Security 64 host, you may refer to the update.log which contains:

Update /pinned-certificates/1667822601 installed successfully.

and

Update /linuxsecurity/1712740227 installed successfully.