Issue:

A user has forgotten their password to Secure Reader and there is no direct way to reset it.

Resolution:

For internal users, the password can be reset through the appliance webGUI:

1. Log in to the appliance webGUI
2. Go to the System-tab
3. Navigate to User Management->Users on the right
4. Search for the users email-address
5. Click the email address to bring up the user details
6. Go to the Authentication-tab
7. Click the Reset-button next to the password
8. The user will get a welcome email with a temporary password and a link to the end user services that is valid for 30 minutes

For external users, the recommendation from Proofpooint is to remove the user and have them re-register:

1. Log in to the appliance webGUI
2. Go to the System-tab
3. Navigate to User Management->Users on the right
4. Search for the users email-address
5. Check the box to the left of the account that needs to be removed
6. Click the Delete-button on top of the user list
7. The next time the user tries to access the Secure Reader, they will be prompted to create a new account

Removing a user has no impact on how the user can access mails in the future. After the re-registering they will be able to access all their secure mails as before, as long as they are still stored on the appliance.
Although the temporary password sent by the welcome-email will work for an external user to access the Secure Reader, the link in the mail to the end user services will not. As this might cause unwanted confusion the better solution is to remove the current user completely.

Issue:

I downloaded the Atlant VMware image, deployed it and went through all the points based on the manual.
In Policy Manager, under Virtual security, I enabled Offload Scanning and set the IP address of the server.
The client says that it cannot connect to the reputation server.
What could be the problem?

Resolution:

Firstly, you need to check the connectivity status from Client Security to Atlant to make sure that it is not caused by a connectivity issue. If you see some other error besides "400", you may need to check your network settings and the firewall configuration.

To check that the client can connect to the Scanning and Reputation Server, follow these steps:

1. Open the web browser on the client.
2. Browse to:
   • the host name or IP address of Scanning and Reputation Server and
   • the port number that the server is configured to accept connections on (by default, 1344).

If the server replies 400 Bad Request, the connection with the server is working.

If the connectivity is OK , check if you have entered a subscription key at Virtual security > Atlant scanning service > Atlant subscription > Subscription key setting mistakenly, which should be left empty.

This setting should be blank because it is meant for the future implementation of advanced features in Atlant (currently these are not available yet), which requires a separate subscription key in order to enable them.

If you had entered the subscription key on Policy Manager Console to the setting and distributed the policy previously, perform the following steps to solve the issue and check if there is any improvement after that.

1. Clear the value of Virtual security > Atlant scanning service > Atlant subscription > Subscription key setting (leave it empty)
2. Distribute the policy to Atlant instance
3. Wait for a few minutes

After this, Atlant should get its licensing setup working again.

Issue:

When executing /opt/f-secure/fspms/bin/fspms-config to configure the Policy Manager proxy, an error message stating the port is already in use is printed:

Specify the details for communication with F-Secure Policy Manager. Enter the server’s IP address or its DNS name.
Server address []: 192.168.1.100
HTTPS port [443]: 443
Port is already in use. Please enter another one.

Based on investigation, the port (here 443) is not is use.
 

Resolution:

The proxy config-script requires and uses the netcat command to check the availability of the port. If netcat is not installed or available, you will receive the above mentioned error message.

To resolve the issue, install netcat. In Debian, this can be installed using the following command:
 

# apt install netcat-traditional

Issue:

• When trying to register a Policy Manager Server, we are getting this error:  The registration cannot be validated. WithSecure Policy Manager Server could not connect to the WithSecure registration server (https://corp-reg.fsapi.com)

Resolution:

What should I do if registration fails, saying that my customer number could not be validated?

The first thing you shoul do, if you get this error message, is to check that you are running a supported version of Policy Manager Server. Check that the Policy Manager version you are running on your server isnot listed as end-of-life: https://www.withsecure.com/en/support/product-lifecycle-announcements

If your Policy Manager Server is supported, check your network configuration to make sure that Policy Manager Server is able to access the registration server.

• version 15: https://corp-reg.f-secure.com
• version 16: https://corp-reg.fsapi.com

Steps to test the connectivity from the same host where Policy Manager Server is installed:

• You need Command Prompt and curl.exe to run the following command:
  curl https://corp-reg.fsapi.com
  • Connection can be treated as successful if you get the html output containing the following: 
    <title>Error 404 Not Found</title>
    <body><h2>HTTP ERROR 404 Not Found</h2>
  • If you use a HTTP proxy, test the connectivity via this proxy: 
    curl https://corp-reg.fsapi.com –proxy [protocol://]proxy_address[:port]
  • If you cannot use curl, try to access https://corp-reg.fsapi.com via Browser
  • Make sure that TLSv1.2 has been enabled. If yes, check and remove the value from additionalJavaArgs and restart fspms service
    • -DhttpsExcludedProtocols=TLSv1.2
• If the connection is blocked, make sure you have allowed the DNS names *. f-secure.com and*. fsapi.com to your firewall, as described here.
• If the browser test is showing that the site is not trusted, it would mean that your host does not trust Amazon Root CA 1 root certificate or intermediate ones.
• If you are using a HTTP proxy, please configure it in the fspms.proxy.config. After the configuration, restart the Policy Manager Service. Depending on the Policy Manger versions and operating system the config file is located at:
  • Windows:
    • version 15: C:\Program Files (x86)\F-Secure\Management Server 5\data\fspms.proxy.config
    • version 16: C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\fspms.proxy.config
  • Linux: /var/opt/f-secure/fspms/data/fspms.proxy.config

Issue:

Unable to change Management Server Address on Client Security or Server Security hosts because the public and private admin keys do not match.
Need to migrate hosts between two Policy Manager Servers without having to do a re-installation of the software client side. 
How can the management key file (admin.pub) on WithSecure clients be replaced in case the original Policy Manager server is no longer available?
How can the Policy Manager Server management address on WithSecure clients be changed when the original Policy Manager server is no longer available?
After upgrading or installing WithSecure Client Security/Server Security 14.x or newer, you encounter issues with communication. Symptoms include:

• the host is unable to connect to WithSecure Policy Manager Server
• the host is not visible on the "Import host" list in WithSecure Policy Manager Console.

Resolution:

As starter, please make sure that the WithSecure Policy Manager Server address is correct and that the host communication ports (default: TCP 80 and 443) are listening.

Test the connectivity between the clients and Policy Manager:

1. Try to connect to the WithSecure Policy Manager Server's address via a web browser from one of the hosts (http://pms-server.local:80 and https://pm-server.local:443). If the connection is set up correctly, you will receive a web page from the WithSecure Policy Manager Server indicating so. If there is no page loaded, check that the host communication ports to the Policy Manager Server are allowed in your firewall.
2. Make sure that you have configured the WithSecure Policy Manager Server IP address and/or hostname correctly and that the ports configured for host modules are correct. 

Below is an example of a failed connection:
 

I: Connecting to wait.pmp-selector.local
I: Update check failed, error=210 (unable to resolve host)
I: Connection failed
W: ServerFinder::Ping: Ping to {host: 10.10.10.10, http: 82, https: 443} aborted. There are no valid certificates
I: UpdatablePmCertVerifier::RenewCertificates: Renewing certificates from 10.10.10.10
E: UpdatablePmCertVerifier::RenewCertificates: Failed to download certificate bodies. AsyncSendRequest failed: 12002
W: CosmosUpdater::Run: No servers responded. Policy Manager unavailable.

Error 12002 means ERROR_WINHTTP_TIMEOUT > Client Security/Server Security cannot connect to Policy Manager to fetch this list.
A complete list of Microsoft Windows HTTP Services errors is available here. 

Below is an example of a working connection:

I: UpdatablePmCertVerifier::RenewCertificates: Renewing certificates from 10.11.10.10
I: UpdatablePmCertVerifier::RenewCertificates: 2 certificate(s) renewed successfully; expire in 86170 seconds

If you have confirmed the communication to work between the client computer and the Policy Manager Server, and you have made sure that the Policy Manager address and ports are configured correctly, make sure that the date and time are configured correctly on the client device.

If the date and time are incorrectly set, the certificate download from the Policy Manager Server will fail. The date and time can be easily incorrectly set in an offline environment, since the Network Time Protocol (NTP) can't be used to set the date and time. 

Check the PmpSelectorPlugin.log again for the following:

W: ServerFinder::Ping: Ping aborted: there are no valid certificates
I: UpdatablePmCertVerifier::RenewCertificates: Renewing certificates from 192.168.1.100:443 with HTTP proxy ''
W: UpdatablePmCertVerifier::StoreCertificates: Certificates renewal yielded no fresh certificates

In the above example the client tries to download the certificate from the Policy Manager Server, but since the client's date and time are in the future compared to the Policy Manager Server, the client thinks no fresh certificate is available.

If the issue still persists after performed all the above steps, you can look at the following log on the host with WithSecure Client Security/Server Security. It shows the connection status with the WithSecure Policy Manager Server. You can use the Keyreplacer to solve the connection issues.

C:\ProgramData\F-Secure\Log\BusinessSuite\PmpSelectorPlugin.log.

From PmpSelectorPlugin.log, this may indicate that the admin.pub on the problematic client, does not match with the admin.prv on the Policy Manager Server:

2022-03-28 18:20:20.977 [18e8.2b48] *E: UpdatablePmCertVerifier::ParseCertificates: Certificate bodies signature invalid. Error is 1  

You can create a keyreplacer file yourself with a tool that can be provided to you by support. The tool comes with instructions on how to create the keyreplacer-file. Please open a support case to WithSecure support and request for the keyreplacer tool. 

Supported products

• Client Security 14 and later
• Server Security 14 and later

Some common uses cases for using this tool are listed below

1. The Policy Manager Server is not accessible and a new Policy Manager management key admin.pub file and the address to the new Policy Manager server needs to be provided to the WithSecure client.
2. The Policy Manager Server is not accessible and a new, changed address to the a Policy Manager server needs to be provided to the WithSecure client.
3. The Policy Manager Server accessible but the Policy Manager management key admin.pub file has changed and needs to be provided to the WithSecure client.

Step-1: Creating the keyreplacer package:

To create the package, you need some prerequisite information-

1. The new Policy Manager hostname or IP-address. Simply use the IP-address and or the hostname or FQDN (fully qualified domain name). Examples: 

• policy-manager-server.acme.com
• 192.168.0.10
• hostname.local

2. The host module HTTP and HTTPS ports the Policy Manager server listens to. The default ports for Policy Manager are port 80 for HTTP and 443 for HTTPS.  If you are not sure which ports are used by the Policy Manager Server, launch  the application "Status monitor" available in the "F-Secure Policy Manager" program group. 

(On Linux systems the port information can be found in the following log:
/var/opt/f-secure/fspms/logs/fspms-stderrout.log )

3. Export the admin.pub file:

• Log on to your Policy Manager Console. 
• From the top menu panel, select Tools > Server Configuration
• Select the Keys tab. Under "Export signing keys", select the button Export
• Enter the private key passphrase

Step-2 Creating the keyreplacer JAR-file

1. Contact the WithSecure Support for the keyreplacer_2021.zip file
2. Once you have the Keyreplacer_2021.zip. you can now extract the ZIP-file that containing the keyreplacer files.
3. Copy the admin.pub file exported from Policy Manager Console in the same folder.
4. Run the following command to create the JAR-file keyreplacer.jar. 

iuupd.exe –create-keyreplacer-package -o keyreplacer.jar –pm-host "10.132.4.214" –pm-port-http 80 –pm-port-https 443 -i admin.pub

Note: the commands should be provided as one, single command. In the example, Policy manager Server IP-address is 10.132.4.214 and the HTTP and HTTPS ports are 80 and 443, respectively. Adjust these values to reflect your own configuration.

Step-3: Instruction to deploy the Key Replacer fix

To install the keyreplacer.jar package created earlier, two installation options are available.

         a) policy based or push installation using Policy Manager
         b) local installation using MSI-file exported from Policy Manager Console.

Note: policy-based installation will only work, if the management key admin.pub has not been changed and therefore can only be used to change the Policy Manager Server address. 

a) Installing the keyreplacer package – policy based installation

1. On the Policy Manager Server, import the registry-file Allow_unsigned_jars_on_PM.reg file included inside the keyreplacer_2021.zip file. To import the file, right-click the file and select option "Merge". This imports the registry changed and enables importing of unsigned packages to Policy Manager Server
2. To activate previous setting, restart the Policy Manager Server using a command prompt:
   • net stop fsms
   • net start fsms
3. Import the file keyreplacer.jar to the Policy Manager Console using Tools > Installation packages. When prompted, select "Yes" to the "not signed by WithSecure" warning message.
4. Perform a push or policy based installation to a target machine.
5. Alternatively, you can also export the previously imported keyreplacer.jar to an MSI-file using Tools > Installation packages. This option is recommended for a local installation of the package.

The same works for Linux, but you need to use config file /etc/opt/f-secure/fspms/fspms.conf instead of the registry. Create a new line with parameter additional_java_args and specify Java system properties in its value in quotes in the following format: -DpropertyName=value. Multiple properties can be specified using space as a delimiter. Property names and values are case sensitive.

Example: additional_java_args=-DallowUnsignedWithRiwsAndMibs=true -Dh2ConsoleEnabled=true -DmaxSynchronousPackageRetrievalRequests=100

4. Start the Policy Manager Server service and open the Policy Manager Console
5. Go to the Installation-tab and click Installation packages
6. Click Import to import "KeyReplacer_unsigned.jar" file to the Policy Manager Console as an Installation package
7. Deploy the KeyReplacer file to all clients, for example using a policy-based installation

After the deployment is finished import the hosts in the Policy Manager Console by going to the Installation tab and clicking "Import new hosts".

b) Installing the keyreplacer package – local installation 

You can export the previously imported keyreplacer.jar to an MSI-file using Tools > Installation packages in your Policy Manager and launch the MSI-package exported using Policy Manager Console. This was created in the previous section "Installing the keyreplacer package – policy based installation". This option is recommended for a local installation of the package.

Issue:

Scanning failure with an error of "file is on a different filesystem" for crossing filesystem boundaries in Linux Security 64 when running the manual scan using "fsanalyze" command

Resolution:

Basically, scanning for crossing filesystem boundaries (files on a different filesystem) is not allowed by default.

Thus, manual scan using "fsanalyze" command may fail for certain files because they are on different mounted partitions/filesystems (for example, /dev and etc).

Currently, scanning of files on different filesystems/partitions for manual scan will only happen when the exclusion setting (ods exclude_paths) is configured either using command-line utility tool (lsctl) or exclusion setting for manual scan is configured via Policy Manager, which is explained in the user guides below. In this case, the filesystem boundaries are crossed.

https://help.f-secure.com/product.html#business/linux-security-64/latest/en/task_6FF3CD0A72924F32A5B43E2600529C51-latest-en

Related information:
====================================================
Note: The exclusions that are set in the current policy for manual scanning are applied when you use manual scanning from the command line.
If you have excluded any paths in the manual scanning policy, recursive scanning crosses file system boundaries.
====================================================

When the exclusion setting is not configured, the reported message may appear thus you could consider to add any path to the exclusion setting of manual scan to solve it.
 

Issue:

I am not able to authenticate  to Active Directory using LDAP or LDAPS, it give me a SSL certificate could not be verified error.
 

Resolution:

Troubleshooting steps:

• Check if port is not specified, Policy Manager uses 389 for plain LDAP and 636 for LDAPS.

Note: Policy Manager does not have any fallback logic, it connects via protocol, address and port specified during user/group import.

• To trust this CA it should be imported to trusted root CA at the host (at Windows) or java keystore (at both Win and Linux), otherwise Policy Manager won't trust the server certificate, like openSSL does.
• You have to import CA cert that issues certs for LDAPS to Policy Manager host like instructed here
• You need to replace LDAPS cert with some properly issued by globally trusted CA in the chain

Note: The most common cause of a "certificate not trusted" error is that the certificate installation was not properly completed on the server (or servers) hosting the site. After you have imported the certificate, make sure its valid and install it on the Policy Manager Host
 

Issue:

Recipients receive spam messages, why did Messaging Security Gateway (MSG) not block these spam messages?

Resolution:

If recipients receive spam messages, it could be because of the following potential root causes:

1. Low spam score (False Negative)
Check spam scores from message headers. Look for "X-Proofpoint" headers and check the scores.

Example:
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2018-03-08_12:,,
 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=39 malwarescore=0
 phishscore=0 bulkscore=12 spamscore=0 mlxscore=0 mlxlogscore=518
 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.0.1-1711220000 definitions=main-1803080233

If you encounter messages that should've been classified as spam you can report them through a support ticket. You can either save the message and send the eml or msg file to the ticket, or if the message has been caught in, for example, an audit quarantine in msg, you can report it from the relevant quarantine folder.

After reporting the False Positive or False Negative spam from F-Secure Messaging Security Gateway (MSG) management portal, at the very top of the main MSG screen, you'll see a message with the reference ID that you need to provide to the support ticket.

2. Safe listed
This needs to be investigated closer through the MSG Web UI.

1. Get the Session ID, or SID, for the message by looking it up in Smart Search (System->Smart Search->Search, expand message details by clicking +-sign left of timestamp)
2. Search the filter log using the particular message SID, to find out more about filtering done on the message. (Logs and Reports->Log Viewer, if you don't find any results, make sure the Log File Type is set to Filter.

Note: You might also need to switch between servers using the Server-dropdown menu, or check the box labelled Include Old Log Files)

In the example below, spam score is modified (set to zero) because the sender address is in the organizational or personal safe list of the recipient.

Filter log:

[2018-03-06 18:43:55.695094 +0100] rprt s=2gfjcgns0q m=1 x=2gfjcgns0q-1 mod=access cmd=run rule=spamsafe duration=0.000
[2018-03-06 18:43:55.695113 +0100] rprt s=2gfjcgns0q m=1 x=2gfjcgns0q-1 mod=session cmd=judge module=access rule=spamsafe
[2018-03-06 18:43:55.695348 +0100] rprt s=2gfjcgns0q m=1 x=2gfjcgns0q-1 mod=session cmd=dispose module=access rule=spamsafe action=execute value="svar('SpamScore', 0)"

To check organizational safe lists, Navigate to Email Protection->Spam Detection->Settings->Organizational Safe List in the MSG Web UI.

To check the personal safe list of the recipient, Navigate to System->User Management->Users, locate the recipient and click on them to open details. You find the personal safe list under the Filtering-tab in the popup window.

Issue:

I've installed  Server Security or Email and Server Security or Elements Endpoint Protection on a Windows Server 2016/2019/2022 server, but Windows Defender real-time protection is still on. Should I deactivate it when I'm using the WithSecure product?

Resolution:

Yes, Windows Defender should be deactivated when using Email and Server Security or Elements Endpoint Protection. Multiple Anti-Virus products running at the same time may cause conflicts.

On Windows Server 2016/2019/2022, Windows Defender will not enter passive or disabled mode automatically if you install a third-party antivirus.
If you're using a non-Microsoft antivirus product as your primary antivirus solution on Windows Server, you must set Microsoft Defender Antivirus to passive mode or disabled mode manually. Please find more details here. Microsoft Defender Antivirus on Windows Server

Microsoft's general recommendation is to uninstall the Defender on the server installations.

Passive mode is something controlled by Windows, so it could be changed by Windows and we don't control it.

After installing a third-party antivirus you should uninstall Windows Defender AV on Windows Server 2016 to prevent problems caused by having multiple antivirus products installed on a machine.

If you are using Windows Server, version 1803 and Windows 2019, you can enable passive mode by setting this registry key:

Path: HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection
Name: ForceDefenderPassiveMode
Value: 1

In case of uninstalling Windows Defender, you can use this Powershell command:

Uninstall-WindowsFeature -Name Windows-Defender

It will require a restart and after that, Windows Security will not be visible with Antivirus at all but WithSecure still functions.

MsMpEng.exe will also not be running anymore
 

Issue:

Security Cloud Client is not connected on Server Security / Client Security

Resolution:

You need to ensure that the affected F-Secure host is allowed to connect to the URL:

• * https://a.karma.sc2.fsapi.com
• * https://api.doorman.fsapi.com

You can try to open https://a.karma.sc2.fsapi.com/healthcheck and https://api.doorman.fsapi.com/doorman/v1/healthcheck in web browser on the host. If the connectivity works you shall see "OK" message in return.

Also, do take note that the URLs are subject to change in the near future. We recommend allowing the connectivity to *f-secure and *.fsapi.com. To validate the connectivity to WithSecure backend, you can run the Connectivity Tool (wsconnectionchecker.exe) from C:\Program Files (x86)\F-Secure\<Client Security or Server Security>\ui on the device, using all accounts including LOCAL SYSTEM and Network Service account.

If this host requires a connection via HTTP proxy to access this URL, you have to configure these settings via the WithSecure Policy Manager Console:

1. Log on to your Policy Manager Console.
2. Select the Policy domain