Issue:

Scanning failure with an error of "file is on a different filesystem" for crossing filesystem boundaries in Linux Security 64 when running the manual scan using "fsanalyze" command

Resolution:

Basically, scanning for crossing filesystem boundaries (files on a different filesystem) is not allowed by default.

Thus, manual scan using "fsanalyze" command may fail for certain files because they are on different mounted partitions/filesystems (for example, /dev and etc).

Currently, scanning of files on different filesystems/partitions for manual scan will only happen when the exclusion setting (ods exclude_paths) is configured either using command-line utility tool (lsctl) or exclusion setting for manual scan is configured via Policy Manager, which is explained in the user guides below. In this case, the filesystem boundaries are crossed.

https://help.f-secure.com/product.html#business/linux-security-64/latest/en/task_6FF3CD0A72924F32A5B43E2600529C51-latest-en

Related information:
====================================================
Note: The exclusions that are set in the current policy for manual scanning are applied when you use manual scanning from the command line.
If you have excluded any paths in the manual scanning policy, recursive scanning crosses file system boundaries.
====================================================

When the exclusion setting is not configured, the reported message may appear thus you could consider to add any path to the exclusion setting of manual scan to solve it.
 

Issue:

I am not able to authenticate  to Active Directory using LDAP or LDAPS, it give me a SSL certificate could not be verified error.
 

Resolution:

Troubleshooting steps:

• Check if port is not specified, Policy Manager uses 389 for plain LDAP and 636 for LDAPS.

Note: Policy Manager does not have any fallback logic, it connects via protocol, address and port specified during user/group import.

• To trust this CA it should be imported to trusted root CA at the host (at Windows) or java keystore (at both Win and Linux), otherwise Policy Manager won't trust the server certificate, like openSSL does.
• You have to import CA cert that issues certs for LDAPS to Policy Manager host like instructed here
• You need to replace LDAPS cert with some properly issued by globally trusted CA in the chain

Note: The most common cause of a "certificate not trusted" error is that the certificate installation was not properly completed on the server (or servers) hosting the site. After you have imported the certificate, make sure its valid and install it on the Policy Manager Host
 

Issue:

Recipients receive spam messages, why did Messaging Security Gateway (MSG) not block these spam messages?

Resolution:

If recipients receive spam messages, it could be because of the following potential root causes:

1. Low spam score (False Negative)
Check spam scores from message headers. Look for "X-Proofpoint" headers and check the scores.

Example:
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2018-03-08_12:,,
 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=39 malwarescore=0
 phishscore=0 bulkscore=12 spamscore=0 mlxscore=0 mlxlogscore=518
 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.0.1-1711220000 definitions=main-1803080233

If you encounter messages that should've been classified as spam you can report them through a support ticket. You can either save the message and send the eml or msg file to the ticket, or if the message has been caught in, for example, an audit quarantine in msg, you can report it from the relevant quarantine folder.

After reporting the False Positive or False Negative spam from F-Secure Messaging Security Gateway (MSG) management portal, at the very top of the main MSG screen, you'll see a message with the reference ID that you need to provide to the support ticket.

2. Safe listed
This needs to be investigated closer through the MSG Web UI.

1. Get the Session ID, or SID, for the message by looking it up in Smart Search (System->Smart Search->Search, expand message details by clicking +-sign left of timestamp)
2. Search the filter log using the particular message SID, to find out more about filtering done on the message. (Logs and Reports->Log Viewer, if you don't find any results, make sure the Log File Type is set to Filter.

Note: You might also need to switch between servers using the Server-dropdown menu, or check the box labelled Include Old Log Files)

In the example below, spam score is modified (set to zero) because the sender address is in the organizational or personal safe list of the recipient.

Filter log:

[2018-03-06 18:43:55.695094 +0100] rprt s=2gfjcgns0q m=1 x=2gfjcgns0q-1 mod=access cmd=run rule=spamsafe duration=0.000
[2018-03-06 18:43:55.695113 +0100] rprt s=2gfjcgns0q m=1 x=2gfjcgns0q-1 mod=session cmd=judge module=access rule=spamsafe
[2018-03-06 18:43:55.695348 +0100] rprt s=2gfjcgns0q m=1 x=2gfjcgns0q-1 mod=session cmd=dispose module=access rule=spamsafe action=execute value="svar('SpamScore', 0)"

To check organizational safe lists, Navigate to Email Protection->Spam Detection->Settings->Organizational Safe List in the MSG Web UI.

To check the personal safe list of the recipient, Navigate to System->User Management->Users, locate the recipient and click on them to open details. You find the personal safe list under the Filtering-tab in the popup window.

Issue:

I've installed  Server Security or Email and Server Security or Elements Endpoint Protection on a Windows Server 2016/2019/2022 server, but Windows Defender real-time protection is still on. Should I deactivate it when I'm using the WithSecure product?

Resolution:

Yes, Windows Defender should be deactivated when using Email and Server Security or Elements Endpoint Protection. Multiple Anti-Virus products running at the same time may cause conflicts.

On Windows Server 2016/2019/2022, Windows Defender will not enter passive or disabled mode automatically if you install a third-party antivirus.
If you're using a non-Microsoft antivirus product as your primary antivirus solution on Windows Server, you must set Microsoft Defender Antivirus to passive mode or disabled mode manually. Please find more details here. Microsoft Defender Antivirus on Windows Server

Microsoft's general recommendation is to uninstall the Defender on the server installations.

Passive mode is something controlled by Windows, so it could be changed by Windows and we don't control it.

After installing a third-party antivirus you should uninstall Windows Defender AV on Windows Server 2016 to prevent problems caused by having multiple antivirus products installed on a machine.

If you are using Windows Server, version 1803 and Windows 2019, you can enable passive mode by setting this registry key:

Path: HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection
Name: ForceDefenderPassiveMode
Value: 1

In case of uninstalling Windows Defender, you can use this Powershell command:

Uninstall-WindowsFeature -Name Windows-Defender

It will require a restart and after that, Windows Security will not be visible with Antivirus at all but WithSecure still functions.

MsMpEng.exe will also not be running anymore
 

Issue:

Security Cloud Client is not connected on Server Security / Client Security

Resolution:

You need to ensure that the affected F-Secure host is allowed to connect to the URL:

• * https://a.karma.sc2.fsapi.com
• * https://api.doorman.fsapi.com

You can try to open https://a.karma.sc2.fsapi.com/healthcheck and https://api.doorman.fsapi.com/doorman/v1/healthcheck in web browser on the host. If the connectivity works you shall see "OK" message in return.

Also, do take note that the URLs are subject to change in the near future. We recommend allowing the connectivity to *f-secure and *.fsapi.com. To validate the connectivity to WithSecure backend, you can run the Connectivity Tool (wsconnectionchecker.exe) from C:\Program Files (x86)\F-Secure\<Client Security or Server Security>\ui on the device, using all accounts including LOCAL SYSTEM and Network Service account.

If this host requires a connection via HTTP proxy to access this URL, you have to configure these settings via the WithSecure Policy Manager Console:

1. Log on to your Policy Manager Console.
2. Select the Policy domain 

Issue:

I am trying to push a Client Security installation from the Policy Manager, but the installation fails with error code 53.

Resolution:

Error code 53 means that the network path was not found:
ERROR_BAD_NETPATH
53 (0x35)
The network path was not found.

System Error Codes (Windows)

Make sure, that:

1. The installation account have enough rights (has to be local or domain administrator).

2. Enable the Remote registry service on the clients (To enable remote registry service go to Control Panel -> Administrative Tools -> Services -> Remote registry).

3. Admin$ shares is enable on the client as well as the PMS, please try to access the admin$ share drive on the client from PMS and vice versa to confirm on this.

4. Windows Firewall is disable in the service on both clients and PMS, to avoid blocking the network traffic from getting through.

5. Both Policy manager and workstation are in the same network.

6. Certain Inbound traffic need to be allowed for the workstation such as RPC(TCP 135 Port), NetBios (137-139) and SMB (TCP 445 port) on your firewall (if there's any)

7. On the client, go to Control Panel->Administrative tools->Local security policy->Local policies-> Security Options – Network Access: sharing and security model for local accounts, check that setting. Make sure is Classic – local users authenticate as themselves" 

8. Otherwise you can create an .msi package and run the installation locally on the client, you can find more information about that here:

Push Installations

Issue:

Customer run the normal command of
 

sg fspmc -c /opt/f-secure/fspmc/fspmc

to login to Policy Manager Console but it does not apper and there is no output being shown on Terminal.

Resolution:

Graphical User Interface (GUI) enabled environment is needed in order to use F-Secure Policy Manager for Linux.
Hence, you need to enable the GUI and run the command to login to the F-Secure Policy Manager Console.

Issue:

We are using the policy-based installation option to upgrade our clients, from which we receive status "Failed: download interrupted" 

Resolution:

By default WithSecure Policy Manager Server can handle a maximum of 50 simultaneous package download requests. If the network cannot handle the bandwidth required for 50 simultaneous downloads, the policy-based installation or upgrade operation might fail. This error can also be the result of, if you have a sub-network with low bandwidth, which tries to fetch packages for several minutes.

For a network with low bandwidth, that can not handle such a high network load, we recommend to use the  Policy Manager Proxy as an option.
Policy Manager Proxy offers a solution to bandwidth problems in distributed installations of Client Security and Server Security by significantly reducing load on the networks. More about this topic can be found in the Help Guide. The Policy Manager Proxy can be downloaded from the WithSecure page: WithSecure™ Download Center | WithSecure™

Another solution, which can decrease the network load, is to use the additional_java_args setting: -DmaxSynchronousPackageRetrievalRequests=25

This settings changes the maximum number of simultaneously handled package download requests for policy-based installations. 

You can apply this change on your WithSecure Policy Manager Server by following these steps:

1. Open the Command Prompt as an administrator and use the following command to stop the Policy Manager Server service:
   • Policy Manager 15: net stop fsms
   • Policy Manager 16: net stop wspms
2. Open regedit and navigate to:
   • Policy Manager 15: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Data Fellows\F-Secure\Management Server 5
   • Policy Manager 16: HKEY_LOCAL_MACHINE\SOFTWARE\WithSecure\Policy Manager\Policy Manager Server
3. Select additional_java_args and double-click it
4. Enter the following string to Value Data: -DmaxSynchronousPackageRetrievalRequests=25
5. Use Command prompt to restart the Policy Manager Server service:
   • Policy Manager 15: net start fsms
   • Policy Manager 16: net start wspms

Note: If there is no existing additional_java_args registry entry, you can create one. Set the type as REG_SZ.

Issue:

NonVisual Desktop Access (NVDA) user is unable to start / run Policy Manager Console after upgrading to or installing version 15.30 

Resolution:

We have tested and found that Policy Manager Console 15.30 JRE is some how missing some accessibility support.

While the R&D team is working on getting this fixed on the upcoming build, please follow the instruction below for a temporary workaround.

1. Install Policy Manager Console 15.21
2. Copy the jre folder in C:\Program FIles (x86)\F-Secure\Administrator\ to some temporary place like desktop.
3. Install Policy Manager Console 15.30
4. Rename the existing jre folder in C:\Program Files (x86)\F-Secure\Administrator\ to jre-orig
5. Copy the jre folder that was taken from the Policy Manager Console 15.21 installation earlier and paste it in to C:\Program Files (x86)\F-Secure\Administrator\

You should be able to launch Policy Manager Console 15.30 after this.

If issue persists, the reason is in another Java installed at the target host enabling assistive technologies for all JVMs. As Policy Manager versions starting from 15.30 are using the Java runtime image with all unused modules removed (to lower the attack surface for vulnerabilities like log4j), this technology can not be loaded to the Policy Manager Console.

As a workaround (instead of replacing the JRE runtime) you can disable this technology for the current user:

1. Open C:\Users\<username>\.accessibility.properties as a text file (i.e. using Notepad)
2. Comment following lines in the config by adding hashmark (#) in front of them:
   • assistive_technologies=com.sun.java.accessibility.AccessBridge screen_magnifier_present=true

Issue:

Policy Manager Alerts tab shows an alert with the Severity Security and the description "Databases are old" for a host. How to troubleshoot why Malware definitions or engines are shown as outdated?

Resolution:

WithSecure Policy Manager receives the updates through our guts2 delivery and stores them in C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\guts2 folder.

WithSecure Policy Manager Server checks for new update versions every 10 minutes, other checks (headers, diffs) are requested by clients.

What do I do if clients are alerting about Virus definitions being x days old?

1. Make sure connection between client and F-Secure Policy Manager is stable. 

–    Check for latest policy under status
–    Check Automatic updates under Status
–    Verify your WithSecure Policy Manager HTTP and HTTPS address are reachable from client, by opening example http://10.0.0.50:80 and https://10.0.0.50:443 in Browser. Successful connection will show you  "WithSecure Policy Manager Server is installed and is working fine", if not, make sure your https and https Ports defined in your WithSecure Policy Manager are opened for the clients.

Note: You might be using http proxy and therefore Policy Manager might not be reachable in case traffic to Policy Manager is routed through the HTTP proxy.

•    You can define your http proxy by opening settings in your WithSecure Policy Manager console, expand Centralized management and scroll down to Internet connections.
•    Custom HTTP proxy address – this is used when "Use HTTP proxy" is set to "Custom". It can be defined as follows:

http://[user[:password]@]host:port, for example:
http://myproxy.com
http://myproxy.com:8080
http://<http-encoded-user-name>:<http-encoded-password>@host:port

or

domain\user is considered domain%5cuser.
Our support for authenticated proxies is limited to SIMPLE and NTLM authentication and should be the same as
FsHttpRequest's.

2.    From your local Policy Manager host, you can check if there are any problems with updates:

• fspms-download-updates.log shows the download activities -> C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\log
• If there are some connection issues to our backend, make sure you allow these two Hostnames *.withsecure.com and *.fsapi.com on your Firewall.
• From Policy Manager console, open Tools and then Server Configurations and check the setting for " consider virus definitions outdated after xx days.
• This value (number of days) indicates when the virus definitions are considered "old". 
•  A warning is sent to the administrator if the last virus definition file is older than the specified number of days).
•  Another way of troubleshooting is to reset the updates:

1. Stop WithSecure Policy Manager Server service (net stop wspms)
2. Empty the folder -> C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\guts2
3. Restart the service (net start wspms) 
4. Troubleshoot from the affected clients locally as each client will request updates independently

• From system tray, open WithSecure UI and click on ‘Check for updates. Here you will have another visibility of connection state.
• You can click ‘Check now’ and scroll down to view update history. 
• View the log file to see if updates are being downloaded and installed.
• Verify if the updates are being stored under example: C:\Program Files (x86)\F-Secure\Server Security\Ultralight and C:\ProgramData\F-Secure\GUTS2 
• Additionally, you can verify from Guts2Plugin.log-> C:\ProgramData\F-Secure\Log\CCF if updates have a ‘Success’ status.

• In case you see some wrong behavior and there is only one client affected, you can solve the problem by running the Uninstallation tool Support tools | WithSecure™ , restart the server and reinstall the product or contact WithSecure Support.

• When you have checked the WithSecure Policy Manager and didn't find any issues related, and still see installation error in aua log (different from pending restart)
• 16 series have aua-reset tool bundled with the product, for example Client Security-> c:\Program Files (x86)\F-Secure\Client Security\fsaua-reset.exe. It can also be downloaded from the Support Tools page: Support tools | WithSecure™