Issue:

Is it possible to create a read-only account to login into Policy Manager Console? How to create an account to login to Policy Manage Console?
 

Resolution:

If you want to limit a user's access, you can add users with either admin or read-only access to Policy Manager. The process is described in this user guide: https://www.withsecure.com/userguides/product.html#business/policy-manager/16.00/en/task_A0E9BD3FFD504E28A2B04B8689CFF649-16.00-en

Issue:

New updates for some software such as Citrix Receiver appear on the Software Updates list in Policy Manager console Software Updater. Whenever I try to download and install them, I receive the following status message: The update package must be downloaded manually.

What does it mean and how can I install the newest updates?

Resolution:

The message means that the updates must be downloaded directly from the Citrix Receiver official website. After downloading the updates, install them manually as it is not possible to do it via the Policy Manager console or by using Software Updater. 

The reason why it is not possible is that more and more sites require authentication (e.g. "I'm not a robot" captcha). 

In those cases where Software Updater cannot download the updates, it advises that an update is available and can be installed manually to ensure security.

Issue:

Is it possible to install Policy Manager Console silently? 

Resolution:

The WithSecure  Policy Manager management console is typically only installed on admin computers and thus an unattended installation is a rare use case. We recommend installing the console manually for the administrators who need it.

The WithSecure  Policy Manager installer does not feature the possibility to install either the Policy Manager Server or the Policy Manager Console silently. 

If you want to install the Policy Manager Console for several computers without any visible user interface. You can simply copy the contents of C:\Program Files (x86)\F-Secure\Administrator\ to the desired host. Fspmc.exe can be run to start the Policy Manager Console.

Issue:

Internet Gatekeeper blocks(or slowdown) some specific web sites, although other web site are no problem.

Resolution:

When specific web sites are blocked(or slowdown) through Internet gatekeeper, Internet Gatekeeper needs to be configured as below.
 

HTTP/1.0 requests relayed by the Internet Gatekeeper may not be processed due to the setting of the destination Web server, etc., such as when there is a problem with connection only when accessing a specific Web site, although it does not occur with other Web site access I will.

In cases where such a version of HTTP is a problem, there is a possibility that improvement can be expected by trying the following procedure.

1.) Set use_http11 = yes for Linux gateway expert option (default: no setting)

By default, the Linux gateway converts to HTTP / 1.0 for HTTP / 1.1 requests and sends it to the server, but there is a possibility that improvement can be expected by using the HTTP / 1.1 transparent function by the following procedure.

In addition, since this feature has been improved from time to time by version upgrade, we recommend you update to the latest version.

Insert a description of use_http 11 = yes in the entry of [http] in <installation directory> /conf/fsigk.ini

use_http 11 = yes

Then, please restart the HTTP proxy process.

# <Installation directory> /rc.fsigk_http restart

2.) Change settings on the Windows browser side.

Exclude the check box for the Internet Options Advanced tab "Use HTTP 1.1" "Use HTTP 1.1 for proxy connection". Please restart the browser after setting.

3.) Set keepalive = yes setting of Linux gateway to no.

After that, to reflect the setting

# <Installation directory> /rc.fsigk_http restart

Please restart the HTTP proxy process.

4.) Add ipv6 = no setting to the Linux gateway.

　(It is set not to perform name resolution in IPV 6)

<Installation directory> /conf/fsigk.ini

[http]

ipv6 = no

After that, please restart the HTTP proxy process.

# <Installation directory> /rc.fsigk_http restart

####For connection problems, various factors such as server load, Ethernet MTU value, name resolution failure, etc. can be considered, so strictly specify the cause by collecting packet log etc.

* The normal installation directory is /opt/f-secure/ fsigk.

Issue:

Can I verify if WithSecure Policy Manager is affected by the vulnerability, CVE-2021-42392?

Resolution:

The H2 Console is not enabled in the Policy Manager Server by default.

Even if the H2 Console has been enabled through the advanced configuration for the Policy Manager Server, there is no way to inject the database URL into it.

Hence, the Policy Manager Server is not affected by this vulnerability.

Issue:

Is it possible to schedule monthly reporting in Messaging Security Gateway?

Resolution:

No, it's not possible. You can set a report that will be scheduled for selected days, so the longest interval is one week.

Issue:

We are in an isolated intranet environment and our clients/servers are not connected to internet. We are facing an issue that in times Client Security and Server Security clients change the update server details from default Policy Manager server URL to guts2.sp.f-secure.com. As the clients are not connected to internet, the updates check fails.

Resolution:

To disable fallback to the WithSecure update server, follow these steps to disallow the hosts from falling back to the WithSecure update server if Policy Manager is inaccessible:

1. Log in to the Policy Manager Console
2. Select a host or a policy domain from the domain tree
3. Go to the Settings tab 
4. Go to the Windows > Centralized Management settings page
5. Scroll down to the Automatic updates section and disable Allow falling back to WithSecure update server if Policy Manager Proxies are inaccessible
6. Distribute the policy (Ctrl + D)

Issue:

• How to setup the silent installation for Policy Manager Proxy 
• User is creating a policy-based upgrade and needs to export installer msi for rollout via group policies

Resolution:

Note: These instructions are not valid for version 16 and later. 

Clean installations:

For Windows

1. Open Policy Manager Console and create temporary user with full access permissions for the root domain
2. Download Policy Manager Proxy installer: fspmp-15.30.96312.exe as an example
3. Extract Policy Manager Proxy setup executable content. For 14.00 and older – via any archive manager, for 14.10 start the executable and grab all the content from temporary directory at root level of system drive
4. Transfer admin.pub from Policy Manager to the extracted content
5. Edit prodsett.ini in the same directory: uncomment and specify values for all properties in the section "F-Secure PM Proxy"
6. Use user credentials created at first step for UpstreamPmUserName and UpstreamPmUserPwd properties
7. Run "setup.exe /silent" at target host for 14.00 and older, starting from 14.10 executable is called like fspmp-15.30.96312.exe, so have to run "fspmp-15.30.96312.exe /silent"
8. Remove user created at first step

For Linux

1. Open Policy Manager Console and create temporary user with full access permissions for the root domain
2. Download installer: fspmp-15.30.96312-1.x86_64.rpm as an example
3. Put admin.pub from PM to the dir with installer
4. Create shell script with name like pmp.sh and following content:

yum -y update libstdc++

yum -y install libstdc++.i686

rpm -i fspmp-15.30.96312-1.x86_64.rpm

/opt/f-secure/fspms/bin/fspms-config << PMPCONFIG PM address PM port (usually 443) ./admin.pub PMP http port to be used (usually 80) PMP https port to be used (usually 443) PM admin username (created at first step) PM admin password (created at first step) PMPCONFIG

1. Run the script: “./pmp.sh”.
2. Remove user created at first step.

Same things with Debian/Ubuntu, but use apt and dpkg instead, so sh script will look like:

apt -y upgrade libstdc++6:

apt -y install libstdc++6:i386

dpkg -i fspmp_15.30.96312_amd64.deb

/opt/f-secure/fspms/bin/fspms-config << PMPCONFIG PM address PM port (usually 443) ./admin.pub PMP http port to be used (usually 80) PMP httpS port to be used (usually 443) PM admin username (created at first step) PM admin password (created at first step) PMPCONFIG

After the script run, if everything is ok, PMP host should appear in PMC.
 

Policy Manager Proxy upgrades:

For upgrades, as there is not need to configure PMP and generate certificates enough to just upgrade the build.

For Windows:

1. Extract PMP executable content via any archive manager
2. Run "setup.exe /silent"

For Linux:

1. rpm -U fspmp-15.30.96312-1.x86_64.rpm
2. dpkg -i fspmp_15.30.96312_amd64.deb

Issue:

How to configure Business Suite Client Security and Server Security hosts to use HTTPS instead of HTTP for downloading updates from the Policy Manager Server and from the update server? 

Resolution:

You can configure the Windows endpoint clients to use HTTPS instead of HTTP by following these steps:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Go to the Centralized management settings page
5. Scroll down to the Automatic updates section
6. Enable Use HTTPS to download updates
7. Distribute the policy (Ctrl + D)

Once the policy has been taken into use on the hosts, they will download the virus definition updates from the Policy Manager Server or update server (guts2.sp.f-secure.com) using HTTPS. Software Updater updates are not affected by this setting. 

Using HTTPS to download updates improves privacy and complies with certain certifications. However, this may increase network traffic if you use proxies, because HTTPS traffic cannot be cached in the proxies.

NOTE: For Mac and Linux endpoint clients, this is not doable.

Issue:

How can I perform FSAUA database reset in WithSecure Linux based products?

Resolution:

Steps to do FSAUA database reset are different for each of the following WithSecure Linux based products.

• Linux Security Full / Command-line Edition version 11.xx
• Linux Gateway version 5.xx
• Policy Manager for Linux version 12.xx/13.xx

You can refer to the following detailed instructions for each product.

Note: 

• All steps require root privileges
• Latest fsdbupdate9.run can be downloaded here

1. Linux Gateway

2. Policy Manager for Linux version 12.40 and older

3. Policy Manager for Linux version 13.00 and above

4. Linux Security Full Edition

5. Linux Security Command-line Edition