Issue:

How to scan files that are linked by symbolic link in Linux Security 64?

Resolution:

Realtime scan is able to scan symbolic link, as long as the target file's original location is included in RTS scan target. For manual scan (using remote command from PMC) and schedule scan, symbolic link will not be scanned. For fsanalyze, we need to use "–follow" or "-L" option in order to scan the target file's original location.

Issue:

In default configuration, Policy Manager Server listens to HTTPS traffic on port 443. However, if there is a requirement for changing this port, clients connected to the Policy Manager may end up in state where they are no longer able to communicate with the server.
 

Resolution:

This article describes, how to configure port forwarding on the server running windows. Effectively, this allows the Policy Manager Server to listen to multiple TCP ports.

To accomplish this, we use "Netsh interface portproxy " documented here.

Also ensure, the correct listening port is provided in the Policy Manager policy.

The following command forwards TCP port traffic from port 443 to port 444. (Note: PMS=Policy Manager Server):

• C:> netsh interface portproxy add v4tov4 listenaddress=<insert PMS IP address> listenport=443 connectaddress=<insert PMS IP address> connectport=444

To print the current settings:

• C:> netsh interface portproxy show all

To remove the netsh portproxy forward from port 443 to 444:

• C:> netsh interface portproxy delete v4tov4 listenport=443 listenaddress=<insert PMS IP address>

Remember to ensure, all configured TCP ports are open in the windows firewall on the server hosting PMS. 

Issue:

How to centrally remote mass uninstall Client Security or Server Security from several / multiple hosts at the same time using Policy Manager Console / Server?

Resolution:

Business Suite (Client Security and Server Security) has a remote uninstallation operation feature, which can be used to uninstall the product remotely from Windows hosts. Mac or Linux hosts require manual local uninstallation using an uninstallation tool. 

1. Log in to the Policy Manager Console
2. Go to the Installation tab
3. Select a host or policy domain from the domain tree
4. Click on the uninstall button from the "Installed products summary" table
5. Distribute the policy (CTRL + D)

Once the host receives the operation, the Client Security or Server Security client will be silently uninstalled from the host.

Note: For the uninstall button to appear on the "installed products summary" table, you will need to have the .jar file of that particular Client Security or Server Security version imported in the Policy Manager Server's installation packages.

Issue:

How to install Client Security or Server Security 15.30 with Endpoint Detection and Response for the Citrix/XenApp environment ?

Resolution:

Installation steps:

1. Install Client Security / Server Security 15.30 to the master without EDR keycode distributed to it
2. Wait for OK in [ProtectionStatus] (See Note)
3. Apply the FSCS1530-HF03 hotfix from support, so that the clones have this binary updated.
   • Hotfix is required for all kind of "cloned" setups. This is required for VMWare, Xen, HyperV and many more scenarios.
4. Make it as a master image
5. Create (a) clone(s), import them to the subdomain with the EDR keycode, wait for the clones to register

Note: Starting from Client Security 15.20, a registry key was introduced to avoid broken installations when creating images:

• HKLM\SOFTWARE\WOW6432Node\F-Secure\NS\default\OneClient\CosmosMirror\ProtectionStatus

Must be checked for all kind of installations. This is not limited to XEN or software distribution using image files. All kind of (managed) installations must ensure not to reboot directly after MSI finishes.

Monitor registry HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\F-Secure\NS\default\OneClient\CosmosMirror\[ProtectionStatus] as soon as it is changed to OK, all updates are installed and ready to go.
 

Issue:

How to install an WithSecure Client Security or Server Security as stand-alone, so that it downloads the updates directly from the WithSecure Update Server, without trying to download them from the WithSecure Policy Manager Server?

Resolution:

During the MSI installer exporting process, you can choose the initial policy, which will be the policy included in the installer. After installation, the client will start to use the settings from that policy immediately. Since the WithSecure Client Security or Server Security will be installed as stand-alone, the MSI installer must be given an initial policy that allows the client to fallback to the WithSecure Update Server if the WithSecurePolicy Manager Server is unreachable.

You can create a new policy domain in the domain tree for the policy which you will then include as the initial policy in the installer:

1. Right-click an existing policy domain in the domain tree
2. Click New policy domain
3. Enter the domain a name

Follow these steps to allow the client to fallback to the WithSecure Update Server:

1. Select the newly created policy domain from the domain tree
2. Go to the Settings tab 
3. Go to the Centralized Management settings page
4. Scroll down to the Automatic updates section and enable Allow falling back to WithSecure update server if Policy Manager Proxies are inaccessible
5. Distribute the policy (Ctrl + D)

Now you can select that Policy domain when exporting the Client Security or Server Security installation package. 

After exporting the MSI installer, run it on a host. The Client Security or Server Security installation will still try to first download the updates from the WithSecure Policy Manager Server, but after failing to download the updates for a few hours, the client will fallback to using the WithSecure Update Server to download the malware definition updates. 

If the host client is in an isolated environment with no access to the WithSecure Update Server, you can find the instructions how to update malware definitions on isolated Client Security and Server Security hosts here: https://www.withsecure.com/userguides/product.html#business/policy-manager/16.00/en/concept_8AE300FF20744C2882DFBB00D3E6E426-16.00-en

Issue:

How to allow users to be able to see and manage the encrypted messages they have sent through Messaging Security Gateway using the end user web service?

Resolution:

To enable management of sent encrypted messages in the end user web service (euweb):

1. Log into the Messaging Security Gateway Web UI.
2. Click on the System tab.
3. From the left-side menu, navigate to End User Services > Web Application.
4. Under Settings, change Show Encryption Key Management to On.
5. Click Save Changes at the top left corner.

Issue:

WithSecure Policy Manager informs on the Software updates tab that a update package is required to be downloaded manually, how does this work in Software Updater?

Resolution:

F-Secure Policy Manager 14.30 or later now allows manually downloading software updates that cannot be downloaded automatically from vendors' sites, e.g. Oracle Java updates.

Hosts report such updates as requiring manual downloading and the admin is able to download and import those using the Manual downloads feature found on the Software updates tab in Policy Manager Console.

Issue:

How to manage (start/stop/restart/check status) services of Linux Security 64?

Resolution:

Issue:

How can I configure alert forwarding by email on Policy Manager?

Resolution:

You can set Policy Manager to send alerts for the managed environment to one or more recipients by email.

You can send alerts both for Policy Manager Server notifications and for managed hosts. Policy Manager Server alerts are each sent as individual emails, but multiple host alerts can be included in the same email. Policy Manager checks for new alerts that are received from managed hosts every ten minutes.

Follow the steps below to configure email forwarding for alerts:

1. Select Tools > Server configuration from the menu
2. Click Email alerts
3. Enter the email addresses for the recipients
   • All recipients will receive all of the alerts generated by the system
4. Select either Host and server alerts or Server alerts only as the alert type to send by email
5. If you include host alerts, set the minimum alert severity and how many alerts you want to see in individual emails

   • Note: If the number of alerts for the polling period exceeds the selected amount, the email shows you the most recent alerts and prompts you to check the remaining alerts in the Policy Manager Console.

6. Click OK.

Issue:

WithSecure Client Security or Server Security scheduled scan causes high CPU usage. How can I reduce this?

Resolution:

Follow the steps below to change the priority of the scan from "Normal" to "Background" to improve the host performance during scheduled scanning:

1. Open the Policy Manager console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Navigate to Windows > Manual scanning
5. In the Scheduled scanning section you can change these settings to improve performance:
   • Run scanning with low priority (scan takes longer but takes less CPU resources)
   • Scan only known file types (scan in faster but does not scan all files)
   • Scan inside compressed archives (this requires significantly more CPU resources)
6. After changing settings, distribute the policy (Ctrl + D)