Experiencing a breach?
Select Language
Contact support
Languages
Contact support
Back to Home

placeholder-title

placeholder-link
Back to Home

Login

Back to Home

Languages

English

Support articles

Other WithSecure Products

  • Can I use environment variables for defining exclusions in Linux for Elements Linux Protection or Linux Security 64?
    Read more
    Issue:

    Can I use environment variables for defining exclusions in Linux for Elements Linux Protection or Linux Security 64?

    Example: $HOME/build

    Resolution:

    Environment values are not supported in exclusions nor in any settings in Linux. Wildcards can be used for on-access scanning exclusions for Elements Linux Protection and Linux Security 64.

    To use the example above, /home/*/build would be nearly equivalent to the example provided.

  • How to use the –override-distro parameter to install Elements Linux Protection or Linux Security 64 on an unsupported Linux distribution?
    Read more
    Issue:

    How to use the –override-distro parameter to install Elements Linux Protection or Linux Security 64 on an unsupported Linux distribution? 

    –help parameter for the linuxsecurity-installer shows:

    • –subscription-key=KEY Specify subscription key (required);
    • –profile-id=PROFILE-ID Specify profile ID;
    • –next-boot Schedule the product to be activated
      on the next boot;
    • –override-distro=ID:VERSION-ID Spoof a supported operating system;
    Resolution:

    The override-distro parameter is mainly to be used to install Elements Linux Protection or Linux Security 64 on a newer version of a particular Linux distribution that WithSecure has not yet added to the officially supported distributions list.

    The –help for the installer provides the format for the –override-distro: ID:VERSION-ID.
    Examples:

    • –override-distro=debian:11 
    • –override-distro=rhel:8
    • –override-distro=ubuntu:22.04

    Even though we provide the means to install Elements Linux Protection or Linux Security 64 on an unsupported Linux distribution, distro override is to be used at your own discretion. If you are facing an issue while or after installing on a Linux distro version that is not yet officially supported, we can't provide support on it.

  • Atlant: How to check Policy Manager Server address, HTTP port and HTTPS port which was entered when creating Atlant installer in Policy Manager
    Read more
    Issue:

    How to check the Policy Manager Server address, HTTP port and HTTPS port which was entered when exporting the Atlant installer from the Policy Manager Console?

    Resolution:

    Policy Manager (PM) address setting cannot be viewed by atlantctl get command.
    Instead, here are some other ways to check their PM address, HTTP port and HTTPS port settings in Atlant.

    /var/opt/f-secure/atlant/fsbg/setup/mgmt-mode.json
    -> This will show PM address and HTTPS port

    /etc/opt/f-secure/atlant/baseguard/updated.ini > [server::policymanager]
    -> This will show PM address and HTTP port

    Apart from the method mentioned above, it is also possible to check the PM address and its port directly from the process's parameter by running the command below.

    # ps aux | grep fsma2
     

  • Unable to manage or import a new Linux Security 64 host to Policy Manager Server due to the same unique ID (UID) when installing it in the virtual environment or Linux containers
    Read more
    Issue:

    Unable to manage or import a new Linux Security 64 host to Policy Manager Server due to the same unique ID (UID) when installing it in the virtual environment or Linux containers

    Resolution:
    WithSecurity Linux Security 64 derives the UID from the unique information provided by the hardware.
     
    Most virtualization platforms emulate the unique hardware information as well so every clone should be unique.

    This UID cannot be cleared or changed.

    Normally, the unique hardware ID can be seen with the following command:
    # cat /sys/class/dmi/id/product_uuid

     
    Currently, there is no mechanism in Linux Security 64 to clear the UID as it comes from the operating system.
     
    Having the same host identity for two different Linux Security 64 hosts affects the policy distribution and etc as it will force Policy Manager to generate policies every time the host connects, which also causes additional overhead on the server resources.

    Apart from that, you will not be able to identify the actual host if one host gets infected in that situation.

    Both hosts will initiate connections to the Policy Manager Server, the server will still be able to answer to them and the policy counter will be increased accordingly.

    For some cases, editing the virtualization configuration file could be considered for such environment.

    In case of VMware, you could refer to the following documentation on how exactly it is done.
     
    https://kb.vmware.com/s/article/1541

    In case of Hyper V virtual environment, there are some documentations below on how UUID could be changed in order to solve the duplication issue.

    https://docs.microsoft.com/en-us/answers/questions/450978/is-it-possible-to-change-the-uuid-of-a-hyper-v-hos.html

    In case of container, you could consider to carry out the following steps that could possibly workaround the issue.

    1. Generate a new UUID within the container
    2. Save it as file with “uuidgen > filename”
    3. Mount the file to “/sys/class/dmi/id/product_uuid"
        # mount –bind filename /sys/class/dmi/id/product_uuid
    4. Perform the reboot
    5. Check the newly generated local "product_uuid"
    6. Migrate this container to an host running another container with Linux Security 64 
     
    Note:
    At the moment, installation of Linux Security 64 in the container is not officially tested and not supported. 

  • How to scan computer manually using command line with Linux Security 64 or Elements Linux Protection
    Read more
    Issue:

    How to scan computer manually using command line with Linux Security 64 or Elements Linux Protection ? 

    Resolution:

    You can scan the computer for malware manually from the command line of a Linux host that has Linux Security 64 or Elements Linux Protection installed.

    Make sure the user account you run fsanalyze as has read access to the files, and read and execute access to all directories to be scanned. To rename or remove infected files, the user also needs write access to those directories.

    The fsanalyze command scans specified targets (files or directories) and reports any malicious code it detects.

    If no files are specified on the command line, fsanalyze reads the standard input for content to analyze. Otherwise, every given file is analyzed and every given directory is scanned recursively, with the following exceptions:

    • Special files (such as socket, FIFO, or device files), and files on the /proc and /sys special file systems are skipped.
    • Recursive scanning does not follow symbolic links unless this is explicitly requested with the –follow command line option.
    • Recursive scanning does not automatically cross file system boundaries. To scan files mounted on other file systems, specify the mount points explicitly on the command line.

    Note: The exclusions that are set in the current policy for manual scanning are applied when you use manual scanning from the command line. If you have excluded any paths in the manual scanning policy, recursive scanning crosses file system boundaries.

    1. Run the following command from the shell to start the manual scan: /opt/f-secure/linuxsecurity/bin/fsanalyze [OPTIONS] [FILE…]
      Usage: fsanalyze [OPTIONS] [FILE…]

    Analyze each FILE for potential malicious content. If no file is specified, analyze standard input, in which case the only supported action is none.

    • -h, –help Show help.
    • –malware=ACTION Action to take when a file is detected as malware. If ACTION is remove the file is removed; if ACTION is rename the file is renamed adding the detection type as an extension; if ACTION is none, the infection is only reported on standard output. Default: rename
    • –pua=ACTION Action to take when a file is detected as a potentially unwanted application. Options for the action are the same as for malware.
      Default: none
    • –suspected=ACTION Action to take when a file is detected as suspicious. Options for the action are the same as for malware.
      Default: none-L,
    • –follow Follow symbolic links.
    • -l, –list List all scanned files.
    • –preserve-atime=VALUE Preserve the access time of files that are scanned. Value can be yes or no.
      Default: no
    • -q, –quiet Only output the scan results.
    • –scan-archives=VALUE Enable archive scanning. Value can be yes or no.
      Default: no
    • –max-nested=NUMBER Set the maximum allowed nesting level of scanned archives.
      Default: 5
    • –detect-max-nested=VALUE If enabled, treat archives that exceed the maximum depth as malware. Value can be yes or no.
      Default: no
    • –detect-encrypted-archives=VALUE Treat encrypted archives as malware. Value can be yes or no.
      Default: no
    • –detect-pua=VALUE If disabled, potentially unwanted applications are ignored. Value can be yes or no.
      Default: yes
    • –use-orsp=VALUE If enabled, use the reputation service (ORSP) from Security Cloud. Value can be yes or no.
      Default: yes
    • -v, –version Display program version and exit.
    • –quoting-style=STYLE Set how to quote the output. If STYLE is url, the output is URL-encoded; if STYLE is escape, ASCII control characters in the output are escaped as <NAME>, and if the output is not redirected to a file, they are also highlighted; if STYLE is literal, the output is printed as is.
      Default: url
    • –ignore-exclude-paths Does not use the exclusions set from the current policy for manual scanning.

    The scanning exit codes are as follows:

    0 = scanning was completed with no errors, and no malware, PUA, or suspicious content was detected
    1 = scanning failed for one or more files
    2 = scanning was completed with no errors, but malware, PUA, or suspicious content was detected

     

  • Is it possible to install Linux Security 64 (LS64) and Atlant on same server?
    Read more
    Issue:

    Is it possible to install Linux Security 64 (LS64) and Atlant on same server?

    Resolution:

    Yes, it is possible to install both LS64 and Atlant on same server. You can install either one first. 
     

  • Unable to edit firewall profile in Policy Manager Console due to it being grayed out
    Read more
    Issue:

    Administrator is unable to edit or modify firewall settings profiles in the Policy Manager Console because the Add rule, edit rule and remove rule buttons are greyed out.

    Resolution:

    The reason why the buttons are greyed out and cannot be clicked on the Policy Manager Console's Firewall settings page is because the firewall profile that you have selected from the Profile being edited drop-down menu is a predefined profile created by WithSecure or it has been created by an admin who is out of your scope. 

    Firewall profiles have three possible scopes in the Policy Manager Console:

    • Predefined: not editable, defined by WithSecure or upper-level admins, available for all the policy domains and hosts within the admin's scope
    • My scope: editable, defined by the admins who share the same domain access level, available for all the policy domains and hosts within the admin's scope
    • Sub-admin scope: editable, defined by the sub-admins and available only within their scopes

    To create a profile to your own scope (my scope):

    1. Log in to the Policy Manager Console
    2. Select a host or policy domain from the domain tree
    3. Open the Settings tab
    4. Go to the Windows > Firewall settings page
    5. Select a profile from the Profile being edited drop-down menu 
    6. Click Clone 
    7. Enter a name for the profile

    Now you have a custom profile which you can edit. You can then assign that profile to the selected host or policy domain by selecting if from the Workstation host profile or Server host profile drop-down menu. 

  • Is it possible to export the MSI installation package in the Policy Manager console for Linux?
    Read more
    Issue:

    Is it possible to export a Client Security or Server Security MSI installation package if Policy Manager Console is running on a Linux device?

    Resolution:

    You can prepare MSI packages for distributed installation within your managed network even if you have both Policy Manager Server and Policy Manager Console running on Linux.

    With the Linux version of Policy Manager, you cannot use the base MSI file extracted from the JAR installation package to roll out WithSecure products to Windows hosts. However, you can use a command line tool to prepare the MSI file for distributed installation.

    1. Export the client installation JAR package from Policy Manager Console.
    2. Extract the content of the JAR archive on a Windows host.
    3. Run the following command:
      • For Client Security: program\inst\one-launcher.exe –install –prepare_msi_only –msi OneClientCS.msi
      • For Server Security: program\inst\one-launcher.exe –install –prepare_msi_only –msi OneClientSS.msi

    The correct command is also given as the preparemsicommand property in the package.hdr file, which you can find in the root folder of the extracted content.

    This command updates the .msi file given as the parameter for the –msi option. You can use this prepared MSI file to distribute the WithSecure product to Windows hosts in your network.

    If the target MSI package is not updated, the log file may be useful for troubleshooting purposes. The location of the log file depends on your access rights when running the preparation command:

    • With administrator rights and user access elevation: C:\ProgramData\F-Secure\Log\BusinessSuite\one-launcher.u.log
    • Without user access elevation: C:\Users\user\AppData\Local\F-Secure\Log\BusinessSuite\one-launcher.u.log

  • Linux Security 64 installation to isolated environment fails with error ‘failed to find content for one or more required channels’
    Read more
    Issue:

    Linux Security 64 installation on a host in an isolated or offline environment fails with the error: 
    " Unfinished F-Secure Linux Security 64 activation found. Restarting activation.
    Preparing content for installation…
    Activate: /root/withsecure-updates.zip: failed to find content for one or more required channels
    Failed to activate the product! "

     

    Resolution:

    To install Linux Security 64 on an isolated host using a content package (withsecure-updates.zip), run: 

    • bash linuxsecurity-pm-installer/linuxsecurity-installer –package=/PATH/TO/withsecure-updates.zip –automatic-updates=none

    When creating the withsecure-updates.zip, make sure that you have the latest version of the channels.json file. If you are unsure about the version, download the latest channels.json file: 

    Instructions how to create the content package for isolated Linux environments can be found in the Linux Security 64 user guide: Creating the content package for isolated environments | Linux Security 64 | Latest | WithSecure User Guides 

  • Import button missing on the Installation packages page in the Policy Manager Console
    Read more
    Issue:

    When I try to import a JAR installation package the Policy Manager Console from the Installation > Installation packages page, the Import button is missing / not visible.

    Resolution:

    If you do not see the import button, It is possible that the user account you have used to login to the Policy Manager console is a sub-domain admin and not a root domain admin user. The sub-domain admin users can only see the export button as they don't have privileges to import or delete installation packages as per the software design.

    Login with the root admin account and verify if the Import and Delete buttons are displayed correctly.