Issue:

Is it possible to export a Client Security or Server Security MSI installation package if Policy Manager Console is running on a Linux device?

Resolution:

You can prepare MSI packages for distributed installation within your managed network even if you have both Policy Manager Server and Policy Manager Console running on Linux.

Issue:

Linux Security 64 installation on a host in an isolated or offline environment fails with the error: 
" Unfinished F-Secure Linux Security 64 activation found. Restarting activation.
Preparing content for installation…
Activate: /root/withsecure-updates.zip: failed to find content for one or more required channels
Failed to activate the product! "

Resolution:

To install Linux Security 64 on an isolated host using a content package (withsecure-updates.zip), run: 

• bash linuxsecurity-pm-installer/linuxsecurity-installer –package=/PATH/TO/withsecure-updates.zip –automatic-updates=none

When creating the withsecure-updates.zip, make sure that you have the latest version of the channels.json file. If you are unsure about the version, download the latest channels.json file: 

Instructions how to create the content package for isolated Linux environments can be found in the Linux Security 64 user guide: Creating the content package for isolated environments | Linux Security 64 | Latest | WithSecure User Guides 

Issue:

When I try to import a JAR installation package the Policy Manager Console from the Installation > Installation packages page, the Import button is missing / not visible.

Resolution:

If you do not see the import button, It is possible that the user account you have used to login to the Policy Manager console is a sub-domain admin and not a root domain admin user. The sub-domain admin users can only see the export button as they don't have privileges to import or delete installation packages as per the software design.

Login with the root admin account and verify if the Import and Delete buttons are displayed correctly.

Issue:

What are the steps to install WithSecure Client Security on a Windows computer?

Resolution:

Note: For the Client Security deployment, you need a Policy Manager Server to manage the clients.

Before you proceed with the installation, you need to configure the Policy Manager Server address and the ports in the policy:

1. Log in to the Policy Manager Console
2. Select a policy domain from the domain tree
   1. Note: if you only have Root: Right-click root and click New policy domain
3. Go to the Settings tab
4. Navigate to the Windows > Centralized management page
5. In the Policy Manager Server host communication settings, you need to configure the address and ports the clients will try to connect to after installation
6. Distribute the policy (Ctrl + D)

Download the installation package (.jar) file from WithSecure website here. After you have downloaded the .Jar file, it needs to be imported to the Policy Manager Server so that you can export a fully configured installation file.

1. Log in to the Policy Manager Console
2. Navigate to the Installation tab, then click on Installation Packages and click Import
3. Choose the .Jar file you just downloaded

Note: Before you start to deploy the client, you need to choose what installation type you prefer:

• Export as MSI file and deploy via 3rd party software or locally running the installation file
• Push installation, to centrally install the client onto Windows hosts

Steps to export the MSI File:

1. On the Installation tab, click on Installation packages
2. Select the imported .Jar file from the list and click Export 
3. Save it to your desired location (not to a root folder of a drive, example C:\)
4. Enter the license keycode, which is visible on your License Certificate
5. Select the features which you want to install
6. Choose product language
7. Select the initial policy, which will be in use until the host has been imported to a policy domain
8. In configure the Policy Manager Server address step, choose the Host identification method and click Next
9. In the Conflicting software step, select if you want the installation to try to uninstall any conflicting software

Once you have the fully configured .msi file, deploy the MSI package using a 3rd party deployment software in your organization or run it locally on a host.

Steps for push installation:

1. Click on push installation to Windows Hosts and add you Host.
2. After you have found the host from your domain tree, select the .jar file you imported and authenticate with your admin account (the account you are logged in) and click Next.
3. Click Start.
4. After the Start you will be prompt with the Client Wizard page, so click Next
5. Enter your license keycode and click Next.
6. Choose the preferred language.
7. Set your policy domain or host and click Next. 
8. In "configure the communication with your Policy Manager Server" step. Make sure the Host identification is set to SMBIOS global unique ID. 
9.  and click Next.
10. Select the checkbox to uninstall the conflicting software.
11. Choose the restart option and finish your installation Wizard.

Once the client has been installed, the host will be listed in the Pending list, in the "hosts outside the domain tree" section on the left side of the Policy Manager Console window. 

1.  Click Pending 
2.  Select the host(s)
3.  Click on the three dots to select to which policy domain you want to import the host(s) to 
4.  Click Import

Once a host is listed on the Domain tree, you can select it and change the policy settings centrally from the Settings tab. To distribute the policy, click on the blue Distribute policies button in the top left corner or use Ctrl + D shortcut.
 

Issue:

I would like to upgrade Atlant to the latest version, how can I do that?

Resolution:

All WithSecure for Linux products, including the Atlant component version is updated to the latest versions via the definition database updates. You can check the following location in the Linux host to verify what are the product component version (fscomp_version=1.0.XXX):

• /etc/opt/f-secure/atlant/release-info.ini
• /etc/opt/f-secure/baseguard/release-info.ini
• /etc/opt/f-secure/fsbg/release-info.ini

Issue:

After installing Linux Security 64, a host device hasn't reported itself in the Policy Manager Console's Pending list or the host hasn't been automatically imported to the domain tree according to the import rules. 

How to investigate why a Linux Security 64 device hasn't been able to connect to the Policy Manager Server? 

Resolution:

It is advised to check on the following for common root causes of the issue of Linux Security not 

Verify the connectivity that the connection between the Linux host and the Policy Manager Server isn't blocked for example by a firewall rule. You may check with ping, curl, etc.

Alternatively, if the Linux server has a graphical user interface (GUI)enabled, type in the Policy Manage Server's IP address in the web browser, and the expected message to receive is "If you see this message, WithSecure Policy Manager Server is installed and working fine." 

• If you do not receive this message: then the connection issue is not in the Linux Security 64 configuration but in the connectivity between the Linux host and the server where Policy Manager Servers is running. Check for any firewall blocks or you may turn off the firewall by running the "fsav-config" command and selecting nofirewall
• If you receive this message: Verify if the Policy Manager address (IP or hostname) was set correctly in the settings policy for Linux Security 64. You can in Policy Manager Console select either root or a policy domain from the domain tree and then on the Settings tab navigate to Linux > Centralized management to check the Policy Manager Serverr address, HTTP port and HTTPS port settings. If the settings are incorrect, correct them and export a new Linux Security 64 installation package and reinstall. 

Issue:

Linux Security 64 doesn't download updates from the Policy Manager Server after the product installation was performed with the parameter:

• –automatic-updates=none 

Resolution:

Linux Security 64 is unable to download or install the database updates from the network and also from Policy Manager server when it is installed as an isolated host using a content package (withsecure-updates.zip) and "–automatic-updates=none" parameter option.

The –automatic-updates=none installation mode is only meant for Linux servers which do not have a direct internet access, thus a manual database update using the content package (withsecure-updates.zip) is needed.

If you would like WithSecure Linux Security 64 host to connect to the Policy Manager Server for database updates and policy distribution (product configurations using Policy Manager Console), then the installation package needs to be recreated with the correct configuration of Policy Manager Server address (not "0.0.0.0" for isolated host or standalone deployment) and you should run the installation with the following command without the option of "–automatic-updates=none" to install the product over the network so that it will connect to the Policy Manager Server after the installation.

• bash f-secure-linuxsecurity/f-secure-linuxsecurity-installer

Issue:

If Linux Security 64 was installed with the option:

• automatic-updates=none

Is it possible to enable back the automatic update after installed using "–automatic-updates=none" option automatically download the updates if the device was moved from an isolated or offline network to a network with internet connectivity?

Resolution:

A Linux Security 64 that was installed using the argument  –automatic-updates=none (a.k.a disabled), it needs to be reinstalled so that automatic updates are enabled. 

Issue:

How to check whether automatic updates was disabled or enabled during installation of Linux Security 64?

Resolution:

To check if automatic updates have been disabled for a Linux Security 64 installation, you need to check if the ipf.json file located in /var/opt/f-secure/fsbg/fsma2/ includes the following line:

• "download_updates": "none"

If the line exists, then automatic updates have been disabled. If the line doesn't exist, then automatic updates are enabed. 

If Linux Security 64 has been installed using the argument  –automatic-updates=none, to revert the setting you need reinstall Linux Security 64, since the setting cannot be changed after installation. 

Issue:

How to reset or change Unique ID (UID) in Linux Security 64? For example, if multiple installations are using the same UUID.

Resolution:

Linux Security 64 derives the UID from the unique information provided by the hardware. Most virtualization platforms emulate the unique hardware information as well so every clone should be unique. This UID cannot be cleared or changed.

The unique hardware ID can be seen with the command:

cat /sys/class/dmi/id/product_uuid