Issue:

How can I exclude a file or folder (object) from real-time scanning from the local Client Security or Server Security user interface?

Resolution:

Follow these steps to create a real-time scanning exclusion:

1. Open the Client Security  or Server Security user interface
2. Go to Settings 
3. Go to the Malware Protection settings page
4. In the Real-time scanning section, click View quarantine
5. Go to the Excluded tab
6. Click Add new 
7. Enter the file or folder path

Note: this will also exclude the file or folder path from all security scans, including: Real-time scanning, DeepGuard, Web Traffic Scanning (Advanced Network Protection), Connection Control

Issue:

Where to configure HTTP Proxy configuration for Policy Manager For Linux?

Resolution:

The proxy configuration file path for Linux is: 

/var/opt/f-secure/fspms/data/fspms.proxy.config

Policy Manager service restart is required after changing fspms.proxy.config.

# /etc/init.d/fspms stop
# /etc/init.d/fspms start

Issue:

We have for Linux Security 64 set the Real-time scanning Action for Malware, Action for Potentially Unwanted Applications and Action for suspicious files as  "Do nothing" when there is a detection.

We expected that in that case Linux Security 64 would only report the finding to Policy Manager Console. But in fact, Linux Security 64 will not only report the finding, but it will also prevent access to the detected file. 

Resolution:

When Linux Security 64 real-time scanning detects a file, even if the action is set as "Do nothing", it will indeed block access to the file. This is the intended behavior or logic of the function. 

The workaround is to create either a file or folder exclusion if you need to be able to access the detected file. 

You can create a file or folder exclusion for Linux Security 64 using the Policy Manager Console:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Navigate to Linux > Real-time scanning
5. In the Files to scan section, add the file or folder path to the Files and folders excluded from scanning list
6. Distribute the policy (Ctrl + D) 

Issue:

Linux Security 64 and Policy Manager Server are located on different networks, therefore HTTP proxy would be needed during installation. How to set HTTP proxy when installing Linux Security 64?

Resolution:

Linux Security 64 product has a single, global HTTP proxy setting, which is always used when the product makes HTTP requests to external services.

Issue:

Where can I get separately available stand-alone Linux version of fspm-definitions-update-tool for Linux Security 64? I need the Linux version of fspm-definitions-update-tool for creating update archives for isolated deployments of Business Suite Linux Security 64. 

Resolution:

The stand-alone Linux version of fspm-definitions-update-tool is available in the WithSecure Download Center on the Linux Security 64 page. https://www.withsecure.com/en/support/product-support/business-suite/linux-security

The Policy Manager User Guide includes instructions on how to use the fspm-definitions-update-tool: Updating malware definitions in isolated networks | Policy Manager | 16.10 | WithSecure User Guides 

Issue:

How to check Policy Manager Server alias for CA certificate ?

Resolution:

You can open a Command Prompt with administrator privileges and navigate to the following folder: C:\Program Files\WithSecure\Policy Manager\jre\bin

Then run command: keytool.exe -list -storetype pkcs12 -keystore c:\test\keystore.p12 -v

This command lists the contents of a PKCS#12 keystore file and prints full details for each entry.

First you’ll get the keystore type, provider, and number of entries. Then, for each entry:

• The alias (the name the entry is stored under)
• The entry type, such as PrivateKeyEntry (a private key plus its certificate chain) or trustedCertEntry (a certificate only)
• The creation date
• The certificate chain length
• For each certificate: owner and issuer (distinguished names), serial number, validity dates, SHA-1 and SHA-256 fingerprints, signature algorithm, public key algorithm and size, and any extensions such as Subject Alternative Names and key usage

Issue:

How to move WithSecure Policy Manager Server location to other drive and custom path from the default location?

Resolution:

Issue:

How to check if a scheduled scan has finished in Linux Security 64?

Resolution:

A scan report will be created in Policy Manager Console > Scan Report tab. 
There's no scan result report generated in Linux Security 64 side.

Detections will be logged in /var/log/messages.

Scan log of schedule scanning is logged in access.log as well as real-time scanning and manual scanning.

On a Linux workstation or server locally,  Business Suite Linux Security 64 output to the system log the scan settings, when the scan has started and when the scan has ended. System log location depends on the Linux distro being used:

• /var/log/syslog 
• /var/log/journal
• /var/log/messages

The scheduled scan start and finish logs come from the scand process while the scan settings logs come from the lspmd process.

Below you can see an example of the timestamps of past scheduled scans that are listed in a system log.

• lspmd [1930]: report {source=scheduled scan] scan schedule changed; schedule={"hour":15,"minute":10,"days":["friday"]}
• scand [5243]: report [source=scheduled scan]: scan started
• scand[5243]: report [source=scheduled scan]: scan finished

For example, on a Ubuntu Linux installation you can easily list the scan settings and the scan start and finish times by using the following terminal command:

• grep "scheduled scan" /var/log/syslog

Issue:

Does the server need to be rebooted when upgrading Server Security version? 

Resolution:

When upgrading Business Suite Server Security, a reboot is not required for these upgrades to take effect. When creating the installer, you will be given the choice to reboot or not.

Issue:

Policy manager Server service fails to start. fspms-service.log shows "Server process exited because of misconfiguration (exit code 3), see fspms-webapp-errors.log for details" 

Resolution:

If Policy Manager Server service fails to start and you are unable to connect with the Policy Manager Console to the server, the most likely cause for the issue is that either the HTTP or HTTPS port that Policy Manager Server has been configured to listed was in use during startup. 

Navigate to the log folder on the server: C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\log

Then check the fspms-stderrout.log if you see similar error messages related to failing to bind port:

WARN:cffur.NettyHttpServer:main: Http server failed to bind port
reactor.netty.ChannelBindException: Failed to bind on [0.0.0.0:80]
Suppressed: 
|java.lang.Exception: #block terminated with an error

WARN:cffur.NettyHttpServer:main: Http server failed to bind portreactor.netty.ChannelBindException: Failed to bind on [0.0.0.0:443]Suppressed:  |java.lang.Exception: #block terminated with an error

If you see these errors, run the command "netstat -anb" in a Command Prompt to check and ensure that there is no port conflict present. If there is, you need to stop the service that is using the port or you need to change with port the service is using.