{"id":603,"date":"2022-05-26T10:32:53","date_gmt":"2022-05-26T08:32:53","guid":{"rendered":"https:\/\/homepages.lcc-toulouse.fr\/colombet\/?p=603"},"modified":"2022-06-09T12:00:32","modified_gmt":"2022-06-09T10:00:32","slug":"antivirus-deployer-fsecure-policy-manager-sur-debian11","status":"publish","type":"post","link":"https:\/\/homepages.lcc-toulouse.fr\/colombet\/antivirus-deployer-fsecure-policy-manager-sur-debian11\/","title":{"rendered":"antivirus &#8211; deployer f-secure policy manager sur debian 11"},"content":{"rendered":"<p>Policy Manager offre une mani\u00e8re modulable de g\u00e9rer la s\u00e9curit\u00e9 de plusieurs applications sur diff\u00e9rents syst\u00e8mes d&rsquo;exploitation, \u00e0 partir d&rsquo;un emplacement central. Policy Manager offre les fonctionnalit\u00e9s de d\u00e9finition\/distribution des strat\u00e9gies de s\u00e9curit\u00e9, d&rsquo;installation des applications et de surveillance des activit\u00e9s de tous les syst\u00e8mes dans l&rsquo;entreprise afin d&rsquo;assurer la conformit\u00e9 avec les strat\u00e9gies de l&rsquo;entreprise et le contr\u00f4le centralis\u00e9.<\/p>\n<p><!--more--><\/p>\n<p>Proc\u00e9dure pour installer Policy Manager Server et Policy Manager Console sur le m\u00eame serveur en Debian 11 avec interface graphique. Le serveur fraichement install\u00e9 doit acc\u00e9der \u00e0 internet.<\/p>\n<p>Activer l&rsquo;architecture i386 car f-secure a besoin libstdc++6:i386<\/p>\n<pre><code>dpkg --add-architecture i386 &amp;&amp; apt-get update &amp;&amp; apt install libstdc++6:i386\n<\/code><\/pre>\n<blockquote><p>\n  Pour supprimer l&rsquo;architecture : dpkg &#8211;remove-architecture i386\n<\/p><\/blockquote>\n<p>R\u00e9cup\u00e9rer les sources debian chez f-secure.com<\/p>\n<pre><code># F-Secure Policy Manager Server\nwget https:\/\/download.f-secure.com\/corpro\/pm_linux\/pm_linux15.30\/fspms_15.30.96312_amd64.deb\n# F-Secure Policy Manager Console\nwget https:\/\/download.f-secure.com\/corpro\/pm_linux\/pm_linux15.30\/fspmc_15.30.96312_amd64.deb\n#  F-Secure Policy Manager Proxy\nwget https:\/\/download.f-secure.com\/corpro\/pm_linux\/pm_linux15.30\/fspmP_15.30.96312_amd64.deb\n<\/code><\/pre>\n<h2>Installer le serveur et la console f-secure-policy-manager<\/h2>\n<p>Il est possible d&rsquo;installer la console s\u00e9parement, par exemple en t\u00e9l\u00e9chargeant le msi pour windows et en ne s\u00e9lectionnant<\/p>\n<h3>Policy Manager <strong>Console<\/strong><\/h3>\n<pre><code># dpkg -i fspmc_15.30.96312_amd64.deb\nSelecting previously unselected package f-secure-policy-manager-console.\n(Reading database ... 160644 files and directories currently installed.)\nPreparing to unpack fspmc_15.30.96312_amd64.deb ...\nUnpacking f-secure-policy-manager-console (15.30.96312) ...\nSetting up f-secure-policy-manager-console (15.30.96312) ...\n\/bin\/grep: \/usr\/bin\/sg: binary file matches\n********************************************************************************\n* F-Secure Policy Manager Console 15.30.96312 has been successfully installed.\n*\n* A new user group 'fspmc' was created. You should add users, who will use\n* the console, to this group.\n*\n* There is README file in \/opt\/f-secure\/fspmc\/ directory. The README contains\n* late-breaking news, usage tips and additional information. Please read the\n* Licence Agreement included in the README file. You must accept the agreement\n* to use F-Secure Policy Manager Console.\n*\n* Then, run \/opt\/f-secure\/fspmc\/fspmc to launch the program.\n********************************************************************************\n<\/code><\/pre>\n<h3>Policy Manager <strong>Server<\/strong><\/h3>\n<pre><code># dpkg -i fspms_15.30.96312_amd64.deb\n\nSelecting previously unselected package f-secure-policy-manager-server.\n(Reading database ... 159978 files and directories currently installed.)\nPreparing to unpack fspms_15.30.96312_amd64.deb ...\nUnpacking f-secure-policy-manager-server (15.30.96312) ...\nSetting up f-secure-policy-manager-server (15.30.96312) ...\n********************************************************************************\n* F-Secure Policy Manager Server 15.30.96312 has been successfully installed.\n*\n* Run \/opt\/f-secure\/fspms\/bin\/fspms-config to finish installation and\n* to start the server.\n********************************************************************************\n<\/code><\/pre>\n<p>Executer <strong>fspms-config<\/strong> pour initialiser les param\u00e8tres de votre serveur<\/p>\n<pre><code>\/opt\/f-secure\/fspms\/bin\/fspms-config\n<\/code><\/pre>\n<pre><code>F-Secure Policy Manager Server configuration utility.\nCopyright (c) 1997-2021 F-Secure Corporation. All Rights Reserved.\nYou will be asked a few questions regarding the product installation.\nThe default value will be shown in square brackets after the questions.\nTo accept the default value, just press Enter.\n[ ok ] Stopping fspms (via systemctl): fspms.service.\n\nConfigure the ports for the Policy Manager Server.\nHost interface HTTP port [80]: enter\nHost interface HTTPS port [443]: enter\nAdministrator interface port [8080]: enter\nRestrict access to administrator interface to local machine only [yes]: no\nEnable Web Reporting [yes]: enter\nWeb Reporting port [8081]: enter\nCreating administrator account.\nEnter password: *******\nConfirm password: *******\n[ ok ] Starting fspms (via systemctl): fspms.service.\n\nConfiguration is complete. You can manage the F-Secure Policy Manager Server\nmanually by typing '\/etc\/init.d\/fspms {start|stop|restart|status}'.\nThank you for using F-Secure product\n<\/code><\/pre>\n<p>V\u00e9rifier l&rsquo;\u00e9tat du service F-Secure Policy Manager Server<\/p>\n<pre><code># systemctl status fspms.service\n\u25cf fspms.service - LSB: F-Secure Policy Manager Server\n     Loaded: loaded (\/etc\/init.d\/fspms; generated)\n     Active: active (running) since Thu 2022-05-26 09:23:37 CEST; 1h 21min ago\n       Docs: man:systemd-sysv-generator(8)\n    Process: 469 ExecStart=\/etc\/init.d\/fspms start (code=exited, status=0\/SUCCESS)\n      Tasks: 58 (limit: 2317)\n     Memory: 11.3M\n        CPU: 733ms\n     CGroup: \/system.slice\/fspms.service\n             \u251c\u2500768 \/usr\/bin\/perl \/opt\/f-secure\/fsaus\/bin\/fsaus -c \/etc\/opt\/f-secure\/fsaus\/conf\/server.cfg\n             \u251c\u2500769 sh -c \/opt\/f-secure\/fsaus\/bin\/bwserver -c \/etc\/opt\/f-secure\/fsaus\/conf\/server.cfg  &gt;\/dev\/null 2&gt;&amp;1\n             \u2514\u2500774 \/opt\/f-secure\/fsaus\/bin\/bwserver -c \/etc\/opt\/f-secure\/fsaus\/conf\/server.cfg\n<\/code><\/pre>\n<h2>Policy Manager <strong>Proxy<\/strong><\/h2>\n<p>Le proxy doit etre install\u00e9 sur une machine s\u00e9par\u00e9e typiquement en DMZ. Il faut au pr\u00e9alable r\u00e9cup\u00e9rer la cl\u00e9 publique du fspms pr\u00e9c\u00e9dement install\u00e9<\/p>\n<pre><code># wget https:\/\/fspms.interne.mondomaine.fr\/fsms\/fsmsh.dll?FSMSCommand=GetPublicKey -O admin.pub\n<\/code><\/pre>\n<p>Installer le paquet du proxy<\/p>\n<pre><code># dpkg -i fspmp_15.30.96312_amd64.deb\n(Reading database ... 30274 files and directories currently installed.)\nPreparing to unpack fspmp_15.30.96312_amd64.deb ...\nUnpacking f-secure-policy-manager-proxy (15.30.96312) ...\nSetting up f-secure-policy-manager-proxy (15.30.96312) ...\n********************************************************************************\n* F-Secure Policy Manager Proxy 15.30.96312 has been successfully installed.\n*\n* Run \/opt\/f-secure\/fspms\/bin\/fspms-config to finish installation and\n* to start the server.\n********************************************************************************\n<\/code><\/pre>\n<p>Executer <strong>fspms-config<\/strong> pour serveur proxy au serveur manager<\/p>\n<pre><code>\/opt\/f-secure\/fspms\/bin\/fspms-config\n\nF-Secure Policy Manager Proxy configuration utility.\nCopyright (c) 1997-2021 F-Secure Corporation. All Rights Reserved.\n\nYou will be asked a few questions regarding the product installation.\nThe default value will be shown in square brackets after the questions.\nTo accept the default value, just press Enter.\nStopping fspms (via systemctl): fspms.service.\nSpecify the details for communication with F-Secure Policy Manager. Enter the server\u2019s IP address or its DNS name.\nServer address []: fspms.interne.mondomaine.fr\nHTTPS port [443]:\nYou need to install the management public key to ensure secure communication with F-Secure Policy Manager.\nPath to the management public key []: .\/admin.pub\nConfigure the ports for the Policy Manager Proxy.\nHost interface HTTP port [80]:\nHost interface HTTPS port [443]:\nEnter the details for your Policy Manager administrator account to authorize TLS certificate enrollment.\nUser name []: login_du_serveur_fspms\nPassword: mdp_du_serveur_fspms\n\nStarting fspms (via systemctl): fspms.service.\nConfiguration is complete. You can manage the F-Secure Policy Manager Proxy\nmanually by typing '\/etc\/init.d\/fspms {start|stop|restart|status}'.\nThank you for using F-Secure product.\n<\/code><\/pre>\n<p>Si vous rencontrez les erreurs suivantes, vous avez donc d\u00e9ja jou\u00e9 avec les certificats (il faut faire l&rsquo;int\u00e9gration avec le certificat auto sign\u00e9 de f-secure)<\/p>\n<pre><code>Error: CA certificate verification failed\n<\/code><\/pre>\n<pre><code>Error: error creating bean with name 'com.fsecure.fspms.proxy.TrustAllUpstreamPmClient': Bean instantiation via constructor failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [com.fsecure.fspms.proxy.TrustAllUpstreamPmClient]: Constructor threw exception; nested exception is java.lang.RuntimeException: Error during loading admin.pub\n<\/code><\/pre>\n<p>Relancer un enrollment dans le fspms avec le certificat auto sign\u00e9 de f-secure<\/p>\n<pre><code>\/opt\/f-secure\/fspms\/bin\/fspmp-enroll-tls-certificate\nEnter Policy Manager user to authorize certificate enrollment: admin\nEnter password:\nTLS certificate enrollment completed successfully.\n<\/code><\/pre>\n<h2>D\u00e9ploiement d&rsquo;un certificat sign\u00e9 sectigo au serveur f-secure afin d&rsquo;etre compatible client macOS<\/h2>\n<blockquote><p>\n  Pr\u00e9requis obligatoire \u00eatre en possession d&rsquo;un certificat sectigo avec sa cl\u00e9 priv\u00e9e, et avoir d\u00e9ja enrol\u00e9 le serveur f-secure proxy aupr\u00e8s du manager\n<\/p><\/blockquote>\n<p>Si dessous un exemple de script pour convertir le certificat sectigo au format pkcs12 et l&rsquo;int\u00e9grer dans la magasin java de f-secure<\/p>\n<pre><code>#!\/bin\/bash\n\n# Convertir, inclure les certificats, les autorit\u00e9s au format pkcs12\nopenssl pkcs12 -export -name fspms -in \/etc\/letsencrypt\/live\/mondomaine.fr\/fullchain.pem -inkey \/etc\/letsencrypt\/live\/mondomaine.fr\/privkey.pem -out \/tmp\/mondomaine.fr.p12 -password pass:srcpassword\n\n# Importer le pkcs12 dans un keystore java\nkeytool -importkeystore -destkeystore \/tmp\/fspms.jks -deststorepass superPASSWORD -destalias fspms -destkeypass superPASSWORD -srckeystore \/tmp\/mondomaine.fr.p12 -srcstoretype PKCS12 -srcstorepass srcpassword -srcalias fspms\n\n# V\u00e9rifier l'import\nkeytool -list -keystore \/tmp\/fspms.jks -storepass superPASSWORD\n\n# Sauvegarde, remplcement du certificat autosign\u00e9 par le notre\nmv \/var\/opt\/f-secure\/fspms\/data\/fspms.jks \/var\/opt\/f-secure\/fspms\/data\/fspms.jks.old\nmv \/tmp\/fspms.jks \/var\/opt\/f-secure\/fspms\/data\/fspms.jks\nchmod 660 \/var\/opt\/f-secure\/fspms\/data\/fspms.jks\nchown fspms:fspms \/var\/opt\/f-secure\/fspms\/data\/fspms.jks\nsystemctl restart fspms.service\n<\/code><\/pre>\n<h2>D\u00e9ploiement via ilaunchr<\/h2>\n<p>R\u00e9cup\u00e9rer <strong>ilaunchr.exe<\/strong> se trouvant dans <em>\/opt\/f-secure\/fspmc\/bin\/ilaunchr.exe<\/em> du serveur f-secure et le fichier JAR pr\u00e9c\u00e9demment export\u00e9 sur la machine Windows \u00e0 d\u00e9ployer.<\/p>\n<p>Durant l&rsquo;installation du poste client, vous voyez appara\u00eetre une bo\u00eete de dialogue affichant la progression de l&rsquo;installation. Si un red\u00e9marrage est n\u00e9cessaire apr\u00e8s l&rsquo;installation, vous \u00eates invit\u00e9 \u00e0 red\u00e9marrer l&rsquo;ordinateur comme d\u00e9fini lors de l&rsquo;exportation du paquet d&rsquo;installation. Si vous souhaitez que l&rsquo;installation s&rsquo;ex\u00e9cute en mode silencieux, entrez la commande au format : ilaunchr.exe .jar \/Q. Dans ce cas \u00e9galement, vous \u00eates invit\u00e9 \u00e0 red\u00e9marrer l&rsquo;ordinateur apr\u00e8s l&rsquo;installation. Si une erreur fatale se produit pendant l&rsquo;installation, un message s&rsquo;affiche.<\/p>\n<p>ilaunchr poss\u00e8de les param\u00e8tres de ligne de commande suivants :<\/p>\n<pre><code>- \/U : Aucun message ne s'affiche, m\u00eame en cas d'erreur fatale\n- \/F : Installation forc\u00e9e, termine l'installation m\u00eame si l'agent de gestion est d\u00e9j\u00e0 install\u00e9.\n- \/user:domain\\username (variation: \/user:username) \u2014 compte utilisateur et le nom de domaine. Nom de domaine optionnel\n- \/password:secret (variation: \/password:\"secret with spaces\") \u2014 mot de passe du compte utilisateur\n<\/code><\/pre>\n<p>Exemple de commande pour d\u00e9ployer votre agent<\/p>\n<pre><code>ilaunchr.exe &lt;jar file&gt; \/user:domain\\user_name \/password:secret_word\n<\/code><\/pre>\n<h1>Vid\u00e9o de prise en main de la console f-secure avec g\u00e9n\u00e9ration d&rsquo;un paquet \u00e0 d\u00e9ployer<\/h1>\n<div style=\"width: 800px;\" class=\"wp-video\"><video class=\"wp-video-shortcode\" id=\"video-603-1\" width=\"800\" height=\"600\" preload=\"metadata\" controls=\"controls\"><source type=\"video\/webm\" src=\"https:\/\/homepages.lcc-toulouse.fr\/colombet\/wp-content\/uploads\/sites\/2\/2022\/05\/f-secure-debian.webm?_=1\" \/><a href=\"https:\/\/homepages.lcc-toulouse.fr\/colombet\/wp-content\/uploads\/sites\/2\/2022\/05\/f-secure-debian.webm\">https:\/\/homepages.lcc-toulouse.fr\/colombet\/wp-content\/uploads\/sites\/2\/2022\/05\/f-secure-debian.webm<\/a><\/video><\/div>\n<p><!-- [f-secure-debian](media\/16534933002298\/f-secure-debian.webm) --><br \/>\n<!-- [f-secure-debian](media\/16534933002298\/f-secure-debian.mov) --><\/p>\n<h2>Extension Firefox<\/h2>\n<p>Extensions Firefox (protection de navigation)<\/p>\n<ul>\n<li><a href=\"https:\/\/download.sp.f-secure.com\/firefox-extension-install\/prod\/browsing-protection.firefoxextension.xpi\">https:\/\/download.sp.f-secure.com\/firefox-extension-install\/prod\/browsing-protection.firefoxextension.xpi<\/a><\/li>\n<li><a href=\"https:\/\/download.sp.f-secure.com\/online-safety\/fs_firefox_https.xpi\">https:\/\/download.sp.f-secure.com\/online-safety\/fs_firefox_https.xpi<\/a><\/li>\n<\/ul>\n<h2>Activation de la console H2 sur votre serveur fspms<\/h2>\n<ul>\n<li>Fermer la console F-Secure Policy Manager Console<\/li>\n<li>Arr\u00eater le service F-Secure Policy Manager Server<\/li>\n<li>Ouvrir la base de registre et aller \u00e0 la cl\u00e9 HKLM&gt;SOFTWARE&gt;Wow6432Node&gt;Data Fellows\\F-Secure\\Management Server 5\\<\/li>\n<li>Editer le champ \u00ab\u00a0additional_java_args\u00a0\u00bb<\/li>\n<li>Ajouter le param\u00eatre <code>-Dh2ConsoleEnabled=true<\/code><\/li>\n<li>Fermer la base de registre et relancer le service F-Secure Policy Manager Server<\/li>\n<li>Pour acc\u00e9der \u00e0 la console H2, ouvrir un navigateur internet \u00e0 l&rsquo;adresse https:\/\/fspms.interne.mondomaine.fr ou https:\/\/localhost:8080<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"https:\/\/homepages.lcc-toulouse.fr\/colombet\/wp-content\/uploads\/sites\/2\/2022\/06\/console_h2_1.png\" alt=\"console_h2_1\" \/><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/homepages.lcc-toulouse.fr\/colombet\/wp-content\/uploads\/sites\/2\/2022\/06\/console_h2_2.png\" alt=\"console_h2_2\" \/><\/p>\n<h2>R\u00e9f\u00e9rences<\/h2>\n<ul>\n<li><a href=\"https:\/\/www.withsecure.com\/en\/support\/product-support\/business-suite\/client-security#download\">https:\/\/www.withsecure.com\/en\/support\/product-support\/business-suite\/client-security#download<\/a><\/li>\n<li><a href=\"https:\/\/community.f-secure.com\/business-suite-fr\/kb\/articles\/6399-how-to-replace-the-default-self-signed-policy-manager-certificate-with-a-trusted-certificate-authority-ca-created-certificate\">https:\/\/community.f-secure.com\/business-suite-fr\/kb\/articles\/6399-how-to-replace-the-default-self-signed-policy-manager-certificate-with-a-trusted-certificate-authority-ca-created-certificate<\/a><\/li>\n<li><a href=\"https:\/\/community.f-secure.com\/business-suite-en\/kb\/articles\/8933-resolving-connectivity-issues-between-client-security-for-mac-and-policy-manager\">https:\/\/community.f-secure.com\/business-suite-en\/kb\/articles\/8933-resolving-connectivity-issues-between-client-security-for-mac-and-policy-manager<\/a><\/li>\n<li><a href=\"https:\/\/community.f-secure.com\/business-suite-en\/kb\/articles\/8554-how-to-replace-default-self-signed-policy-manager-linux-certificate-with-trusted-ca-created-certificate\">https:\/\/community.f-secure.com\/business-suite-en\/kb\/articles\/8554-how-to-replace-default-self-signed-policy-manager-linux-certificate-with-trusted-ca-created-certificate<\/a><\/li>\n<li><a href=\"https:\/\/help.f-secure.com\/product.html?business\/policy-manager\/13.00\/en\/task_26D88E9EE0E947AAAC816053286A8B20-13.00-en\">https:\/\/help.f-secure.com\/product.html?business\/policy-manager\/13.00\/en\/task_26D88E9EE0E947AAAC816053286A8B20-13.00-en<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Policy Manager offre une mani\u00e8re modulable de g\u00e9rer la s\u00e9curit\u00e9 de plusieurs applications sur diff\u00e9rents syst\u00e8mes d&rsquo;exploitation, \u00e0 partir d&rsquo;un emplacement central. Policy Manager offre les fonctionnalit\u00e9s de d\u00e9finition\/distribution des strat\u00e9gies de s\u00e9curit\u00e9, d&rsquo;installation des applications et de surveillance des activit\u00e9s de tous les syst\u00e8mes dans l&rsquo;entreprise afin d&rsquo;assurer la conformit\u00e9 avec les strat\u00e9gies de [&hellip;]<\/p>\n","protected":false},"author":13,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[11],"tags":[56,92,20,89,2,91,90],"class_list":["post-603","post","type-post","status-publish","format-standard","hentry","category-linux","tag-antivirus","tag-console","tag-debian","tag-f-secure","tag-linux","tag-manager","tag-policy"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/paBEVZ-9J","jetpack_likes_enabled":false,"_links":{"self":[{"href":"https:\/\/homepages.lcc-toulouse.fr\/colombet\/wp-json\/wp\/v2\/posts\/603","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/homepages.lcc-toulouse.fr\/colombet\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/homepages.lcc-toulouse.fr\/colombet\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/homepages.lcc-toulouse.fr\/colombet\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/homepages.lcc-toulouse.fr\/colombet\/wp-json\/wp\/v2\/comments?post=603"}],"version-history":[{"count":9,"href":"https:\/\/homepages.lcc-toulouse.fr\/colombet\/wp-json\/wp\/v2\/posts\/603\/revisions"}],"predecessor-version":[{"id":633,"href":"https:\/\/homepages.lcc-toulouse.fr\/colombet\/wp-json\/wp\/v2\/posts\/603\/revisions\/633"}],"wp:attachment":[{"href":"https:\/\/homepages.lcc-toulouse.fr\/colombet\/wp-json\/wp\/v2\/media?parent=603"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/homepages.lcc-toulouse.fr\/colombet\/wp-json\/wp\/v2\/categories?post=603"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/homepages.lcc-toulouse.fr\/colombet\/wp-json\/wp\/v2\/tags?post=603"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}