local.scv don't work

Doomdon — Tue, 05 Mar 2024 18:17:23 GMT

Hi, please help me.

I am trying to perform a SCV check where I need a registry check. This is to distinguish Harmony VPN clients from regular EndpointSecurity VPN clients.

In the local.csv file, I have added this check:

: (RegMonitor

:type (plugin)

:parameters (

:string ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\CheckPoint\TRAC\client_sub_type=EndpointSecurity")

:begin_admin (admin)

:send_log (alert)

:mismatchmessage ("Access denied. You must use the Harmony Endpoint client.")

:end (admin)

)

I also tried different variations of writing the registry path and this is what tech support sent me

Policy Server is enabled, Desktop Security is added to policies, but no matter how hard I try I can't figure out what my error is.

The problem is that it's like scv is not being applied. and a normal client can still connect.

Thanks in advance for any ideas!

Re: local.scv don't work

JanVC — Tue, 05 Mar 2024 18:35:42 GMT

have you checked if the local.scv file you edited on the MGMT server is being uploaded to the gateway?

can't remember the exact location anymore on the gateway so you'll need to do a "find / -name local.scv"

Re: local.scv don't work

Doomdon — Tue, 05 Mar 2024 19:14:37 GMT

The changes are in the first file, which is the one that I've edited:

the change should be in everyone else?

I don't think I did it right. Are you talking about the mgmt server? So local.scv should have been edited there? I edited it directly to the gateway...😨

Re: local.scv don't work

Doomdon — Tue, 05 Mar 2024 19:28:43 GMT

And here's the output from the mgmt server. Which one should be edited exactly, the first one?

Re: local.scv don't work

the_rock — Tue, 05 Mar 2024 20:08:00 GMT

Its the first one

[Expert@cpazuremgmt:0]# find / -name local.scv
/var/opt/CPsuite-R81.20/fw1/conf/local.scv
[Expert@cpazuremgmt:0]# cat /var/opt/CPsuite-R81.20/fw1/conf/local.scv
(SCVObject
:SCVNames (
: (user_policy_scv
:type (plugin)
:parameters (
)
)
: (BrowserMonitor
:type (plugin)
:parameters (
:browser_major_version (5)
:browser_minor_version (0)
:browser_version_operand (">=")
:browser_version_mismatchmassage ("Please upgrade your Internet browser.")
:intranet_download_signed_activex (disable)
:intranet_run_activex (disable)
:intranet_download_files (disable)
:intranet_java_permissions (disable)
:trusted_download_signed_activex (disable)
:trusted_run_activex (disable)
:trusted_download_files (disable)
:trusted_java_permissions (disable)
:internet_download_signed_activex (disable)
:internet_run_activex (disable)
:internet_download_files (disable)
:internet_java_permissions (disable)
:restricted_download_signed_activex (disable)
:restricted_run_activex (disable)
:restricted_download_files (disable)
:restricted_java_permissions (disable)
:send_log (alert)
:internet_options_mismatch_message ("Your Internet browser settings do not meet policy requirements\nPlease check the following settings:\n1. In your browser, go to Tools -> Internet Options -> Security.\n2. For each Web content zone, select custom level and disable the following items: DownLoad signed ActiveX, Run ActiveX Controls, Download Files and Java Permissions.")
)
)
: (OsMonitor
:type (plugin)
:parameters (
:os_version_mismatchmessage ("Please upgrade your operating system.")
:enforce_screen_saver_minutes_to_activate (3)
:screen_saver_mismatchmessage ("Your screen saver settings do not meet policy requirements\nPlease check the following settings:\n1. Right click on your desktop and select properties.\n2. Select the Screen Saver tab.\n3. Under Wait choose 3 minutes and check the Password Protection box.")
:send_log (alert)
:major_os_version_number_2k (5)
:minor_os_version_number_2k (0)
:os_version_operand_2k ("==")
:service_pack_major_version_number_2k (0)
:service_pack_minor_version_number_2k (0)
:service_pack_version_operand_2k (">=")
:major_os_version_number_xp (5)
:minor_os_version_number_xp (1)
:os_version_operand_xp ("==")
:service_pack_major_version_number_xp (0)
:service_pack_minor_version_number_xp (0)
:service_pack_version_operand_xp (">=")
:major_os_version_number_2003 (5)
:minor_os_version_number_2003 (2)
:os_version_operand_2003 ("==")
:service_pack_major_version_number_2003 (0)
:service_pack_minor_version_number_2003 (0)
:service_pack_version_operand_2003 (">=")
:major_os_version_number_7 (6)
:minor_os_version_number_7 (1)
:os_version_operand_7 ("==")
:service_pack_major_version_number_7 (0)
:service_pack_minor_version_number_7 (0)
:service_pack_version_operand_2003 (">=")
:major_os_version_number_8 (6)
:minor_os_version_number_8 (2)
:os_version_operand_8 ("==")
:service_pack_major_version_number_8 (0)
:service_pack_minor_version_number_8 (0)
:service_pack_version_operand_8 (">=")
:major_os_version_number_81 (6)
:minor_os_version_number_81 (3)
:os_version_operand_8 ("==")
:service_pack_major_version_number_81 (0)
:service_pack_minor_version_number_81 (0)
:service_pack_version_operand_81 (">=")
:major_os_version_number_10 (10)
:minor_os_version_number_10 (0)
:os_version_operand_10 ("==")
:service_pack_major_version_number_10 (0)
:service_pack_minor_version_number_10 (0)
:service_pack_version_operand_10 (">=")
:major_os_version_number_11 (10)
:minor_os_version_number_11 (0)
:os_version_operand_11 ("==")
)
)
: (ProcessMonitor
:type (plugin)
:parameters (
:begin_or (or1)
:AntiVirus1.exe (true)
:AntiVirus2.exe (true)
:end (or1)
:IntrusionMonitor.exe (true)
:ShareMyFiles.exe (false)
:begin_admin (admin)
:send_log (alert)
:mismatchmessage ("Please check that the following processes are running:\n1. AntiVirus1.exe or AntiVirus2.exe\n2. IntrusionMonitor.exe\n\nPlease check that the following process is not running\n1. ShareMyFiles.exe")
:end (admin)
)
)
: (groupmonitor
:type (plugin)
:parameters (
:begin_or (or1)
:begin_and (1)
:"builtin\administrator" (false)
:"BUILTIN\Users" (true)
:end (1)
:begin_and (2)
:"builtin\administrator" (true)
:"BUILTIN\Users" (false)
:end (and2)
:end (or1)
:begin_admin (admin)
:send_log (alert)
:mismatchmessage ("You are using SecureClient with a non-authorized user.\nMake sure you are logged on as an authorized user.")
:securely_configured_no_active_user (false)
:end (admin)
)
)
: (HotFixMonitor
:type (plugin)
:parameters (
:147222 (true)
:begin_admin (admin)
:send_log (alert)
:mismatchmessage ("Please install security patch Q147222.")
:end (admin)
)
)
: (AntiVirusMonitor
:type (plugin)
:parameters (
:type ("Norton")
:Signature (">=20020819")
:begin_admin (admin)
:send_log (alert)
:mismatchmessage ("Please update your AntiVirus (use the LiveUpdate option).")
:end (admin)
)
)
: (HWMonitor
:type (plugin)
:parameters (
:cputype ("GenuineIntel")
:cpumodel ("9")
:cpufamily ("6")
:begin_admin (admin)
:send_log (alert)
:mismatchmessage ("Your machine must have an\nIntel(R) Centrino(TM) processor installed.")
:end (admin)
)
)
: (ScriptRun
:type (plugin)
:parameters (
:exe ("VerifyScript.bat")
:begin_admin (admin)
:send_log (alert)
:mismatchmessage ("Verification script has determined that your configuration does not meet policy requirements.")
:end (admin)
)
)
: (RegMonitor
:type (plugin)
:parameters (
:value ("Software\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\PatternVer>=414")
:begin_admin (admin)
:send_log (alert)
:mismatchmessage ("Please update your AntiVirus (use the LiveUpdate option).")
:end (admin)
)
)
: (SCVMonitor
:type (plugin)
:parameters (
:scv_version ("54014")
:begin_admin (admin)
:send_log (alert)
:mismatchmessage ("Please upgrade your Secure Configuration Verification products package.")
:end (admin)
)
)
: (sc_ver_scv
:type (plugin)
:parameters (
:Default_SecureClientBuildNumber (52032)
:Default_EnforceBuildOperand ("==")
:MismatchMessage ("Please upgrade your SecureClient.")
:EnforceBuild_9X_Operand (">=")
:SecureClient_9X_BuildNumber (52030)
:EnforceBuild_NT_Operand ("==")
:SecureClient_NT_BuildNumber (52032)
:EnforceBuild_2K_Operand (">=")
:SecureClient_2K_BuildNumber (52032)
:EnforceBuild_XP_Operand (">=")
:SecureClient_XP_BuildNumber (52032)
)
)
)
:SCVPolicy (
)
:SCVGlobalParams (
:enable_status_notifications (false)
:status_notifications_timeout (10)
:disconnect_when_not_verified (false)
:block_connections_on_unverified (false)
:scv_policy_timeout_hours (168)
:enforce_ip_forwarding (false)
:not_verified_script ("")
:not_verified_script_run_show (false)
:not_verified_script_run_admin (false)
:not_verified_script_run_always (false)
:allow_non_scv_clients (false)
:skip_firewall_enforcement_check (false)
)
)
[Expert@cpazuremgmt:0]#

Re: local.scv don't work

JanVC — Wed, 06 Mar 2024 06:53:44 GMT

correct the first one should be edited

take a look at https://support.checkpoint.com/results/sk/sk38702 it describes what to configure in order to use local.scv
try to go through each step and see if you configured it on your side

Re: local.scv don't work

Doomdon — Thu, 07 Mar 2024 13:13:36 GMT

Can you also suggest what is the logic behind the scv operation. I have achieved that when connecting via vpn, a warning about a compliance violation pops up, but the connection is still made. Did I understand correctly from the guide that in order to block the VPN connection I need to set :disconnect_when_not_verified (false) in scv ?

Re: local.scv don't work

Doomdon — Thu, 07 Mar 2024 13:16:46 GMT

That is, having the "Block client's connection" checkbox checked is not enough ?

Re: local.scv don't work

JanVC — Thu, 07 Mar 2024 13:17:48 GMT

it should disconnect you after 10-15 seconds

Re: local.scv don't work

Doomdon — Thu, 07 Mar 2024 13:34:15 GMT

For some reason, the connection is not dropping. There is a RemoateAccess community in the rules. Do you know what else could be the reason?

topic local.scv don't work in SASE and Remote Access

local.scv don't work

Re: local.scv don't work

Re: local.scv don't work

Re: local.scv don't work

Re: local.scv don't work

Re: local.scv don't work

Re: local.scv don't work

Re: local.scv don't work

Re: local.scv don't work

Re: local.scv don't work