Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Doomdon
Explorer
Jump to solution

local.scv don't work

Hi, please help me.

I am trying to perform a SCV check where I need a registry check. This is to distinguish Harmony VPN clients from regular EndpointSecurity VPN clients.

In the local.csv file, I have added this check:

: (RegMonitor
:type (plugin)
:parameters (
:string ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\CheckPoint\TRAC\client_sub_type=EndpointSecurity")
:begin_admin (admin)
                                :send_log (alert)
:mismatchmessage ("Access denied. You must use the Harmony Endpoint client.")
:end (admin)
)
)

 

I also tried different variations of writing the registry path and this is what tech support sent me

Снимок экрана 2024-03-05 185736.png

Policy Server is enabled, Desktop Security is added to policies, but no matter how hard I try I can't figure out what my error is.

The problem is that it's like scv is not being applied. and a normal client can still connect.

Thanks in advance for any ideas!

0 Kudos
1 Solution

Accepted Solutions
JanVC
Collaborator

have you checked if the local.scv file you edited on the MGMT server is being uploaded to the gateway?

can't remember the exact location anymore on the gateway so you'll need to do a "find / -name local.scv"

View solution in original post

(1)
9 Replies
JanVC
Collaborator

have you checked if the local.scv file you edited on the MGMT server is being uploaded to the gateway?

can't remember the exact location anymore on the gateway so you'll need to do a "find / -name local.scv"

(1)
Doomdon
Explorer

The changes are in the first file, which is the one that I've edited:

Снимок экрана 2024-03-05 220257.png

the change should be in everyone else?

I don't think I did it right. Are you talking about the mgmt server? So local.scv should have been edited there? I edited it directly to the gateway...😨

0 Kudos
Doomdon
Explorer

And here's the output from the mgmt server. Which one should be edited exactly, the first one?

С333333нимок экрана 2024-03-05 222213.png

0 Kudos
the_rock
Legend
Legend

Its the first one

 

[Expert@cpazuremgmt:0]# find / -name local.scv
/var/opt/CPsuite-R81.20/fw1/conf/local.scv
[Expert@cpazuremgmt:0]# cat /var/opt/CPsuite-R81.20/fw1/conf/local.scv
(SCVObject
:SCVNames (
: (user_policy_scv
:type (plugin)
:parameters (
)
)
: (BrowserMonitor
:type (plugin)
:parameters (
:browser_major_version (5)
:browser_minor_version (0)
:browser_version_operand (">=")
:browser_version_mismatchmassage ("Please upgrade your Internet browser.")
:intranet_download_signed_activex (disable)
:intranet_run_activex (disable)
:intranet_download_files (disable)
:intranet_java_permissions (disable)
:trusted_download_signed_activex (disable)
:trusted_run_activex (disable)
:trusted_download_files (disable)
:trusted_java_permissions (disable)
:internet_download_signed_activex (disable)
:internet_run_activex (disable)
:internet_download_files (disable)
:internet_java_permissions (disable)
:restricted_download_signed_activex (disable)
:restricted_run_activex (disable)
:restricted_download_files (disable)
:restricted_java_permissions (disable)
:send_log (alert)
:internet_options_mismatch_message ("Your Internet browser settings do not meet policy requirements\nPlease check the following settings:\n1. In your browser, go to Tools -> Internet Options -> Security.\n2. For each Web content zone, select custom level and disable the following items: DownLoad signed ActiveX, Run ActiveX Controls, Download Files and Java Permissions.")
)
)
: (OsMonitor
:type (plugin)
:parameters (
:os_version_mismatchmessage ("Please upgrade your operating system.")
:enforce_screen_saver_minutes_to_activate (3)
:screen_saver_mismatchmessage ("Your screen saver settings do not meet policy requirements\nPlease check the following settings:\n1. Right click on your desktop and select properties.\n2. Select the Screen Saver tab.\n3. Under Wait choose 3 minutes and check the Password Protection box.")
:send_log (alert)
:major_os_version_number_2k (5)
:minor_os_version_number_2k (0)
:os_version_operand_2k ("==")
:service_pack_major_version_number_2k (0)
:service_pack_minor_version_number_2k (0)
:service_pack_version_operand_2k (">=")
:major_os_version_number_xp (5)
:minor_os_version_number_xp (1)
:os_version_operand_xp ("==")
:service_pack_major_version_number_xp (0)
:service_pack_minor_version_number_xp (0)
:service_pack_version_operand_xp (">=")
:major_os_version_number_2003 (5)
:minor_os_version_number_2003 (2)
:os_version_operand_2003 ("==")
:service_pack_major_version_number_2003 (0)
:service_pack_minor_version_number_2003 (0)
:service_pack_version_operand_2003 (">=")
:major_os_version_number_7 (6)
:minor_os_version_number_7 (1)
:os_version_operand_7 ("==")
:service_pack_major_version_number_7 (0)
:service_pack_minor_version_number_7 (0)
:service_pack_version_operand_2003 (">=")
:major_os_version_number_8 (6)
:minor_os_version_number_8 (2)
:os_version_operand_8 ("==")
:service_pack_major_version_number_8 (0)
:service_pack_minor_version_number_8 (0)
:service_pack_version_operand_8 (">=")
:major_os_version_number_81 (6)
:minor_os_version_number_81 (3)
:os_version_operand_8 ("==")
:service_pack_major_version_number_81 (0)
:service_pack_minor_version_number_81 (0)
:service_pack_version_operand_81 (">=")
:major_os_version_number_10 (10)
:minor_os_version_number_10 (0)
:os_version_operand_10 ("==")
:service_pack_major_version_number_10 (0)
:service_pack_minor_version_number_10 (0)
:service_pack_version_operand_10 (">=")
:major_os_version_number_11 (10)
:minor_os_version_number_11 (0)
:os_version_operand_11 ("==")
)
)
: (ProcessMonitor
:type (plugin)
:parameters (
:begin_or (or1)
:AntiVirus1.exe (true)
:AntiVirus2.exe (true)
:end (or1)
:IntrusionMonitor.exe (true)
:ShareMyFiles.exe (false)
:begin_admin (admin)
:send_log (alert)
:mismatchmessage ("Please check that the following processes are running:\n1. AntiVirus1.exe or AntiVirus2.exe\n2. IntrusionMonitor.exe\n\nPlease check that the following process is not running\n1. ShareMyFiles.exe")
:end (admin)
)
)
: (groupmonitor
:type (plugin)
:parameters (
:begin_or (or1)
:begin_and (1)
:"builtin\administrator" (false)
:"BUILTIN\Users" (true)
:end (1)
:begin_and (2)
:"builtin\administrator" (true)
:"BUILTIN\Users" (false)
:end (and2)
:end (or1)
:begin_admin (admin)
:send_log (alert)
:mismatchmessage ("You are using SecureClient with a non-authorized user.\nMake sure you are logged on as an authorized user.")
:securely_configured_no_active_user (false)
:end (admin)
)
)
: (HotFixMonitor
:type (plugin)
:parameters (
:147222 (true)
:begin_admin (admin)
:send_log (alert)
:mismatchmessage ("Please install security patch Q147222.")
:end (admin)
)
)
: (AntiVirusMonitor
:type (plugin)
:parameters (
:type ("Norton")
:Signature (">=20020819")
:begin_admin (admin)
:send_log (alert)
:mismatchmessage ("Please update your AntiVirus (use the LiveUpdate option).")
:end (admin)
)
)
: (HWMonitor
:type (plugin)
:parameters (
:cputype ("GenuineIntel")
:cpumodel ("9")
:cpufamily ("6")
:begin_admin (admin)
:send_log (alert)
:mismatchmessage ("Your machine must have an\nIntel(R) Centrino(TM) processor installed.")
:end (admin)
)
)
: (ScriptRun
:type (plugin)
:parameters (
:exe ("VerifyScript.bat")
:begin_admin (admin)
:send_log (alert)
:mismatchmessage ("Verification script has determined that your configuration does not meet policy requirements.")
:end (admin)
)
)
: (RegMonitor
:type (plugin)
:parameters (
:value ("Software\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\PatternVer>=414")
:begin_admin (admin)
:send_log (alert)
:mismatchmessage ("Please update your AntiVirus (use the LiveUpdate option).")
:end (admin)
)
)
: (SCVMonitor
:type (plugin)
:parameters (
:scv_version ("54014")
:begin_admin (admin)
:send_log (alert)
:mismatchmessage ("Please upgrade your Secure Configuration Verification products package.")
:end (admin)
)
)
: (sc_ver_scv
:type (plugin)
:parameters (
:Default_SecureClientBuildNumber (52032)
:Default_EnforceBuildOperand ("==")
:MismatchMessage ("Please upgrade your SecureClient.")
:EnforceBuild_9X_Operand (">=")
:SecureClient_9X_BuildNumber (52030)
:EnforceBuild_NT_Operand ("==")
:SecureClient_NT_BuildNumber (52032)
:EnforceBuild_2K_Operand (">=")
:SecureClient_2K_BuildNumber (52032)
:EnforceBuild_XP_Operand (">=")
:SecureClient_XP_BuildNumber (52032)
)
)
)
:SCVPolicy (
)
:SCVGlobalParams (
:enable_status_notifications (false)
:status_notifications_timeout (10)
:disconnect_when_not_verified (false)
:block_connections_on_unverified (false)
:scv_policy_timeout_hours (168)
:enforce_ip_forwarding (false)
:not_verified_script ("")
:not_verified_script_run_show (false)
:not_verified_script_run_admin (false)
:not_verified_script_run_always (false)
:allow_non_scv_clients (false)
:skip_firewall_enforcement_check (false)
)
)
[Expert@cpazuremgmt:0]#

JanVC
Collaborator

correct the first one should be edited

take a look at https://support.checkpoint.com/results/sk/sk38702 it describes what to configure in order to use local.scv
try to go through each step and see if you configured it on your side

0 Kudos
Doomdon
Explorer

Can you also suggest what is the logic behind the scv operation. I have achieved that when connecting via vpn, a warning about a compliance violation pops up, but the connection is still made. Did I understand correctly from the guide that in order to block the VPN connection I need to set :disconnect_when_not_verified (false) in scv ?

Снимок экрана 2024-03-07 160250.png

 

 

0 Kudos
Doomdon
Explorer

That is, having the "Block client's connection" checkbox checked is not enough ? Снимок экрана 2024-03-07 16064вввв4.png

0 Kudos
JanVC
Collaborator

it should disconnect you after 10-15 seconds

Doomdon
Explorer

For some reason, the connection is not dropping. There is a RemoateAccess community in the rules. Do you know what else could be the reason?

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events