RC version 3.1 of the new on-premise Avast Business Management Console

MartinSvoboda · 2017-09-04T11:45:05.000Z

jjsets post:7:

Sorry to bring up this issue again, but as I posted it on Friday on the now outdated 2.30 beta thread, I want to repeat it:
There seems to be no way to replace the certificate which is used during installation. The only way would be uninstalling and reinstalling Avast Business Management Console - where I would lose the installed clients and their settings.
The RC1 is a good step forward, but this is an important feature missing, I guess.

Update: Also I notice, when installing the Avast client on the same machine as the Avast Business Management Console, the console isn’t accessable after a machine reboot. Disabling the Avast client firewall does only help when I do it fast enough, in the first minute after rebooting or so. This may be random though, as sometimes access is possible, sometimes not.

From your point of view - is this problem general (for you) or would this exists only when making a transition from old avast product to the new one?

jjsets · 2017-09-04T13:09:07.000Z

From my perspective the certificate replacement is a general issue.
SSL certificates usually have a run time from a year or less nowerdays for security reasons. When I install a Management Console for example on a windows server which is reachable from the net to provide administration for branch offices for example, it will be best practice to regularly replace the SSL certificate.
This may be necessary for other security reasons as well, just remember the heartbleed disaster. https://en.wikipedia.org/wiki/Heartbleed

Many people will use free certificates like those from let’s encrypt https://letsencrypt.org/
Those will be replaced every three months.

Edit: Spelling …

InfratechSolutions · 2017-09-04T16:01:35.000Z

IMHO, the most important feature in a report is that you can share the information with other people, so you need to export the report to a PDF or other format to send by email, print or whatever.

We cannot export the report web page!

InfratechSolutions · 2017-09-04T16:07:59.000Z

SSL certificate is a general issue. Small and Medium Business have not got their own certificate and if you have to add the cost of the Avast licenses to the cost of a certificate…
The procedure to add/remove/modify the certificate must be simple and it has no sense to install the console with the “default” certificate and have a security alert in your browser every time you want to access to your antivirus console, it’s crazy!

In a Small and Medium Business the traffic between the server and the browser is in your LAN and it’s not necessary to be HTTPS

system · 2017-09-04T17:46:52.000Z

Martin Svoboda post:6:

Asyn post:2:

Martin Svoboda post:1:

Hello everyone, it’s Friday, it’s the time when some starts thinking what to do on weekend. Well, we were thinking how to help you even with this and especially if the rainy weekend is ahead of you, you might be willing to take a look at the release candidate of the new on-premise console (cloud version will have the same features).
The long ride is almost over, the package is almost done, but not our passion, we already start working on new improvements that will push your satisfaction with our products to another level

Wow Martin, didn’t know that you’re into poetry…

Me neither. I just do not like to be boring, that’s all

Asyn post:4:

Christian363 post:3:

Is this a replacement for the SOA Console

and can it be used with SOA Licenses ?

Yep.

Guess so, but wait for Martin.

Yes

No. There will be a controlled way (from a customer point of view) how to “migrate” from the SOA/EA to the new Console. Which will include also the migration of your license. [work in progress]

Ok that souds good - at what timeframe do you roughly expect the final release ?

rg
Christian

Asyn · 2017-09-05T06:56:07.000Z

Christian363 post:12:

…at what timeframe do you roughly expect the final release ?

Hi, see: https://forum.avast.com/index.php?topic=206171.msg1411067#msg1411067

misak · 2017-09-05T06:56:55.000Z

Infratech Solutions post:10:

We cannot export the report web page!

You can “print” the report page to the PDF document. Google Chrome has built in PDF printer. Definitely, we can do a better job. Notes taken…

jjsets · 2017-09-05T10:45:28.000Z

I can reproduce following behaviour:

Windows 10 Pro x64, 1703 version. Current Avast Business Management Console, Antivirus Pro Plus test license. Installed the Agent on the very same machine.

If I disable the firewall of the client too late, the Web Front End is not reachable, connection refused. When I disable the firewall early enough, the interface is reachable. I can only log-in with Firefox or Chrome. Edge/Internet Explorer will work for the first account setup, but log-in always returns to the login web site with the Microsoft web browsers.

When the firewall is disabled, the Avast client will crash after a few minutes. It shows

https://www2.pic-upload.de/thumb/33867716/2017-09-04-Avast_ist_ausgefallen.png

… something along the lines “Avast has failed” in german. It offers to restart the service, which will show green light for a few seconds, but then fail again.
Update 13:20h The client seems to crash reliably even without disabling the firewall!
Program version: 17.6.2525 (build 17.6.3625.0)
VIrus DB: 140904-2

Please let me know if and how I can help gathering data for debugging or help tracking down the issue.

JanSuchan · 2017-09-05T10:57:06.000Z

Hi jjsets,

jjsets post:7:

Sorry to bring up this issue again, but as I posted it on Friday on the now outdated 2.30 beta thread, I want to repeat it:
There seems to be no way to replace the certificate which is used during installation. The only way would be uninstalling and reinstalling Avast Business Management Console - where I would lose the installed clients and their settings.

Although we don’t provide any tool (yet) to change a certificate, you can do it manually. The path to the certificate as well as the password are saved in C:\Program Files\AVAST Software\Management Console\console\config\application-user-config.yml and you can change them anytime. The console just has to be restarted after that. Look at “keyStorePath” and keep in mind that ${local.securityResources} points to ${local.homeDirectory}\certificates (C:\Program Files\AVAST Software\Management Console\console\certificates by default). It’s a bit complicated, we will simplify it in the next version.

jjsets post:7:

Update: Also I notice, when installing the Avast client on the same machine as the Avast Business Management Console, the console isn’t accessable after a machine reboot. Disabling the Avast client firewall does only help when I do it fast enough, in the first minute after rebooting or so. This may be random though, as sometimes access is possible, sometimes not.

Thanks for bringing this up. We are already aware of the issue and it is being actively investigated.

Thanks,
Jan

LiborAmbruz · 2017-09-05T12:05:42.000Z

Hi jjsets,

If I disable the firewall of the client too late, the Web Front End is not reachable, connection refused. When I disable the firewall early enough, the interface is reachable.

This is the issue we are aware of. Please turn off the firewall, go to the corresponding Settings in the console and enable rule named “Avast MC PostgresSQL” in Rules \ Advanced packet rules in Firewall customize section of settings by clicking the corresponding checkbox. Turn on the Firewall, try to restart your pc and it should already work properly.

We prepared this rule for this purpose, but we don’t allow it automatically as it isn’t necessary for all the computers. Ideally create a special settings only for this pc, because it isn’t necessary to open this port on all your computers.

I can only log-in with Firefox or Chrome. Edge/Internet Explorer will work for the first account setup, but log-in always returns to the login web site with the Microsoft web browsers.

There is a problem with cookies in IE and Edge when you are accessing page using only hostname. It is needed access console using FQDN (Fully qualified domain name - https://en.wikipedia.org/wiki/Fully_qualified_domain_name).

For example FQDN is KOVACIA.int.avast.com and in IE and Edge does not work accessing console using only KOVACIA.

When the firewall is disabled, the Avast client will crash after a few minutes. It shows...

This is an issue which should be fixed by prepared update today or tomorrow.

Please write us back if you need more information and thank you for information, we really appreciate it.

Thanks,
Libor

MartinSvoboda · 2017-09-05T13:53:56.000Z

Christian363 post:12:

Martin Svoboda post:6:

Asyn post:2:

Martin Svoboda post:1:

Hello everyone, it’s Friday, it’s the time when some starts thinking what to do on weekend. Well, we were thinking how to help you even with this and especially if the rainy weekend is ahead of you, you might be willing to take a look at the release candidate of the new on-premise console (cloud version will have the same features).
The long ride is almost over, the package is almost done, but not our passion, we already start working on new improvements that will push your satisfaction with our products to another level

Wow Martin, didn’t know that you’re into poetry…

Me neither. I just do not like to be boring, that’s all

Asyn post:4:

Christian363 post:3:

Is this a replacement for the SOA Console

and can it be used with SOA Licenses ?

Yep.

Guess so, but wait for Martin.

Yes

No. There will be a controlled way (from a customer point of view) how to “migrate” from the SOA/EA to the new Console. Which will include also the migration of your license. [work in progress]

Ok that souds good - at what timeframe do you roughly expect the final release ?

rg
Christian

I can’t tell, although it’s hard to keep the secret “inside”, but I’ll try to come up with better answer tomorrow.

InfratechSolutions · 2017-09-05T14:26:08.000Z

We prepared this rule for this purpose, but we don't allow it automatically as it isn't necessary for all the computers. Ideally create a special settings only for this pc, because it isn't necessary to open this port on all your computers. Ideally create a special settings only for this pc, because it isn't necessary to open this port on all your computers.

So, this must be done “by default” during the installation or create a rule only to give access to the IP address of the console machine.

system · 2017-09-05T16:13:20.000Z

jjsets post:15:

I can reproduce following behaviour:

Windows 10 Pro x64, 1703 version. Current Avast Business Management Console, Antivirus Pro Plus test license. Installed the Agent on the very same machine.

If I disable the firewall of the client too late, the Web Front End is not reachable, connection refused. When I disable the firewall early enough, the interface is reachable. I can only log-in with Firefox or Chrome. Edge/Internet Explorer will work for the first account setup, but log-in always returns to the login web site with the Microsoft web browsers.

When the firewall is disabled, the Avast client will crash after a few minutes. It shows

https://www2.pic-upload.de/thumb/33867716/2017-09-04-Avast_ist_ausgefallen.png

… something along the lines “Avast has failed” in german. It offers to restart the service, which will show green light for a few seconds, but then fail again.
Update 13:20h The client seems to crash reliably even without disabling the firewall!
Program version: 17.6.2525 (build 17.6.3625.0)
VIrus DB: 140904-2

Please let me know if and how I can help gathering data for debugging or help tracking down the issue.

same here after the last update the service under windows 10 fails every few minutes
rg
Christian

jjsets · 2017-09-06T11:19:10.000Z

Another observation: I can install and then choose additonal languages only on the Antivirus client. (N.b.: the list shows the entries sorted by the english language names, but shows the language names translated. Thus german ends up behind french [“Deutsch” after “Französisch” in the list] this is irritating). I don’t find something like language selection in Avast Business Management Console which would control the language used in the GUI by the AV clients.

LiborAmbruz · 2017-09-06T11:35:10.000Z

Hi Infratech Solutions,

Infratech Solutions post:19:

We prepared this rule for this purpose, but we don't allow it automatically as it isn't necessary for all the computers. Ideally create a special settings only for this pc, because it isn't necessary to open this port on all your computers. Ideally create a special settings only for this pc, because it isn't necessary to open this port on all your computers.

So, this must be done “by default” during the installation or create a rule only to give access to the IP address of the console machine.

As I mentioned in my former comment, we didn’t enable it due to security reasons. Wouldn’t you consider it as a security hole that this port would be enabled on all the computers in your network if you don’t create a special policy for them?

InfratechSolutions · 2017-09-06T11:42:29.000Z

Yes, I agree. This is the reason of “…or create a rule only to give access to the IP address of the console machine.”

By default, the console must be accesible without any configuration of the final user/customer.

jjsets · 2017-09-06T12:32:06.000Z

+1 for Infratech Solutions on that matter. At least “localhost” and local IP should be allowed to access Avast BMC by default.

InfratechSolutions · 2017-09-07T09:04:15.000Z

Date format is always MM/DD/YY even if you choose a different language/country from english (spanish in my case) where date format must be DD/MM/YY.

This was communicated in BETA 2.28 (see picture), not fixed.

system · 2017-09-07T23:08:39.000Z

Infratech Solutions post:25:

Date format is always MM/DD/YY even if you choose a different language/country from english (spanish in my case) where date format must be DD/MM/YY.

This was communicated in BETA 2.28 (see picture), not fixed.

This should be default. Most places in the world use DD/MM/YY format. Please make this change

jjsets · 2017-09-08T12:21:13.000Z

Trying SecureLine VPN: It doesn’t work. I can change the server location and the other settings to autostart the connection, but nothing helps. When I press the “Connect”-button (I use the german GUI so this might be called differently in reality), another task without window opens and closes. But no secured connection is available then. We can reproduce this behaviour on two different (virtual) machines.

Announcements