About aparashar1

jyadav · ‎Aug 20, 2021

Hi @shuyuanjianke , You can check the below things and raise a case with us if it doesn't help . 1.Make sure hostname resolution is in place as your use case seems to be working fine with the IP address. 2.The firewall should be allowing this hostname/ IP address to enter for further communication. 3.Make sure the ports on which Lmgrdand VD are configured( as per the license file) are up and listening and are not restricted by the firewall in anyway. 4.With the help of your network team you can also analyze the wire shark logs to check the traffic inflow and where exactly the blockage is happening.

peterdemeyer · ‎Jul 01, 2021

Hi Srinivas, I have the same issue as you described. Did you ever find out what caused this? Best regards, Peter

PierreMarqt · ‎May 19, 2021

From FNP 2021 R2 (11.18.1) Release Notes (page 8): Application Hardening on Windows Researchers identified an elevated privilege issue related to the FlexNet Licensing Service, an optional FlexNet Publisher component used with trusted storage. It only impacts systems running on Windows. Originally, the vulnerability and its report utilized a vector that had been mitigated through a change in the Microsoft Windows operating systems. However, we received further updates from the reporter in 2021 to indicate existence of more vectors and thus exposing the vulnerability. This release contains a application hardening against this vulnerability by adding code to check for the existence of a symbolic link on the C:\ProgramData\FLEXnet. Detection of a symbolic link on these folder or files in this situation results in a system error code "19885" from the FNP API such as Activation APIs and Activation utilities. When the system error "19885" occurs you are advised to check and remove the symbolic link if exist and continue using the product. (FNP-24995)

aparashar1 · ‎Mar 25, 2021

As part of normal operation, Flexnet Publisher may create and delete folders under /dev/shm with names beginning 'FlexNetFs.'. These folders are associated with the implementation of the new secure file anchoring functionality on Linux. They are not designed to be accessed other than by Flexnet Publisher, consequently, errors as below may be reported when trying to list such a folder are to be expected: ls /dev/shm/ -al ls: cannot access /dev/shm/FlexNetFs.43054: Transport endpoint is not connected total 99 drwxrwxrwt 3 root root 120 Mar 14 12:10 . drwxr-xr-x 18 root root 3760 Mar 14 11:10 .. d????????? ? ? ? ? ? FlexNetFs.76491 So, it is suggested to customers to configure their monitoring tool (if any) to ignore any folders matching the name "/dev/shm/FlexNetFs.*"

aparashar1 · ‎Mar 23, 2021

@llacer , May i request you to advise ' Xilinx' to raise a support cas with us? Because we would need to confirm n multiple details that only 'Xilinx ' can answer, like: - FNP toolkit version on server and client in use. - Has there been any implementational enhancement? - What's the business use case i.e. if Trusted activation or borrow is involved? It would be helpful if ' Xilinx' can replicate such behavior in house and then get in touch with Revenera Support for further assistance.

aparashar1 · ‎Mar 23, 2021

@venu_gopal , can you confirm the error code being observed for standalone (I am guessing unserved licenses)? Also, what's the VENDOR license search path set there (lmpath.exe -status)?

aparashar1 · ‎Mar 11, 2021

Observation: When starting the server with the command /opt/FNPLicenseServerManager/lmadmin, the below occurred ./lmadmin: error while loading shared libraries: libldap-2.4.so.2: wrong ELF class: ELFCLASS64 However, in the path /opt/lib64/, libldap-2.4.so.2 does exist Root Cause: The error log "libldap-2.4.so.2: wrong ELF class: ELFCLASS64" indicates that the "ldap" libraries installed in system are for 64 bit but for v11.14.0 there was no 64-bit lmadmin available (it was only released starting FNP-11.15.1). So, try by installing the 32 bit variant of libldap and test.

aparashar1 · ‎Mar 11, 2021

At couple of customer sites, internal technical audit tools are complaining about the world-level read/write access to /dev/shm/.flexnetFS file system. The ask is if that's necessary and can not be avoided? Report: SoC ID: 3.65-9/2.0 No world writable files may exist. World writable files are files that can be accessed by all users of a system. Such files must be identified and the rights of the corresponding files must be adjusted to an adequate level. Motivation: Data in world writable files can be read, changed and possibly compromised by any user of a system. The following threats are relevant to this requirement: Unauthorized viewing or access to data Unauthorized modification of data command to check: find / -type f ! -path "/proc/" ! -path "/sys/" ( -perm -o+w ) -exec ls -adl {} \; rw-rw-rw. 1 nuance nuance 0 Feb 24 11:26 /dev/shm/.flexnetfs Please check the access rights of this file and if this can be subject of change to meet the requirements. Answer: /dev/shm/.flexnetFS is a lock-file located in transitory shared memory. It is used in the initialization and maintenance of the FlexNet file-system. Any Flexnet-enabled process, owned by any user, could potentially access or recreate this lock-file. Typically it contains no content but would not be affected even if the content were added. If deleted, it will simply be regenerated by the next Flexnet-enabled process that tries to access it. For that reason, it is required to have full-world access and poses no security risk. Also, it is important to note that FNP is having its own bespoke security protocols that do not rely on the host operating-system's native user privileges/file permissions.

aparashar1 · ‎Mar 07, 2021

@jbforster , you can contact the Revenera sales. You can either fill in your contact info here: https://www.revenera.com/about-us/contact-us.html or call 1.800.374.4353.

jbforster · ‎Mar 07, 2021

This stuff always confused me. Thanks for reiterating.

MikeSpragg · ‎Mar 07, 2021

Thanks, but that's not it - as the dongle itself isn't recognised by Windows (am I in wrong group) - so no amount of code will detect it (although I do see what you mean - our application does see/use the dongle as per) but this is more of a physical thing. I've seen several occasions where the dongle does not show in Windows Device Manager - as Sentinel HL Key (the Sentinel HASP and Sentinel USB keys are shown).

aparashar1 · ‎Mar 07, 2021

@jjardine It is not enough clear for me, where we set this attribute LM_A_PROMPT_FOR_FILE ? [Abhay]: This attribute is set through the client application, which performs the license checkout. The recommendation is to have an environment variable "VENDOR_LICENSE_FILE" (replace VENDOR keyword with your native vendor daemon name) to port@host configuration. Where port is the TCP port at which license server is running and 'host' could be hostname/IP address of server system.

aparashar1 · ‎Mar 07, 2021

@nxf54812 , yes we can disable this flag (which is set to TRUE by default) under machind/lsvendor.c file. Set, 'ls_client_removal_on_reread' to "0" and rebuild your vendor daemon application. Kindly be advised that post making this attribute as "0", you may observe few potential additional usages of license scenario, which is expected. Hope this helps.

aparashar1 · ‎Mar 04, 2021

@bsivakumar , this particular enhancement has been provided in FNP-11.17.2. This KB should help understand the details about this implementation: https://community.flexera.com/t5/FlexNet-Publisher-Knowledge-Base/Debug-log-Automatic-rollover-starting-FNP-11-17-2-explained-101/ta-p/180474 You would need to upgrade the lmgrd and vendor daemon to avail this feature.

aparashar1 · ‎Mar 02, 2021

Problem Statement: During the FNP-11.13.0 release timeline, it was noticed that RHEL 6.4 doesn't have any inbuilt support for 32 bit. So, as conventionally lmadmin was always a 32 bit executable, hence for lmadmin to run, we need to install the 32 bit rpm "redhat-lsb-core-4.0-7.el6.i686". which could lead to issues on the production server since it might conflict with other applications they have. FNP-11.15.1 : 64-bit lmadmin was provided to overcome this issue. Release Note Statement: The FlexNet Publisher Licensing Toolkit supplies a 32-bit lmadmin installer that can be used for 32- and 64-bit platforms. For 64-bit Linux, the toolkit provides a specific 64-bit lmadmin installer. FNP-11.16.0 Support for 64-bit lmadmin was added for other platforms. Release Note Statement: Previously, FlexNet Publisher 64-bit toolkits contained 32-bit lmadmin binaries which were supported on 64-bit platforms. FlexNet Publisher 64-bit toolkits now include only 64-bit lmadmin binaries. While the 32-bit lmadmin binaries (contained in the relevant 32-bit toolkits or separately available) continue to be supported on 64-bit systems, Flexera recommends using the 64-bit lmadmin binaries on 64-bit systems. (FNP-18383, FNP-17125; Salesforce case 01270591)

Online Status	Offline
Date Last Visited	‎Mar 25, 2021 08:03 AM

Re: License server machine is down or not responding. (-96,7:11001 "WinSock: Host not found (HOST_NO...

Re: lmutil taking 20 sec time to fetch the dongle ID

Re: Elevated Privilege Issue with FlexNet Publisher Licensing Service on Windows

What are the FlexnetFS files created under /dev/shm?

Re: Missing checked out licenses in license server log for Xilinx software

Re: Checkout failure on VPN

wrong ELF class: ELFCLASS64

Why /dev/shm folder structure has world write access?

Re: Is support account needed for downloading security fixes

Re: License Timeout Not Working As Client Not Seen As Idle

Re: Sentinel HL Key is not found in Device Manager post-windows upgrade

Re: FNP 11.14.0.2 used with VPN (Zscaler Private Access) failed due to ICMP/Ping request

Re: ls_client_removal_on_reread is enabled

Re: FlexNet Licensing log (lmgrd)

lmadmin - 32/64 bit support with FNP

What are the FlexnetFS files created under /dev/shm?

Re: Missing checked out licenses in license server log for Xilinx software

Re: Checkout failure on VPN

Re: Elevated Privilege Issue with FlexNet Publisher Licensing Service on Windows

wrong ELF class: ELFCLASS64

Why /dev/shm folder structure has world write access?

Re: Checkout failure on VPN

Re: Is support account needed for downloading security fixes

Re: License Timeout Not Working As Client Not Seen As Idle

Re: Sentinel HL Key is not found in Device Manager post-windows upgrade