1

I've been having trouble with firewalls lately on a few different servers. And im wanting to create a script that will run once every hour or so, and check a file on an external server and execute the relevant firewall rule set. As at the moment if SOMETHING happens to the firewall, and i get my ssh/etc blocked I have to schedule an onsite visit which is ridiculously expensive. So this will effectively be a failsafe system. If something goes wrong, i can use another server to initiate a change on the "broken" server and get it back to being able to be remotely managed. Bit haxy i know, but at my current Linux admin level should work out well.

I've never really done bash/sh scripting before, but im used to bat. So what im needing help with from the community is to turn this psudo code into something that might work:

$PATH = "/usr/firewall-scripts/temp/";
cd $PATH;
wget https://example.com/firewall/config/failsafe;
$FAILSAFE = readfile("$PATH/failtsafe");#This <--- im sure doesn't exist. 
if($FAILSAFE == "1") {
    /usr/firewall-scripts/failsafe.fw
}
else if ($FAILSAFE == "2")  {
    /usr/firewall-scripts/failsafe2.fw
}
else if ($FAILSAFE == "0")  {
    /usr/firewall-scripts/normal.fw
}
else if ($FAILSAFE == "-1")  {
    /usr/firewall-scripts/extra-secure.fw
}

The remote file would just have the numbers listed 1,2,0 or -1 (or something similar to these lines.

Its purely just a conditional tree/switch to execute different files.

Thanks in advance!

Note: Using a mixture of Mandrivia 2010.R2 / Ubuntu 10.04 / ClearOS, all have full sh and bash, incase that matters. Which it shouldn't.

EDIT: This is a hacky approach and there is probably far better (secure) ways to do this, but this is very light and simple.

8
  • A note for anyone else: this is about as bad a way of managing a firewall and achieving the goal of "don't lock me out of my server" as I can imagine. Please don't do this.
    – womble
    May 5, 2012 at 8:59
  • 1
    @womble: Why not make the internet a better place and provide an answer demonstrating the correct way to do it rather than just sniping from the sidelines ?
    – user9517
    May 5, 2012 at 9:45
  • Because people get pissy when I give answers that don't directly answer the question. It was recommended that comments are more appropriate. I'm giving it a go. I think it would be incredibly dangerous to let this sort of idea hang around without providing a warning to others, though.
    – womble
    May 5, 2012 at 10:11
  • @womble: Well I for one would like to see your solution.
    – user9517
    May 5, 2012 at 16:03
  • @Iain: The "ask a question" button's right up there on the top right. <grin>
    – womble
    May 5, 2012 at 23:12

3 Answers 3

1

You can use the following script:

#!/bin/bash

failsafe=`w3m -dump_source http://example.com/firewall/config/failsafe`
if [ "$failsafe" -eq "1" ] ; then
    /usr/firewall-scripts/failsafe.fw
elif [ "$failsafe" -eq "2" ] ; then
    /usr/firewall-scripts/failsafe2.fw
elif [ "$failsafe" -eq "0" ] ; then
    /usr/firewall-scripts/normal.fw
elif [ "$failsafe" -eq "-1" ] ; then
    /usr/firewall-scripts/extra-secure.fw
fi

You need to make sure the page returns one of the expected values to get correct results.

The above is the answer to your question about shell script, but I think it will be a good idea to try to use configuration management solution like puppet. Puppet agent can be run to pull the configuration from a puppet master periodically. So, when you are done with puppet configuration, you can just drop another firewall rules file and wait for some time to be executed by puppet agent on the remote machine.

1
  • The script works as expected and looks great! The advice with Puppet is good and I'll definitely look into that as an alternate to this current haxy plan in the future!
    – Mattisdada
    May 5, 2012 at 8:59
2

If you use

FAILSAFE=$(wget -O - http://example.com/firewall/config/failsafe) 

then the contents of the remote file will be saved to the variabe $FAILSAFE.

You can then use $FAILSAFE in your comparisons e.g.

#!/bin/bash

FAILSAFE=$(wget -O - http://example.com/firewall/config/failsafe 2> /dev/null)

if [ "$FAILSAFE" -eq "1" ]
then
    echo "FAILSAFE = $FAILSAFE"
elif [ "$FAILSAFE" -eq "2" ]
then
    echo "FAILSAFE = $FAILSAFE"
elif [ "$FAILSAFE" -eq "-1" ]
then
    echo "FAILSAFE = $FAILSAFE"
fi
1
#!/bin/bash 
# (or whatever the path to bash is, find out from 'which bash'

STATE=$(wget -O - http://example.com/firewall/config/failsafe)

case $STATE in
-1)
  /usr/firewall-scripts/extra-secure.fw
  ;;
0)
  /usr/firewall-scripts/normal.fw
  ;;

1)
  /usr/firewall-scripts/failsafe.fw
  ;;
2)
  /usr/firewall-scripts/failsafe2.fw
  ;;
*)
  echo "unexpected failsafe state"
  exit 1
  ;;
esac

exit 0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .