Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been having trouble with firewalls lately on a few different servers. And im wanting to create a script that will run once every hour or so, and check a file on an external server and execute the relevant firewall rule set. As at the moment if SOMETHING happens to the firewall, and i get my ssh/etc blocked I have to schedule an onsite visit which is ridiculously expensive. So this will effectively be a failsafe system. If something goes wrong, i can use another server to initiate a change on the "broken" server and get it back to being able to be remotely managed. Bit haxy i know, but at my current Linux admin level should work out well.

I've never really done bash/sh scripting before, but im used to bat. So what im needing help with from the community is to turn this psudo code into something that might work:

$PATH = "/usr/firewall-scripts/temp/";
cd $PATH;
wget https://example.com/firewall/config/failsafe;
$FAILSAFE = readfile("$PATH/failtsafe");#This <--- im sure doesn't exist. 
if($FAILSAFE == "1") {
    /usr/firewall-scripts/failsafe.fw
}
else if ($FAILSAFE == "2")  {
    /usr/firewall-scripts/failsafe2.fw
}
else if ($FAILSAFE == "0")  {
    /usr/firewall-scripts/normal.fw
}
else if ($FAILSAFE == "-1")  {
    /usr/firewall-scripts/extra-secure.fw
}

The remote file would just have the numbers listed 1,2,0 or -1 (or something similar to these lines.

Its purely just a conditional tree/switch to execute different files.

Thanks in advance!

Note: Using a mixture of Mandrivia 2010.R2 / Ubuntu 10.04 / ClearOS, all have full sh and bash, incase that matters. Which it shouldn't.

EDIT: This is a hacky approach and there is probably far better (secure) ways to do this, but this is very light and simple.

share|improve this question
    
A note for anyone else: this is about as bad a way of managing a firewall and achieving the goal of "don't lock me out of my server" as I can imagine. Please don't do this. –  womble May 5 '12 at 8:59
1  
@womble: Why not make the internet a better place and provide an answer demonstrating the correct way to do it rather than just sniping from the sidelines ? –  Iain May 5 '12 at 9:45
    
Because people get pissy when I give answers that don't directly answer the question. It was recommended that comments are more appropriate. I'm giving it a go. I think it would be incredibly dangerous to let this sort of idea hang around without providing a warning to others, though. –  womble May 5 '12 at 10:11
    
@womble: Well I for one would like to see your solution. –  Iain May 5 '12 at 16:03
    
@Iain: The "ask a question" button's right up there on the top right. <grin> –  womble May 5 '12 at 23:12
show 3 more comments

3 Answers 3

up vote 1 down vote accepted

You can use the following script:

#!/bin/bash

failsafe=`w3m -dump_source http://example.com/firewall/config/failsafe`
if [ "$failsafe" -eq "1" ] ; then
    /usr/firewall-scripts/failsafe.fw
elif [ "$failsafe" -eq "2" ] ; then
    /usr/firewall-scripts/failsafe2.fw
elif [ "$failsafe" -eq "0" ] ; then
    /usr/firewall-scripts/normal.fw
elif [ "$failsafe" -eq "-1" ] ; then
    /usr/firewall-scripts/extra-secure.fw
fi

You need to make sure the page returns one of the expected values to get correct results.

The above is the answer to your question about shell script, but I think it will be a good idea to try to use configuration management solution like puppet. Puppet agent can be run to pull the configuration from a puppet master periodically. So, when you are done with puppet configuration, you can just drop another firewall rules file and wait for some time to be executed by puppet agent on the remote machine.

share|improve this answer
    
The script works as expected and looks great! The advice with Puppet is good and I'll definitely look into that as an alternate to this current haxy plan in the future! –  Mattisdada May 5 '12 at 8:59
add comment

If you use

FAILSAFE=$(wget -O - http://example.com/firewall/config/failsafe) 

then the contents of the remote file will be saved to the variabe $FAILSAFE.

You can then use $FAILSAFE in your comparisons e.g.

#!/bin/bash

FAILSAFE=$(wget -O - http://example.com/firewall/config/failsafe 2> /dev/null)

if [ "$FAILSAFE" -eq "1" ]
then
    echo "FAILSAFE = $FAILSAFE"
elif [ "$FAILSAFE" -eq "2" ]
then
    echo "FAILSAFE = $FAILSAFE"
elif [ "$FAILSAFE" -eq "-1" ]
then
    echo "FAILSAFE = $FAILSAFE"
fi
share|improve this answer
add comment
#!/bin/bash 
# (or whatever the path to bash is, find out from 'which bash'

STATE=$(wget -O - http://example.com/firewall/config/failsafe)

case $STATE in
-1)
  /usr/firewall-scripts/extra-secure.fw
  ;;
0)
  /usr/firewall-scripts/normal.fw
  ;;

1)
  /usr/firewall-scripts/failsafe.fw
  ;;
2)
  /usr/firewall-scripts/failsafe2.fw
  ;;
*)
  echo "unexpected failsafe state"
  exit 1
  ;;
esac

exit 0
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.