thr3ads.net - Shorewall users - [Shorewall-users] 1.2.10 Preview [Mar 2002]

If this information is useful, please help other people find it:
Share via:

Tom Eastep

2002-Mar-18 15:04 UTC

[Shorewall-users] 1.2.10 Preview

In http://www.shorewall.net/pub/shorewall/Beta/shorewall is a version of
/sbin/shorewall that includes a ''try'' command:

    shorewall try <configuration directory>

This command:

a) Tries "shorewall -c <configuration directory> restart
b) If that command fails, it issues "shorewall start" to start the
default
configuration.

This should allow folks who do remote administration to try new
configurations without the risk of isolating themselves. It''s probably
a
good idea to redirect the output as in:

    shorewall try /etc/foo > /tmp/tryfoo 2>&1

(ash users will have to specify individual redirection of file descriptors 2
and 1).

If the new config works, you can then copy the files from <configuration
directory> to /etc/shorewall.

-Tom
--
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@shorewall.net

Dario Lesca

2002-Mar-18 16:43 UTC

head link

[Shorewall-users] 1.2.10 Preview

----- Original Message -----
From: "Tom Eastep"
<teastep@shorewall.net>>
>     shorewall try <configuration directory>
>
Following your suggest into "Re: [Shorewall-users] HowTo avoid to be close
out
when active a new configurations from remote host", I have generate
the following script.

Now that this option has been inserted into shorewall, I will throw mine
script.
Check if something could be useful for you (perhaps it is in Italian, if you
thing
it could be useful for you i can translate the comment)

Many Thanks.

Dario Lesca

-----------------[setupshwconf.sh]--------------
#!/bin/bash

# Run shorewall and get status ...
function test_shorewall
{
        test $# != 2 && exit 1
        config=$1
        azione=$2
        flog=/tmp/setupshwconf.log
        stat=/tmp/setupshwconf.stat
        function my_run {
                c=$2
                a=$3
                cmd="shorewall -c $c $a"
                date
                echo $cmd
                eval $cmd
                echo $? > $stat
        }

        rm -rf $stat

        my_run shw_stat "$config" "$azione"  2>&1 |
        awk -v flog=$flog ''{printf "."; print $0 >
flog}''

        test -f $stat && st=$(cat $stat) || st=10
        rm -rf $stat
        echo " (status=$st)"

        return $st
}

SHOREWALL=/etc/shorewall
NEW_CONFIG=$(cd $1 && pwd -P)
CURR_CONFIG=$SHOREWALL/Config/Current.cfg

if [ ! -d "$1" ]
then
        echo "Usage: $(basename $0) {directory whit config file of
shorewall}"
        if test -f $CURR_CONFIG
        then
                echo "       (last config files from: $(cat
$CURR_CONFIG))"
        fi
        exit 2
fi

echo "Verifica sintassi nuova configurazione ..."
if ! test_shorewall $NEW_CONFIG check
then
        tput bel
        echo "ATTENZIONE: I file utilizzati contengono qualche errore"
        echo "Procedura interrotta, nulla di fatto."
        exit 1
fi

cat << EOF
OK: File di configurazione privi di errori sintattici.

Si procede ora con l''attivazione della nuova configurazione.

Per prevenire eventuali errori di configurazione, dopo la sua
attivazione verra'' richiesto di digitare la stringa OK.

Se entro $sec secondi non verra'' digitato nulla, sara''
ripristinata
la configurazione precedente, oppure disattivato il firewall nel
caso nessuna configurazione sia stata ancora attivata.

EOF

sleep 3

echo "Attivazione nuova configurazione ..."
if ! test_shorewall $NEW_CONFIG restart
then
        tput bel
        echo "ATTENZIONE: caricamento nuova configurazione fallito!"
        inp="ERROR!"
else
        echo "Nuova configurazione attivata."
        echo

        stty -echo
        str="Per renderla operativa digitare OK entro %2d secondi: "
        nch=$(printf "$str" 0|wc -c)
        sec=9
        while [ -z "$inp" -a $sec != 0 ]
        do
                tput bel
                printf "$str" $sec
                read -t 1 inp
                i=$nch
                while [ $i -gt 0 ]
                do
                        printf " \b\b"
                        i=$[$i - 1]
                done
                sec=$[$sec - 1]
        done
        stty echo
fi

if test "$inp" = OK
then
        echo "OK: Attivo la nuova configurazione."
        cp -va $NEW_CONFIG/* $SHOREWALL/.
        echo $NEW_CONFIG > $CURR_CONFIG

        echo "Avvio la nuova configurazione ..."
        azione=restart
else
        echo "ATTENZIONE!: La nuova configurazione non e'' stata
attivata."
        echo
        if test -f $CURR_CONFIG
        then
                echo "Ripristino la configurazione precedente ..."
                azione=restart
        else
                echo "Disattivo il firewall ..."
                azione=clear
        fi
fi
service shorewall $azione

echo "Termime Procedura."

--------------------------------[setupshwconf.sh]--------------

Tom Eastep

2002-Mar-18 17:10 UTC

head link

[Shorewall-users] 1.2.10 Preview

Thanks, Dario -- I''ll take a look.

-Tom

----- Original Message -----
From: "Dario Lesca" <d.lesca@ivrea.osra.it>
To: "Shorewall Firewall" <shorewall-users@shorewall.net>
Sent: Monday, March 18, 2002 8:43 AM
Subject: Re: [Shorewall-users] 1.2.10 Preview

> ----- Original Message -----
> From: "Tom Eastep" <teastep@shorewall.net>
> >
> >     shorewall try <configuration directory>
> >
>
> Following your suggest into "Re: [Shorewall-users] HowTo avoid to be
close
> out
> when active a new configurations from remote host", I have generate
> the following script.
>
> Now that this option has been inserted into shorewall, I will throw mine
> script.
> Check if something could be useful for you (perhaps it is in Italian, if
you> thing
> it could be useful for you i can translate the comment)
>
> Many Thanks.
>
> Dario Lesca
>
> -----------------[setupshwconf.sh]--------------
> #!/bin/bash
>
> # Run shorewall and get status ...
> function test_shorewall
> {
>         test $# != 2 && exit 1
>         config=$1
>         azione=$2
>         flog=/tmp/setupshwconf.log
>         stat=/tmp/setupshwconf.stat
>         function my_run {
>                 c=$2
>                 a=$3
>                 cmd="shorewall -c $c $a"
>                 date
>                 echo $cmd
>                 eval $cmd
>                 echo $? > $stat
>         }
>
>         rm -rf $stat
>
>         my_run shw_stat "$config" "$azione" 
2>&1 |
>         awk -v flog=$flog ''{printf "."; print $0 >
flog}''
>
>         test -f $stat && st=$(cat $stat) || st=10
>         rm -rf $stat
>         echo " (status=$st)"
>
>         return $st
> }
>
> SHOREWALL=/etc/shorewall
> NEW_CONFIG=$(cd $1 && pwd -P)
> CURR_CONFIG=$SHOREWALL/Config/Current.cfg
>
> if [ ! -d "$1" ]
> then
>         echo "Usage: $(basename $0) {directory whit config file of
> shorewall}"
>         if test -f $CURR_CONFIG
>         then
>                 echo "       (last config files from: $(cat
$CURR_CONFIG))">         fi
>         exit 2
> fi
>
> echo "Verifica sintassi nuova configurazione ..."
> if ! test_shorewall $NEW_CONFIG check
> then
>         tput bel
>         echo "ATTENZIONE: I file utilizzati contengono qualche
errore"
>         echo "Procedura interrotta, nulla di fatto."
>         exit 1
> fi
>
> cat << EOF
> OK: File di configurazione privi di errori sintattici.
>
> Si procede ora con l''attivazione della nuova configurazione.
>
> Per prevenire eventuali errori di configurazione, dopo la sua
> attivazione verra'' richiesto di digitare la stringa OK.
>
> Se entro $sec secondi non verra'' digitato nulla, sara''
ripristinata
> la configurazione precedente, oppure disattivato il firewall nel
> caso nessuna configurazione sia stata ancora attivata.
>
> EOF
>
> sleep 3
>
> echo "Attivazione nuova configurazione ..."
> if ! test_shorewall $NEW_CONFIG restart
> then
>         tput bel
>         echo "ATTENZIONE: caricamento nuova configurazione
fallito!"
>         inp="ERROR!"
> else
>         echo "Nuova configurazione attivata."
>         echo
>
>         stty -echo
>         str="Per renderla operativa digitare OK entro %2d secondi:
"
>         nch=$(printf "$str" 0|wc -c)
>         sec=9
>         while [ -z "$inp" -a $sec != 0 ]
>         do
>                 tput bel
>                 printf "$str" $sec
>                 read -t 1 inp
>                 i=$nch
>                 while [ $i -gt 0 ]
>                 do
>                         printf " \b\b"
>                         i=$[$i - 1]
>                 done
>                 sec=$[$sec - 1]
>         done
>         stty echo
> fi
>
> if test "$inp" = OK
> then
>         echo "OK: Attivo la nuova configurazione."
>         cp -va $NEW_CONFIG/* $SHOREWALL/.
>         echo $NEW_CONFIG > $CURR_CONFIG
>
>         echo "Avvio la nuova configurazione ..."
>         azione=restart
> else
>         echo "ATTENZIONE!: La nuova configurazione non e''
stata attivata."
>         echo
>         if test -f $CURR_CONFIG
>         then
>                 echo "Ripristino la configurazione precedente
..."
>                 azione=restart
>         else
>                 echo "Disattivo il firewall ..."
>                 azione=clear
>         fi
> fi
> service shorewall $azione
>
> echo "Termime Procedura."
>
> --------------------------------[setupshwconf.sh]--------------
>
>
> _______________________________________________
> Shorewall-users mailing list
> Shorewall-users@shorewall.net
> http://www.shorewall.net/mailman/listinfo/shorewall-users
>

Shorewall users - Mar 2002 - 1.2.10 Preview

[Shorewall-users] 1.2.10 Preview

[Shorewall-users] 1.2.10 Preview

[Shorewall-users] 1.2.10 Preview