sed used for updating firewall allow ftp from DHCP access Post: 302171558

Sponsored Content

Top Forums Shell Programming and Scripting sed used for updating firewall allow ftp from DHCP access Post 302171558 by manouche on Thursday 28th of February 2008 07:26:16 PM

02-28-2008

Registered User

sed used for updating firewall to accept

Here is my situation. You can make all kinds of comments about how I am doing it and why from the networking standpoint, but I am really only looking for comments on how to make it work. Of course, any other ideas for how to do this would be welcome.

I have an iptables firewall that allows only specific ips in to the ftp port. I have a user who needs ftp access but works from a variety of locations and thus, the ip is constantly changing.

So, I read about "port knocking" and my idea is an offshoot of that.

I created a web page that captures the users ip address at the time and writes it to a file. I have two other text files that include the other parts of the iptables string needed for the firewall.

Here is file1.txt:

/sbin/iptables -A INPUT -p tcp -s

Here is ip.txt: (actual ip address masked from forum)

my.ip.my.ip

Here is file 3.txt:

--destination-port 21 -j ACCEPT

So, the idea is that I capture the ip into ip.txt, then cat the three files like this and use sed to put them back on one line, separated by spaces.

cat 1.txt ip.txt 3.txt | sed -n -e ":a" -e "$ s/\n//gp;N;b a" > final.txt

So, now I have the file final.txt that looks like this:

/sbin/iptables -A INPUT -p tcp -s my.ip.my.ip --destination-port 21 -j ACCEPT

The next step is to modify the firewall. I could rename this file to updatefirewall.sh and use this file as a script to modify the firewall like this:

./updatefirewall.sh or something like that.

Or, I could use sed or some other utility to do a search and replace/substitute on the actual firewall script that I have in place. The comment for that particular entry has a distinguishing character at the end of it, so I could search for the string and do a replace with the new string. I came up with the following, which looks for the end of the comment (#) and a new line (\n), and then an ip address and replaces it with "showboat".

sed 'N;s/#\n/[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*/showboat/'

That was just for a test. I actually need to replace it with the line:

/sbin/iptables -A INPUT -p tcp -s my.ip.my.ip --destination-port 21 -j ACCEPT

which would be read from the text file final.txt.

So, after all that, my question is, is there a way for sed to read in a string from a file, or would I really need to create a sed script with variables and such?

manouche

View Public Profile for manouche

Find all posts by manouche

10 More Discussions You Might Find Interesting

1. Linux

Ftp to firewall

Hi, My Linux Mandrake 9.2 is dedicate to be a web server, ftpserver, dns, firewall and internet router. With firewall enabled, I can't transfer files from a local computer to this machine. I can still; however, connect to the ftp server but whenever I do ls, get, mget. my process gets frezze...

2. Shell Programming and Scripting

delete dhcp.conf entry using sed

I am trying to use sed to remove entries from my dhcpd.conf file. The form of the file is: host foo { option 1 option 2 } host bar { option 1 option 2 } I was trying to use a label like: sed -e :a -e "s/^host bar {*//g;/{/N;//ba" /etc/dhcpd.conf...

3. Shell Programming and Scripting

Sed Help in Updating something only in one particular file.

Hi, The scenerio is that I want to replace a text in one particular line of a file. But when I am using the sed it's replacing all the occurences of that text. Like the file is: >cat test DNGGF10 :None :Test DNGGF11 :ABC :Test1 DNGGF12 :None :Test2 DNGGF13 :None :...

4. BSD

Firewall Build: Problem Updating, Patching

In building a firewall, I need to update and patch the operating system after the initial install. However, the compiler and sources should never be on a firewall PC. So what is the best way to do this ? This firewall PC has 2 identical drives; I was thinking of performing 2 installs, updating...

5. AIX

extract data from DB2 and FTP it outside ompany's firewall

The main function is to extract the data from DB2 tables and FTPed to outside the company's firewall directly. pls find the attachment and help me out..i have only one day to do this

6. AIX

Extract data from DB2 tables and FTP it to outside company's firewall

Please help me in creating the script in AIX. requirement is; The new component's main function is to extract the data from DB2 tables and company's firewall directly. The component function needs to check the timestamp in the DB2 tables ((CREDAT and CRETIM) with the requested timestamp and...

7. AIX

ftp access without shell access

Hi all, I'm using AIX v 5.3 I want to create system users to access through ftp or sftp and restrict those users into specific directory and don't traverse the whole file system just to be restricted within a directory and don't get shell access . i don't want to use any other third party...

8. Shell Programming and Scripting

updating a file with sed -help

I have a file of records all made up of single charactors that need to be updated using their row/column (the dashes represent spaces as the html formatting of this text box when it posts removes the "nonessential" white space between the charactors) file example A 1 c B 2 b C 3 a...

9. UNIX for Dummies Questions & Answers

iptables rule to block access from VM Browser to Firewall Login Page

10. Shell Programming and Scripting

Updating variables using sed or awk

Hi, I have a file(testfile.txt) that contains list of variables as shown below. T $$FirstName=James $$LastName=Fox $$Dateofbirth=1980-02-04 ……and so on there are 50 different variables. I am writing a script(script1.sh) that will update the above three variable one by one with the values...

LEARN ABOUT DEBIAN

arno-iptables-firewall

ARNO-IPTABLES-FIREWALL(8)												 ARNO-IPTABLES-FIREWALL(8)

NAME

       arno-iptables-firewall - Single- & multi-homed firewall script with DSL/ADSL support.

SYNOPSIS

       /etc/init.d/arno-iptables-firewall [start|stop|status|force-reload|restart]

DESCRIPTION

       arno-iptables-firewall  is  an  iptables configuration script with support for both IPv4 & IPv6.  While it is extremely easy to use one can
       nevertheless use it in quite complicated environments.

       All available options are explained in the extensively documented configuration file.

       The external interface of the system needs to be set up properly in the firewalls configuration file (EXT_IF).  The default behavior of the
       firewall is to deny all incoming connections.

       For  additional	requirements not covered by the configuration file custom iptables rules can be placed in /etc/arno-iptables-firewall/cus-
       tom-rules.  This file is automatically parsed by the service script.

       See the README file (eg. in /usr/(local/)share/doc/arno-iptables-firewall) for an example how to manage logging of firewall events  through
       syslogd.

       The arno-fwfilter script can be used to make the firewall logs more readable for humans (see manpage).

       Several plugins for the firewall script are available online. Plugins can be downloaded from http://rocky.eld.leidenuniv.nl/ Please see the
       README file for more information.

FILES

       /etc/init.d/arno-iptables-firewall	       system service script
       /etc/arno-iptables-firewall/firewall.conf       firewall configuration
       /etc/arno-iptables-firewall/conf.d/	       firewall configuration directory
       /etc/arno-iptables-firewall/custom-rules        custom iptables rules
       /etc/arno-iptables-firewall/blocked-hosts       host blacklist
       /etc/arno-iptables-firewall/mac-addresses       mac filter list

       Please note, that the last two files do exist in the initial configuration and their use is disabled  in  /etc/arno-iptables-firewall/fire-
       wall.conf

SEE ALSO

       iptables(8), arno-fwfilter(1), syslog.conf(5)

       The http://rocky.eld.leidenuniv.nl/ web site.

AUTHOR

       arno-iptables-firewall was written by Arno van Amersfoort <arnova@rocky.eld.leidenuniv.nl>.

       This manual page was written by Michael Hanke <michael.hanke@gmail.com>, for the Debian project (but may be used by others).

Michael Hanke							  March 14, 2012					 ARNO-IPTABLES-FIREWALL(8)