Example of a heartbeat script<\/a><\/a><\/li><\/ul><\/nav><\/div>\n\nWhy run a script on the Sophos Firewall?<\/h2>\n\n
In certain situations, it may be necessary to run a custom script on the Sophos Firewall.\nThis can be used, for example, to customize network settings, to regularly send heartbeat signals to monitoring services or to change firewall rules.\nOften this functionality should be retained even after a restart of the firewall, which means that the default configuration of the Sophos Firewall must be adjusted. <\/p>\n\n
Activate write permissions for the file system<\/h2>\n\n
By default, the Sophos Firewall file system is read-only.\nTo make changes to scripts, it must first be mounted with write permissions: <\/p>\n\n
mount -no remount,rw \/<\/code><\/pre>\n\nCreate or edit script<\/h2>\n\n
Next, you can create a script or edit an existing script.\nIn this example, a user-defined script is created that sets certain network rules: <\/p>\n\n
vi \/scripts\/system\/clientpref\/customization_application_startup.sh<\/code><\/pre>\n\nAdd the following content:<\/p>\n\n
#!\/bin\/sh
iptables -t mangle -D POSTROUTING -d 172.19.0.0\/16 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 900
exit 0;<\/code><\/pre>\n\nThis command removes an existing rule and sets a new rule to set the maximum segment size (MSS) for TCP connections to 900 bytes.<\/p>\n\n
#!\/usr\/bin\/expect -f\nspawn ssh <Sophos Firewall IP> -l admin\nexpect \"password:\"\nsend \"<Admin Password>\\r\"\nexpect \"Select Menu Number \\\\\\[0-7\\\\\\]:\"\nsend \"7\\r\"\nexpect \"Shutdown(S\/s) or Reboot(R\/r) Device (S\/s\/R\/r): No (Enter) >\"\nsend \"r\\r\"\nexpect eof\nexit<\/code><\/pre>\n\nThis command ensures that the Sophos Firewall restarts every night.<\/p>\n\n
Save changes and write-protect file system again<\/h2>\n\n
After the script has been edited, the changes should be saved and the write protection of the file system reactivated:<\/p>\n\n
mount -no remount,ro \/<\/code><\/pre>\n\nTo ensure that the script is also executed after a restart of the firewall, it must be integrated into the start procedure of the firewall.\nThe previously edited script (customization_application_startup.sh) is executed each time the firewall is started and ensures that the desired settings are applied. <\/p>\n\n
Example of a heartbeat script<\/h2>\n\n
If it is necessary to send a heartbeat to a monitoring service such as Uptimerobot, you can use the following example:<\/p>\n\n
1. create a new script:<\/p>\n\n
touch \/var\/script.sh<\/code><\/pre>\n\n2. edit the script:<\/p>\n\n
vi \/var\/script.sh<\/code><\/pre>\n\n3. add your content, here is an example:<\/p>\n\n
#!\/bin\/sh\nwhile [ 1 ];\ndo\ncurl --insecure https:\/\/heartbeat.uptimerobot.com\/xxxxxxx-20cf67c87a3c0a318820d201f19483e06c99c9f7 >\/dev\/null 2>&1\nsleep 60 ;\ndone<\/code><\/pre>\n\n4. make the script executable:<\/p>\n\n
chmod 755 \/var\/script.sh<\/code><\/pre>\n\n5. execute the script:<\/p>\n\n
\/var\/script.sh >> \/dev\/null 2>&1 &<\/code><\/pre>\n\n6. to run the script automatically even after a restart, add the following line to the file customization_application_startup.sh:<\/p>\n\n
\/var\/script.sh >> \/dev\/null 2>&1 &<\/code><\/pre>\n\nImportant notes<\/strong><\/p>\n\n\n- High Availability (HA) Cluster<\/strong>: When using an HA cluster, the script must be applied to both nodes.<\/li>\n\n\n\n
- Persistence via restarts<\/strong>: If the script is to be executed each time the firewall is restarted, the steps described for integration into the start procedure must be carried out.<\/li>\n\n\n\n
- Risks<\/strong>: Care should be taken when making changes to the firewall start scripts, as incorrect settings can impair the functionality of the firewall.<\/li>\n<\/ul>\n","protected":false},"author":1,"featured_media":0,"parent":0,"template":"","format":"standard","kb_kategorie":[382],"class_list":["post-161472","kb","type-kb","status-publish","format-standard","hentry","kb_kategorie-sophos-firewall"],"blocksy_meta":[],"acf":[],"_links":{"self":[{"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/kb\/161472","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/kb"}],"about":[{"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/types\/kb"}],"author":[{"embeddable":true,"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/users\/1"}],"wp:attachment":[{"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/media?parent=161472"}],"wp:term":[{"taxonomy":"kb_kategorie","embeddable":true,"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/kb_kategorie?post=161472"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}