diff --git a/Shorewall/help b/Shorewall/help index c92187605..292560a8b 100755 --- a/Shorewall/help +++ b/Shorewall/help @@ -248,6 +248,15 @@ reset) All the packet and byte counters in the firewall are reset." ;; +reload) + echo "reload: reload + Causes the shorewall configuration in the current working directory to be + compiled into a program called 'firewall'. If compilation is successful, + the 'firewall' script is copied via scp to the /usr/share/shorewall-lite/ + directory on . If the script is copied successfully, Shorewall + Lite on is restarted via ssh." + ;; + restart) echo "restart: restart [ -n ] [ ] Restart is the same as a shorewall stop && shorewall start. diff --git a/Shorewall/shorewall b/Shorewall/shorewall index 8b4ace5f4..76d52f532 100755 --- a/Shorewall/shorewall +++ b/Shorewall/shorewall @@ -1282,6 +1282,13 @@ restore_command() { fi } # +# Reload command executor +# +reload_command() +{ + shorewall compile -e . firewall && scp firewall root@${1}:/usr/share/shorewall-lite/ && ssh root@${1} '/sbin/shorewall-lite restart' && progress_message3 "System $1 reloaded" +} +# # Help information # help() @@ -1316,6 +1323,7 @@ usage() # $1 = exit status echo " logwatch []" echo " refresh" echo " reject
..." + echo " reload " echo " reset" echo " restart [ -n ] [ ]" echo " restore [ -n ] [ ]" @@ -1622,6 +1630,11 @@ case "$COMMAND" in shift show_command $@ ;; + reload) + shift + [ $# -eq 1 ] || usage 1 + reload_command $1 + ;; status) [ $# -eq 1 ] || usage 1 echo "Shorewall-$version Status at $HOSTNAME - $(date)" diff --git a/docs/CompiledPrograms.xml b/docs/CompiledPrograms.xml index a03dd0918..25f871819 100644 --- a/docs/CompiledPrograms.xml +++ b/docs/CompiledPrograms.xml @@ -305,6 +305,8 @@ refresh + reload + try safe-start @@ -397,30 +399,20 @@
- A simple shell program for remote firewall replacement + /sbin/shorewall reload command (Added in 3.2.0 RC4) - I use the following simple - shell program for compiling firewall scripts and installing them - on firewall systems: + The reload command allows for easy updating of remote firewall + systems. At shorewall.net, I keep my firewall configurations in + sub-directories under ~/Configs. The name of the directory corresponds + to the DNS name of the system. -
- #/bin/bash - -[ $# -eq 1 ] || { echo "Usage: $(basename $0) <system>" >&2; exit 2; } - -/sbin/shorewall compile -e . firewall && scp firewall root@${1}:/usr/share/shorewall-lite/ && ssh root@${1} 'shorewall-lite restart' -
- - I install this program in - /usr/local/bin/compile and I have my configuration - directories in ~/Config. So, for example, to recompile the firewall - script for the 'gateway' system and install the script on gateway, I do - the following: + To recompile the firewall script for the system named gateway and + to install that script on gateway, I issue the following + commands:
teastep@wookie:~$ cd Configs/gateway -teastep@wookie:~/Configs/gateway$ compile gateway +teastep@wookie:~/Configs/gateway$ /sbin/shorewall reload gateway Compiling... Shorewall configuration compiled to firewall firewall 100% 29KB 29.3KB/s 00:00 diff --git a/docs/starting_and_stopping_shorewall.xml b/docs/starting_and_stopping_shorewall.xml index 896c5cfbe..2b681b41c 100644 --- a/docs/starting_and_stopping_shorewall.xml +++ b/docs/starting_and_stopping_shorewall.xml @@ -943,6 +943,38 @@ + + reload (Added in Shorewall 3.2.0 RC4 -- not supported by + Shorewall Lite) + + + reload <system> + + Allows a non-root user to compile a shorewall script and + install it on a remote system (provided that the user has access to + the remote system via ssh). The command is equivalent to: + + + /sbin/shorewall compile -e . firewall + &&\ + + scp firewall + root@<system>:/usr/share/shorewall-lite/ + &&\ + + ssh root@<system> '/sbin/shorewall-lite + restart' + + + In other words, the configuration in the current working + directory is compiled to a file called firewall + in that directory. If compilation succeeds, then + firewall is copied to the remote system using + scp. If the copy succeeds, Shorewall Lite on the remote system is + restarted via ssh. + + + reset