netsecnotes Notes from just another netsec guy

Creating configs with Bash, for loops, and awk

So, maybe you sit next to someone that loves using GUIs to administer their firewalls. Or, maybe that person is you. Well, it's time to start looking at why the CLI is so much more powerful than any GUI... Because you can script any repetitive parts of the configuration. This becomes invaluable when you work on large networks with lots of nodes.

In this post, I'll show you one of my favourite ways of quickly throwing together some very lengthy, repetitive config in just a few simple steps. For this, we'll use Bash brace expansion.

What is Bash brace expansion? It is a way of giving Bash a series to expand, and letting it do the hard work. I'll assume that you know how a simple for loop works (and if you don't it should be fairly obvious just by reading this), so I'll just show you a quick example of brace expansion:

$ for i in blah{08..12}; do echo $i; done
blah08
blah09
blah10
blah11
blah12
$

Note that as long as we're using Bash 4 or above, the brace expansion even copes with leading zeros in the way we'd expect it to (this was a pain with brace expansion before Bash 4).

You can also have multiple brace expansions in one expression, as shown here:

$ for i in {foo,bar}-{1..3}; do echo $i; done
foo-1
foo-2
foo-3
bar-1
bar-2
bar-3
$

So, why is this important, and why should we care as NetSec engineers? What happens when someone says something like "we're adding 64 new web servers to our farm, and need them to be added to the webservers group on the firewall"? Fancy spending an hour clicking through the GUI, which is both mind-numbingly boring and error-prone? Nope, me neither. Instead, you could do this in an easy for loop, tidying up things a little with awk.

For this example, we'll assume that we're working on a Cisco ASA/PIX, as the syntax is what most people will be familiar with.

You can easily look up the hosts in DNS like this (I'll just do 4 servers, but you get the idea - with our brace expansion, it can be for as many as we like):

$ for i in site01-web-{01..04}; do host $i; done
site01-web-01 has address 10.10.1.1
site01-web-02 has address 10.10.1.2
site01-web-03 has address 10.10.1.3
site01-web-04 has address 10.10.1.4
$

Now we can just create our config by echoing our object-group line, followed by network-object statements for each IP we resolve, followed by echoing an "exit":

$ echo "object-group network webserver-group"; for i in site01-web-{01..04}; do host $i | awk '{print "network-object host", $4}'; done; echo exit
object-group network webserver-group
network-object host 10.10.1.1
network-object host 10.10.1.2
network-object host 10.10.1.3
network-object host 10.10.1.4
exit
$

The syntax of awk should be fairly obvious here - the "$4" just means the fourth field that was piped to it - in this case, the resolved IP. Read the manpage if in doubt!

So what have we just managed to achieve here? We've managed to generate a config with one line of Bash syntax, where we're adding as many webservers as we want to scrape from DNS! No chance of typos, as long as your DNS is correct, and more importantly, no mind-numbing clickety-clickety!