Stonesoft stonegate 5.2, Руководство по установке

Страница: 90 / 109

90
Appendix A Command Line Tools
StoneGate-Specific Commands
StoneGate engine commands can be run from the command line on the sensors and analyzers.
For a full list of command line tools for all types of components, see the
Command Line Tools
appendix in the Administrator’s Guide or the Online Help of the Management Client.
Table A.1 StoneGate-specific Command Line Tools on Engines
Command Description
sg-blacklist
show
[
-v]
[
-f FILENAME
]
|
add [
[
-i FILENAME
] |
[
src IP_ADDRESS/MASK
]
[
dst IP_ADDRESS/MASK
]
[
proto {tcp|udp|icmp|NUM}
]
[
srcport PORT{-PORT
}
]
[
dstport PORT{-PORT
}
]
[
duration NUM
]
] |
del [
[
-i FILENAME
] |
[
src IP_ADDRESS/MASK
]
[
dst IP_ADDRESS/MASK
]
[
proto {tcp|udp|icmp|NUM}
]
[
srcport PORT{-PORT
}
]
[
dstport PORT{-PORT
}
]
[
duration NUM
]
] |
iddel NODE_ID ID |
flush
Can be used to view, add, or delete active blacklist entries. The
blacklist is applied as defined in Access Rules.
Commands:
show
displays the current active blacklist entries in format:
engine node ID | blacklist entry ID | (internal) | entry creation
time | (internal) | address and port match | originally set
duration | (internal) | (internal). Use the
-f
option to specify a
storage file to view (
/data/blacklist/db_<number>)
. The
-v
option adds operation’s details to the output.
add
creates a new blacklist entry. Enter the parameters (see
below) or use the
-i
option to import parameters from a file.
del
deletes the first matching blacklist entry. Enter the
parameters (see below) or use the
-i
option to import
parameters from a file.
iddel NODE_ID ID
removes one specific blacklist entry on
one specific engine.
NODE_ID
is the engine’s ID,
ID
is the
blacklist entry’s ID (as shown by the
show
command).
flush
deletes all blacklist entries.
Add/Del Parameters:
Enter at least one parameter. The default value is used for the
parameters that you omit. You can also save parameters in a
text file; each line in the file is read as one blacklist entry.
src IP_ADDRESS/MASK
defines the source IP address and
netmask to match. Matches any IP address by default.
dst IP_ADDRESS/MASK
defines the destination IP address
and netmask to match. Matches any IP address by default.
proto {tcp|udp|icmp|NUM}
defines the protocol to match
by name or protocol number. Matches all IP traffic by default.
srcport PORT[-PORT
] defines the TCP/UDP source port or
range to match. Matches any port by default.
dstport PORT[-PORT]
defines the TCP/UDP destination port
or range to match. Matches any port by default.
duration NUM
defines in seconds how long the entry is kept.
Default is 0, which cuts current connections, but is not kept.
Examples:
sg-blacklist add src 192.168.0.2/32 proto tcp
dstport 80 duration 60
sg-blacklist add -i myblacklist.txt
sg-blacklist del dst 192.168.1.0/24 proto 47