Data Security Protector CLI

Data Security Protector CLI

Applies to

Data Security v7.6.x

In this topic

Overview

Accessing the CLI

Command-line reference

Exit the command line interface

Show CLI help messages

Accessing the basic configuration wizard

Rebooting the protector

Turning off the protector

Showing the Websense Protector version

Setting or showing the system date

Setting or showing the system time

Modify or show system timezone

Viewing protector information

Collecting statistics

Configure or show the DNS server(s)

Configure or show the default domain name(s)

Configure or show the default gateway

Configure or show the host name

Configure or show interface information

Add or delete routing information

Manage users

Filtering monitored networks

Configuring NTP support

Overview

A command-line interpreter (also known as a command-line shell) is a computer program that reads lines of text entered by a user and interprets them in the context of a given operating system or programming language.

Command-line interpreters allow users to issue various commands in a very efficient way. This requires the user to know the names of the commands and their parameters, and the syntax of the language that is interpreted.

This chapter describes the command line interpreter (CLI) for the Linux-based Data Security Protector.

The CLI can be used after initial installation to modify the settings configured by the wizard as well as configure other protector parameters. Log in using the admin or root user (other users can also be defined). Note that admin users are limited and not all Linux shell commands are available to them.

Accessing the CLI

Access the CLI through a direct terminal or via a serial port console.

If using a serial port console, configure your terminal application, such as HyperTerminal or TeraTerm, as follows:

19200 baud, 8 data bits, no parity, 1 stop bit, no flow control.

In addition, the protector allows access via SSH connection.

Connect to port 22 with the SSH tool of your choice and use the credentials you set to access the protector CLI. It is impossible to access the protector using SSH before running the wizard for the first time, as it has irrelevant default network settings.

Command-line reference

Following are general guidelines to using the CLI.

For admin users, use the help command to view a list of all available commands

All commands can be run with the help option to view detailed help about that command. For example: iface help

The CLI shell implements auto-complete for command names using the TAB key. For example, typing i+TAB will display: iface info (all the commands that start with i)

The CLI shell implements command history. Use the up/down arrows to view/run/modify previously entered commands, sequentially.

Some commands' output may exceed the height of the screen. Use your terminal software to scroll back and view all output.

All commands and their arguments are case sensitive.

Abbreviations are not accepted in the CLI; it is necessary to type the entire word. The TAB button can be used to complete partially typed commands.

Some command output may exceed the length of the screen. Once the screen is full, the CLI will prompt –more-. Use the spacebar to display the next screen.

Exit the command line interface

Syntax	exit
Description	Exits the user from the Websense Protector CLI and returns to the login prompt or to a wrapper shell environment.
Parameters	N/A
Default	N/A
Example	Websense1# exit Websense1 login:

Show CLI help messages

Syntax	help ?
Description	This command displays all available commands with a small description for each. The list of available commands depends on the user's profile. All commands support the help argument. When used, the command displays a help message relevant to that command.
Parameters	N/A
Default	N/A
Example	Websense1# dns help dns: Configure or show DNS server(s) Usage: dns [list | delall] dns [{add | del} <ipaddr>]

Accessing the basic configuration wizard

Syntax	wizard
Description	Opens the Websense Protector Installation Wizard. The user can also run wizard securecomm to go directly to the registration stage of the Wizard, where Data Security Manager details are entered.
Parameters	N/A
Default	N/A
Example	Websense1# wizard Websense1# wizard securecomm

Rebooting the protector

Syntax	reboot
Description	Reboots the protector. The protector is shut down and restarted immediately after the command is executed.
Parameters	N/A
Default	N/A
Example	Websense1# reboot

Turning off the protector

Syntax	shutdown
Description	Shuts down the protector. The protector is shut down and powered off immediately after the command is executed.
Parameters	N/A
Default	N/A
Example	Websense1# shutdown

Showing the Websense Protector version

Syntax	version
Description	Displays the protector version information.
Parameters	N/A
Default	N/A
Example	Websense1# version This is Websense Content Protector 7.5.1.009, Policy Engine 7.5.1.9 (Appliance 7.5.1.009)

Setting or showing the system date

Syntax	date [-d] [dd-mmm-yyyy]
Description	Sets or displays the date of the protector. By default, the command displays the current date. Otherwise, the argument is used to set the date of the protector. date is also a native Linux command. Root users can access the CLI command by running it with its full path: /opt/websense/neti/bin/date.
Parameters	If the the –d option is given, the date is displayed or set using an all digit format (mm/dd/yyyy, for example: 02/21/2006). Otherwise, a dd-mmm-yyy format is used. dd is the day of the month [01 to 31] mmm is the month in abbreviated 3-letter format [Jan, Feb, Mar, etc.] yyyy is the year [2006, 2007]
Default	N/A
Example	Websense1# date 21-Feb-2006

Setting or showing the system time

Syntax	time -h [HH[:MM[:SS]]]
Description	Sets or displays the time in the protector. By default, the command displays the current time. time is also a native Linux command. Root users can access the CLI command by running it with its full path: /opt/websense/neti/bin/time.
Parameters	-u sets the time in UTC -h displays a short usage message HH:MM:SS HH is the hour [00 to 24] MM is the minutes [00 to 59] SS is the seconds [00 to 59]
Default	N/A In the event that minutes and/or seconds are not entered, they are considered 00.
Example	Websense1# time 17:55:03

Modify or show system timezone

Syntax	timezone [list, show, set timezone]
Description	Shows or sets the protector timezone.
Parameters	list: displays a complete list of time zones that can be set in the Websense Protector show: displays the time zone set in the Websense Protector (default option) set timezone: sets the time zone. The set command must be followed by the name of the time zone to be selected, as listed using the list command. Note that the names of the time zones are case-sensitive.
Default	When no argument is given, show is assumed.
Example	Websense1# timezone set US/Hawaii

Viewing protector information

Syntax	info { cpu | memory | network | diag | uptime | hardware | features} info stats [reset]
Description	Displays information about the Websense protector. Root users must access the CLI command by running it with its full path: /opt/websense/neti/bin/info.
Parameters	cpu: displays the protector's CPU usage information. memory: displays the protector memory usage information. network: displays the protector's network settings including hostname, domain name, IP address and routing table. diag: creates a diagnostic file to be used by Websense technical services. uptime: displays the amount of time the protector has been up and operational. features: lists all the possible features available on this protector and what they can do (monitor or block) hardware: displays hardware information including which network cards are installed. stats: displays traffic statistis for each protocol being monitored; this is useful to verify the operational status of the Protector. stats reset: resets all statistics counters to zero.
Default	N/A
Example	Websense1# info cpu Processor 1: 1.3% loaded (98.7% idle) Websense1# info memory Free physical memory 8.7%

Collecting statistics

Syntax	debug stats [-d] [-i interval | -n count]
Description	This command allows a user to collect statistics about network behavior over time. It does so by running info stats at specified intervals for a given number of times. The collected statistics are saved in a CSV file for easy manipulation and analysis in spreadsheet tools such as Microsoft Excel. The resulting file is saved as opt/pa/log/collect_stats.csv.gz
Parameters	-d: delete previously recorded statistics information file, if one exists interval: the interval in seconds between two runs that take a snapshot of the statistics. count: how many times the statistics snapshot should be taken.
Default	The default interval is every 60 seconds. The default number is 1440 (which is the equivalent of 24 hours of statistics when the default interval of 60 is selected).
Example	Websense# debug stats

Configure or show the DNS server(s)

Syntax	dns [list | delall] dns [{add | del}] ip addr]
Description	Lists, adds, or deletes DNS servers.
Parameters	list: displays a list of DNS servers in the protector delall: deletes all DNS servers set in the protector add: adds a DNS server specified by its IP address to the protector del: deletes the DNS server denoted by the specified IP address
Default	N/A
Example	Websense1# dns add 192.168.15.3

Configure or show the default domain name(s)

Syntax	domain [list | delall] domain [{add (-m) | del} <domain>]
Description	Lists, adds, or deletes default domain names in the protector.
Parameters	list: displays a list of configured default domain names in the protector delall: deletes all default domain names set in the protector add: adds a default domain name specified by domain to the protector Use the -m switch to set a domain as main. The main domain is the domain that the protector is actually is a member of. Without the –m switch a 'search domain' is created. For the protector to resolve a domain this domain is searched as well. There may be many 'search domains' but only one main domain. del: deletes the default domain name denoted by domain from the protector
Default	N/A
Example	Websense1# domain add example.com

Configure or show the default gateway

Syntax	gateway ipaddr gateway [list | delete]
Description	By default, displays the current defined gateway. Using the parameters, it is possible to set or delete the default gateway of the protector.
Parameters	ipaddr: when given, the ipaddr is used as a default gateway for the protector. list: shows the configured default gateway. delete: deletes the defined default gateway. Please note that if this command is run from a remote SSH session, the session may terminate.
Default	N/A
Example	Websense1# gateway 192.168.10.254

Configure or show the host name

Syntax	hostname [name]
Description	Displays the current host name. The parameter can also set a unique name by which to identify the protector.
Parameters	name: if given, the host name is set to the name given. Otherwise, the host name is displayed.
Default	N/A
Example	Websense1# hostname 1Tokyo

Configure or show interface information

Syntax	iface [list] iface ifname [ip ipaddr] [prefix prefix] [bcast bcastaddr] [speed speed] [duplex duplex] [mgmt] [enable|disable] [descr description]
Description	Configures and displays the protector's network interface information. When invoked without arguments or with the list option, the command displays a list of all available interfaces in the system. When invoked with only an interface name, the command shows detailed information about that interface. Any other invocation method configures the interface denoted in ifname. Note: When using this command to configure the management interface, we recommend you use a console connection to the protector (and not a remote SSH connection). Using the latter may terminate the session to the protector. In addition, if the IP address is changed, it may be required to re-establish secure communication with the Websense Data Security Server (by re-running the configuration wizard).
Parameters	ip: the IP address denoted by ipaddr is assigned to the interface. This option is valid only for the management interface. When setting ip, the prefix and bcast options must also be set prefix: network mask of the interface. For example: 24 (will assign 255.255.255.0 mask to the interface) bcast: broadcast address of the interface. For example: for an interface with the IP address 192.168.1.1/24, the broadcast address is usually 192.168.1.255. speed: interface link speed. Available speeds: auto, 10, 100, 1000 duplex: interface link duplex. Available duplex options: auto, half, full mgmt: sets the interface as the management interface of the protector. The previously defined management interface can no longer be used for management purposes. enable, disable: enables or disables the interface (default is enable) descr: assigns a short description for the interface. Note that if the description contains spaces, it must be enclosed within quotation marks ("").
Default	eth0
Example	Websense1# iface eth0 ip 10.100.16.20 prefix 24 bcast 10.100.16.255 mgmt enable

Add or delete routing information

Syntax	route list route add {destination network | destination ip} {via ip | dev device} route del {destination network | destination ip} {via ip | dev device}
Description	Adds or deletes route entries in the protector. When adding or deleting routes to networks, use the x.x.x.x/prefix format. For example: 192.168.1.0/24.
Parameters	list: displays the routing table of the Protector add: adds a route to a network or IP del: deletes a route to a network or IP
Default	N/A
Example	Websense1# route add 100.20.32.0/24 via 10.16.10.10 Websense1# route add 172.16.1.0/24 dev eth0

Manage users

Syntax	user add {username} profile {profile} pwd {password} user del {username} user mod {username} [profile {profile}] [pwd {new password}] user list
Description	The user command allows you to define additional users who can access the system. Each user has a profile that defines the operations available to users. Available profiles: admin: all commands are allowed netadmin: only networking related commands are allowed policyadmin: only the policy command is allowed The list of commands each profile can run cannot be changed.
Parameters	add: add a user with the given profile and password del: delete a user mod: modify a user's profile and/or password list: display a list of all defined users and their profiles
Default	N/A
Example	Websense1# user add Jonny profile netadmin pwd 123qwe

Filtering monitored networks

You can use the Websense Management Interface to define which networks are monitored by the protector.

This CLI command enables advanced filtering of monitored networks.

Note  Websense recommends that you test the filter using a tcpdump command before setting the filter to ensure that the filter expression is recognized by the protector.

Syntax	filter [show | set rule | delete]
Parameters	show: displays the current active filters - monitored networks set: defines a list of monitored networks delete: deletes previously set filter rules
Default	N/A
Example	Websense1# filter set "tcp and host 10.0.0.1" Sets the protector to monitor all TCP traffic to/from 10.0.0.1 and ignore all other hosts in the network. If VLAN is used, it should be listed first in the filter (vlan and tcp, not tcp and vlan).

Configuring NTP support

The protector includes an NTP package which contains a NTPD service and a set of related utilities.The service is turned off by default. Enabling the NTP service is simple, but requires very customer-dependent configuration settings. Thus, the following procedure is a general description of the steps that should be executed in order to enable the service.

The NTP service requires root user permissions.

For further NTP configuration details, refer to: http://en.linuxreviews.org/NTP_-_Howto_make_the_clock_show_the_correct_time, or http://doc.ntp.org/4.2.2/, and many other sites on the Web.

Configuration

1.	Decide and define the NTP server(s) to be used.

2.	Firewall configurations (considering the bullet above): NTP port is UDP 123.

3.	Edit the relevant configuration files (/etc/ntp.conf, etc`).

Execution

1.	Perform an initial time synchronization. This can be done manually via the protector's Wizard, or by using the 'ntpdate' utility.

2.	From the command line, type chkconfig ntpd on|off to start/not start the service each time the protector machine is started.

3.	Type service ntpd start|stop|restart to explicitly start/stop/restart the service.

4.	Type ntpq -p to verify the synchronization is correct.

Data Security Protector CLI