Re: Script to verify route commands - same after reboot?

From: Logan Shaw (lshaw-usenet_at_austin.rr.com)
Date: 09/09/03 

Date: Tue, 09 Sep 2003 08:10:03 GMT

arabub wrote:
> So in short: I don't trust the folks working on these hosts, and I
> want to double-check that the routes are going to be the same after a
> reboot. That's why I am looking for a script to do this.

Well, this is not a complete solution, but you could always do this:

1. Create /etc/init.d/snapshotroutes (linked to
     /etc/rc2.d/S99snapshotroutes), like this:

         #! /bin/sh

         routefile=/var/adm/route-snapshot.boot

         case "$1" in
         start)
             [ -f "$routefile" ] && mv "$routefile" "$routefile".old
             netstat -nr > "$routefile"
         ;;
         esac

         unset routefile

2. Create a script /var/adm/routesnapshotcompare:

         #! /bin/sh

         routefile=/var/adm/route-snapshot
         emailnotify=cluefuladmin@example.com

         netstat -nr > "$routefile".latest

         if diff "$routefile".boot "$routefile".latest >/dev/null
         then
             {
             echo "Warning: routes changed on host `uname -n`:"
             diff "$routefile".boot "$routefile".latest
             } | mailx -s "routes changed on `uname -n`" "$emailnotify"
         fi

3. Put /var/adm/routesnapshotcompare in cron on all servers
     to run every night.

4. If you receive mail that routes have changed on a host,
     go to the host, audit it, and manually ensure that
     the startup scripts, etc. match the routing table. If you
     are satified that they match, then do
     "cd /var/adm && mv route-snapshot.latest route-snapshot.boot"
     and the e-mails will stop.

It's not fully automatic, but it's easy, and hopefully it
will help. (And hopefully the diff will nicely summarize
what you should be looking for.)

Naturally, if you use a lot of dynamic routes, this
approach will be totally useless...

    - Logan

Relevant Pages

  • java.net.Socket doesnt correctly route over VPN tunnel
    ... correct route to the host. ... at java.net.Socket.(InetAddress host, Int32 port, InetAddress ... Ethernet adapter Built-in Ethernet: ... Active Routes: ...
    (microsoft.public.dotnet.vjsharp)
  • Re: LAN routing
    ... I would not mind at all to put a couple of routes in on each of the subnet ... I would like for every host in main Lan to be able to talk to every host on ... Remote Lan = 192.168.101.0/24 ... >> a router at the remote location and setting them on a new IP scheme/ subnet. ...
    (microsoft.public.windows.server.networking)
  • Re: Secure desktop idea?
    ... Subject: Secure desktop idea? ... > allocate and de-allocate routes. ... Does "as needed" mean when a connection is attempted _to_ a host ... If "as needed" means a connection _to_ it, how is it any different than ...
    (Security-Basics)
  • Re: Illinois Supplemental Freeway maps
    ... Aid Primary routes in 1974. ... I also have a copy of the revised route ... Craig and I can host those on midwestroads.com if you would like. ... Just e-mail to webmaster or scott and we'll put them up. ...
    (misc.transport.road)