InnGate 3 Command Line Interface Reference r1.01

8/11/2019 InnGate 3 Command Line Interface Reference r1.01

1/26

INNGATE 3

COMMAND LINE INTERFACE REFERENCE

DOCUMENT RELEASE 1.01


2/26

Connectivity Made Easy Page 2 of 26

InnGate 3 Command Line Interface Reference

This is a reference guide of the commands available in the Command LineInterface. Many of the commands have direct GUI feature equivalents

accessible via the web-based Admin GUI and the purpose of these featuresfor setting up the InnGate 3 is discussed in the main Administrators Manual.This document is intended for system and network administrators who will beconfiguring and administrating the InnGate 3.

Copyright 2002 - 2010 Advanced Network Technology Laboratories Pte Ltd.All rights reserved.


3/26


TRADEMARKS AND ACKNOWLEDGEMENTS

The following trademarks and acknowledgments apply to the following:The InnGate system and TruConnect technology are products andtechnologies of Advanced Network Technology Laboratories Pte Ltd,(ANTlabs). Windows and Microsoft are registered trademarks of

Microsoft Corporation. Solaris is a registered trademark of SunMicrosystems. All other products mentioned in this manual aretrademarks of their respective owners.

DISCLAIMER

No part of this manual may be copied, distributed, transmitted,transcribed, stored in a retrieval system or translated into any humanor computer language, in any form or by any means, electronic orotherwise, without the express written permission of ANTlabs.

The software and accompanying written materials (includinginstructions for use and this document) are provided as is withoutwarranty of any kind.

ANTlabsdoes not warrant, guarantee or make any representationsregarding the use, or the results of the use, of the software or writtenmaterials in terms of correctness, accuracy, reliability, trend orotherwise. ANTlabsreserves the right to make changes without furthernotice to any products described herein to improve reliability, functionor design. This documentation is copyrighted and may not be alteredwithout written consent from ANTlabs.

ANTlabsreserves the right to prosecute companies or individuals whomake, distribute or use illegal copies of this software system and itsaccompanying documentation.

Release Date: July 2010Document Reference No: IG3-CLI


4/26


CONTENT

Chapter 1 ................................................................................................ 6INTRODUCTION ................................................................................. 6

1.1 Overview ............................................................................... 61.2 Command Syntax ................................................................... 6

Chapter 2 ................................................................................................ 8

NETWORK SERVICE COMMANDS.......................................................... 82.1

dns ........................................................................................ 8

2.2

email ..................................................................................... 8

2.3 inetd ..................................................................................... 92.4 ip .......................................................................................... 92.5 ntpd ..................................................................................... 102.6 netpx_conf ............................................................................ 112.7

syslog ................................................................................... 14

2.8

webpx .................................................................................. 15

2.9 websv ................................................................................... 16Chapter 3 ............................................................................................... 17

SYSTEM SECURITY COMMANDS .......................................................... 173.1

webadm ............................................................................... 17

3.2 wadacc ................................................................................. 173.3 enasup ................................................................................. 183.4 passwd_sup .......................................................................... 18

Chapter 4 ............................................................................................... 19STATUS AND LOG COMMANDS ........................................................... 19

4.1

status ................................................................................... 19

4.2 sessions ................................................................................ 194.3 session_log ........................................................................... 194.4 show .................................................................................... 194.5

usage_log ............................................................................. 20

4.6 users .................................................................................... 20Chapter 5 ............................................................................................... 21

SYSTEM COMMANDS .......................................................................... 21

5.1 help ...................................................................................... 215.2 reboot .................................................................................. 21

5.3

shutdown .............................................................................. 215.4 restart .................................................................................. 21

5.5

sshtun .................................................................................. 22

5.6

check ................................................................................... 22

5.7 exit....................................................................................... 225.8 save_snapshot ...................................................................... 235.9 restore_firmware ................................................................... 235.10

restore_snapshot ................................................................... 23

Appendix A ............................................................................................. 24

UNIX SHELL COMMANDS .................................................................... 24


5/26


PREFACE

AUDIENCE

This manual is intended for administrators who will be responsible for theinstallation and configuration of the InnGate.

This manual details the commands accessible via the Command LineInterface.

Administrators are expected to have a good working knowledge of networksand TCP/IP. Knowledge of the operating environment and characteristics ofthe systems used in the deployed networks are also useful.

RELATED DOCUMENTATION

You may refer to the ANTlabshomepage at http://www.antlabs.com/ forother related materials and documents released by ANTlabs.

FEEDBACK AND COMMENTS

ANTlabswelcomes all comments and suggestions on the quality and

usefulness of this document. Our users feedback is an important componentof the information used for improvement of this document.

Please include in your feedback:

Name Title Company Department E-Mail

Postal Address Telephone Number Document Title & Release No Document Reference No. Comments/Feedback

Also, please include the chapter, section and/or page number when referringto specific portions of the document.

Send your comments via email to [email protected]


6/26


Chapter 1

INTRODUCTION

1.1 Overview

This documentation provides a reference for the various commands that areavailable to aid in configuring the InnGate.

Many of the commands have direct feature equivalents accessible via theweb admin and the purpose of these features for setting up the InnGate isdiscussed in the main Administrators Manual. This document only provides areference guide for the command usage in the CLI.

Each category of associated commands is described in individual chapters.The various categories are as follows:

1. NETWORK SERVICE COMMANDS Commands related to settingup the InnGate for operation on the network. See Chapter 2.

2. SYSTEM SECURITY COMMANDS Commands that manage systemsecurity such as the administrator account details like username,password, etc. See Chapter 3.

3. STATUS AND LOG COMMANDS Commands that show theoperational status, various system settings and historical logs. SeeChapter 4.

4. SYSTEM COMMANDS System commands manage various systemfunctions such as optimization, services, database, etc. See Chapter 5.

In addition, the CLI also supports a subset of the Unix Shell commands whichare listed in 5.8.

The InnGate features 2 levels of CLI access; operator mode andsupervisor mode (see Section 3.3). Commands available in the operator modeare a subset of those in the supervisor mode.

1.2 Command Syntax

The basic command syntax is as follows:

command keywor d [ opt i on ]


7/26


Some keywords are common throughout the majority of commands and aredescribed in the table below. The keywords apply to most commands except

the showcommand, where the syntax is different. Also, some system

commands like shutdown, r eboot and passwor ddo not have any options.

Keywords Descriptionshow View the existing configurations.show conf i g View the existing configurations in command syntax.set Modify the existing configurations.enabl e Enable a feature that is already set.di sabl e Disable a feature, retaining the value set (if any).del et e Delete the logged reports (This keyword is specific to

the commands in reports section).


8/26


9/26


The InnGate has its own SMTP server and therefore does not require anyexternal server. However, email forwarding to and external SMTP servce ispossible. The IP address of the external SMTP server can be specified using

the f or war d_t o_i p option with keyword set .

Set Options Descriptionadmi n_emai l Postmasters email account.f or war d_t o_i p IP address of the external SMTP server.

Enable/Disable Optionssyst em_emai l Enable/disable use of system administrators

email (in place of postmasters email).f or war d_t o_i p Enable/disable email forwarding to the

external SMTP server.

2.3 inetd

The InnGate FTP and Telnet services are configured with this command. Bydefault, FTP and Telnet access is enabled.

This command is only available in supervisor mode (see Section 3.3).

Usage: i net d show [ f t p/ t el net ]i net d show conf i gi net d enabl e/ di sabl e f t p/ t el net

Example: i netd showi net d show f t pi net d show t el neti net d show conf i gi net d di sabl e f t pi net d enabl e t el net

Enable/Disable Options Descriptionf tp Enable/disable FTP access.

t el net Enable/disable Telnet access.

2.4 ip

Using this command, the upstream interface of the InnGate can beconfigured.


Usage: i p show [ devi ce1 devi ce2 . . . ]

i p show conf i gi p set devi ce_name [ i p i p ] [ net mask nm ]


10/26


11/26


2.6 netpx_conf

This command allows you to configure a port forwarding service which can beuseful if you want to allow upstream access to downstream services.

For example, there may be a downstream host running an FTP service thatneeds to be accessible to upstream users. But because the downstreamnetwork might be a private network that is not visible to the upstream, therewill be no way for the upstream user to connect to the FTP service. For adownstream private network, upstream users will only see the WAN IP of theInnGate and not the individual downstream hosts. Port forwarding allows youto assign a Port Number on the InnGates WAN interface so that a userconnecting to the InnGates WAN IP + Port Number will actually have theirtraffic forwarded to the downstream service.

Port forwarding can also be used as a means to conserve public IP addresses;as opposed to assigning a public IP for each downstream service host.

To setup the net proxy, you will need to perform the following steps:

1. Setup the proxy environment Configure the interface to listen forincoming connections and general connection settings.

2. Create the proxy entries Configure the entries for the hosts whichrequire the proxy service.

3. Create action filters Configure filters that perform an action whenthe filter criteria match the incoming connection attempt.

The command syntax is first discussed here with subsequent examples toillustrate its use according to the steps above.

Usage: net px_conf

Wher e obj ect : = { env | pr oxy_r ul e | f i l t er | sessi on }

command( env) : = { get | set | l i st }

key : = { pr oxy_devi ce | t cp_t i meout |

udp_t i meout | t cp_max_conn | udp_max_conn |

f i l t er _act i on }

command( pr oxy_r ul e) : = { l i st | cl ear

| del ete

| add

}


12/26


command( f i l t er ) : = { l i st | i nser t

| append

| updat e | del et e

|

del et e_f i r st | del et e_al l

command( sessi on) : = { l i st }

f i l t er _spec1 : =

f i l t er _spec2 : =

t ype : = { t cp | udp }

Note: When specifying an IP address for the source network snet , you may

use CIDR format (e.g. 192. 168. 123. 50/ 24where / 24 is the subnet

mask prefix).

Example (netpx_conf env):

net px_conf env l i st

netpx_conf env set t cp_t i meout 30netpx_conf env get pr oxy_devi ce t cp_t i meout

The above commands allow you to list/store/retrieve the proxyenvironment variables and their associated settings. The environmentvariables are explained here:

Variables Descriptionpr oxy_devi ce The interface on which to listen for incoming

connections.

t cp_t i meout Timeout (in seconds) for TCP connectionattempts.udp_t i meout Timeout (in seconds) for UDP connection

attempts.Max TCP Connect i ons Maximum number of TCP connections allowed.Max UDP Connect i ons Maximum number of UDP connections allowed.f i l t er _ act i on The action applied on receipt of an incoming

connection attempt.

Example (netpx_conf session):

net px_conf sessi on l i st t cp


13/26


The above command lists the current active TCP net proxy sessions.

Example (netpx_conf proxy_rule):

net px_conf pr oxy_r ul e l i st t cp

The above command lists the rules applied to TCP proxy connections.

netpx_conf pr oxy_r ul e add t cp 92 10. 68. 12. 24 23 et h1net px_conf pr oxy_r ul e del et e t cp 92

The first of the two above commands adds an entry to listen for

incomingTCPconnections on port 92and forward them to the host

with IP address 10. 68. 12. 24on port 23(telnet) which can be found

on the network accessible through interface et h1. The secondcommand deletes the entry just created.

net px_conf pr oxy_r ul e cl ear udp

The above command clears all UDP connections entries currentlyapplied.

Example (netpx_conf filter):

net px_conf f i l t er l i st t cp

The above command lists all the filters currently applied to TCP proxyconnections. An example of the output generated by the abovecommand is shown here:

Fi l t er 1:Act i on : ACCEPTSour ce Network : 123. 123. 123. 0/ 24Sour ce Por t : ANY

Tar get Por t : ANYFi l t er 2:

Act i on : ACCEPTSour ce Net wor k : 10. 12. 10. 1Sour ce Por t : 30

Tar get Por t : 20

To add a filter to the sample list above you may formulate a commandsuch as the one below:

net px_conf f i l t er i nser t t cp 1 DENY 10. 10. 1. 1 ANY 60


14/26


The above command inserts the filter before Filter 2. Using the sampleoutput above, the list of filters can be though of as an array withposition index 0 occupied by Filter 1 and position index 1 occupied byFilter 2. As such the above command will insert the filter before Filter2, pushing Filter 2 to position index 2 and automatically renamed to

Filter 3. If you wish to use insert after the position, use the appendcommand instead.

Note: Because of the array-based representation described above, ifyou are inserting the very first entry into an empty list, the positionindex should be 0 not 1.

This filter is matched when a host with IP address 10. 10. 1. 1

attempts to make aTCPconnection to the InnGate on port 60. When

matched, the connection is denied, as specified by the action. The

order of precedence is simple, the first filter matched is the one that isapplied.

Note: While the system allows you to specify the source port, becausemost outgoing connections use ephemeral ports, it is more common to

set the source port to ANYindicating that all connection attempts from

10. 10. 1. 1irregardless of its source port will match this filter.

net px_conf f i l t er del et e t cp 1

The command above deletes the TCP filter entry at position index 1.

net px_conf f i l t er del et e_f i r st t cp DENY 10. 10. 1. 1ANY 60

The command above deletes the first TCP filter entry that matches thecriteria specified. If you wish to delete all filter entries that match the

criteria (i.e. duplicate entries), use the del et e_al l command

instead.

2.7 syslogUsing this command, remote logging of certain system events to a specifiedsyslog server can be configured.


Usage: sysl og showsysl og show conf i gsysl og set ser ver addr esssysl og enabl e/ di sabl e ser ver

Example: sysl og show


15/26


sysl og show conf i gsysl og set server 192. 136. 112. 1sysl og enabl e ser versysl og di sabl e ser ver

The remote syslog machine must be configured to accept logs through FTPand email delivery.

Set Options DescriptionSer ver Set IP address of the syslog server.

Enable/Disable OptionsSer ver Enable/disable remote logging.

2.8 webpxUsing this command, the InnGate can be configured to use either a directconnection or specify a web proxy. A comma-separated list of valid proxiesand associated ports can be specified. Also, you can set the contact emailaddress presented to the user when a proxy error occurs.


Usage: webpx showwebpx show conf i g

webpx set [ pr oxy addr ess ] [ admi n_emai l emai l ]webpx enabl e/ di sabl e [ pr oxy] [ syst em_emai l ]

Example: webpx di sabl e pr oxywebpx enabl e syst em_emai lwebpx set pr oxy pr oxy1. ant l abs. com: 8080,

pr oxy2. ant l abs. com: 8080 admi n_emai ladmi n_cont act@l ocal host . com

Set Options DescriptionProxy Comma separated list of proxy addresses of theform addr1:port1,addr2:port2,addr3:port3

admi n_emai l Webmasters the email address for proxy errors.

Enable/Disable OptionsProxy Enable/disable use of parent proxy.syst em_emai l Enable/disable use of system administrators

email (in place of Webmasters email).


16/26


2.9 websv

Using this command, parameters for the web server can be configured.


Usage: websv showwebsv show conf i gwebsv set emai l emai l websv enabl e/ di sabl e syst em_emai l

Example: websv showwebsv show conf i gwebsv set emai l t est @ant l abs. comwebsv enabl e syst em_emai l

................................................................................................................

Set Options DescriptionEmai l Webmasters email address for web server

errors.

Enable/Disable Optionssyst em_emai l Enable/disable use of system administrators

email (in place of Webmasters email).


17/26


Chapter 3

SYSTEM SECURITY COMMANDS

3.1 webadm

Using this command, the administrators account details such as user id, emailaddress and password for the web admin can be configured.


Usage: webadm show

webadm show conf i gwebadm set [ name i d ] [ passwor d] [ emai l addr ess ]

Example: webadm showwebadm show conf i gwebadm set name j ohntan passwor d emai l

anywher e@ant l abs. com

The default value for user id is r oot and password is admi n.

Set Options Descriptionname Set system administrators user id.passwor d Set system administrators account password.emai l Set the email address of the administrator.

3.2 wadacc

Restrictions on which IP addresses can have access to the web admin can besetup here.


Usage: wadacc showwadacc enabl e/ di sabl e [ deny_downst r eam/ i p_cont r ol ]

Example: wadacc showwadacc di sabl e deny_downst r eam

wadacc enabl e i p_cont r ol

Set Options Description

i p_cont r ol Configure the IP addresses that are allowed toaccess the web admin from the upstream.


18/26


Enable/Disable Optionsdeny_downst r eam Enable/disable access from downstream.i p_cont r ol Enable/disable upstream IP access control list.

3.3 enasup

The InnGate features 2 levels of CLI access; operator mode and supervisormode. Commands available in the operator mode are a subset of those in thesupervisor mode.

This command enables the user to enter into the supervisor mode. Afterentering the command, a prompt for a password will appear.

Usage: enasup

3.4 passwd_sup

This command changes the supervisor password. After entering thecommand, it prompts you for the new password.


Usage : passwd_sup


19/26


Chapter 4

STATUS AND LOG COMMANDS

4.1 status

This command displays information about the current system status.

Usage: st at us show

Example: st atus show

4.2 sessionsThis command displays the real-time information about the currently loggedin sessions.

Usage: sessi ons show

Example: sess i ons show

4.3 session_log

This command displays a historical trace of sessions that were previouslyactive. You can also delete the log.

Usage: sessi on_l og showsessi on_l og del et e

4.4 show

This command acts as a wrapper for displaying the configurations of all thecommands listed above.

The show set t i ngs command is equivalent to showand the

show conf i g command is equivalent to show conf i gas

was discussed in Section 1.2.

Usage: show set t i ngs [ command_name]show conf i g [ command_name]show sess i onsshow user sshow sessi on_l og

show usage_l ogshow st atus


20/26


21/26


Chapter 5

SYSTEM COMMANDS

5.1 help

Displays the list of supported commands and provides a description for eachcommand.

Usage: hel p [ command]

Example: hel p r eboot

5.2 reboot

This command is used to reboot the InnGate. You will be prompted to confirmthe action.


Usage: r eboot

5.3 shutdown

This command is used to shutdown the InnGate. You will be prompted toconfirm the action.


Usage: shutdown

5.4 restart

Use this command to restart any service when troubleshooting.


Usage: r est ar t [ ser vi ce_name]

Where [ servi ce_name] is one of the following:

ant _aut h_t i mer ant _aut h_i nt upd ant mgr

ar pd Webser ver dnsmai l Snmp


22/26


5.5 sshtun

In some network configurations, the InnGate may reside in an internal scopeand therefore assigned a private IP address. In such a case, Internet boundtraffic originating from the InnGate (and other clients from the internal scope)would most likely be NATed onto the Internet. In such a scenario, an externalhost which may need to access the InnGate from the Internet will not be ableto do so.

This command uses the port forwarding feature of SSH to create a tunnelfrom the InnGate (SSH client) to the external host (SSH server) so that theexternal hosts applications can subsequently communicate with the InnGatethrough the tunnel.

Usage: ssht un user i d r emot e- i p r emot e- por t l i st en- por t

Example: ssht un guest 123. 44. 55. 66 5468 1842

The above command specifies that port 5468 on the remote host123.44.55.66 is to be forwarded to port 443 (HTTPS) on theInnGate. Once executed, applications on the remote host canaccess the InnGates HTTPS by connecting to port 5468 on theremote host.

5.6 check

This command checks on the status of the httpd and squid daemon processesand restarts them if they are not active currently or abnormally terminated.

Usage: check syst em

This command also checks, repairs and optimizes all the mysql databasetables. It can be invoked occasionally to optimize the database performance.

Usage: check dat abase

5.7 exit

This command terminates the current CLI shell. When in supervisor mode,exi t will terminate the supervisor shell and return to operator mode shell.

Usage: exi t


23/26


5.8 save_snapshot

Use this command to save a snapshot of the current state of the InnGate.Upon executing this command, the InnGate will reboot to save the snapshot.


Usage: save_snapshot

5.9 restore_firmware

Use this command to restore the InnGate to its factory default state. Uponexecuting this command, the InnGate will reboot to perform the restoration.


This command is only available via the serial port connection.

Usage: r est or e_f i r mwar e

5.10 restore_snapshot

Use this command to restore the InnGate to the previously saved snapshot.Upon executing this command, the InnGate will reboot to perform therestoration. If a snapshot is not found, no changes will be made on the

InnGate.


Usage: r est or e_snapshot


24/26


Appendix A

UNIX SHELL COMMANDS

Listed below are the additional commands that are accessible via theinterface. Supervisor-Only commands are only available in supervisor mode.Operator commands are available in both operator and supervisor mode.

Supervisor-Only

Command Descriptionar p Manipulate the system ARP cachechmod Change file access permissions

cp Copy filesedi t Open a text editorl n Make links between filesmai l q List pending mails in the mail queuemenu Configure the system through a menu-based interfacemkdi r Make new directoriesmv Move (rename) filespasswd Change CLI operator passwordpasswd_f t p Change password of ftp-only userr m Remove files or directoriesr mdi r Remove empty directoriest ouch Change file timestamps


25/26


Operator

Command Descriptioncat Create and display short filescd Change current working directory

cl ear Clear the display screendf Report filesystem disk space usagef r ee Display information about free and used memory on the

systemhead Display the first part of filei f st at Display the Internet statisticsl s List directory contentsnetstat Displays the network connections, routing tables, interface

statistics, masquerade connections, netlink messages andmulticast memberships

nsl ookup Query Internet name server non-interactively. Theinteractive interface is disabled.

pi ng Send ICMP ECHO_REQUESTS packets to network hostspmst at Display high-level system performance overviewps Report process status informationshd Show the current working directoryr z Receive filessz Send one or more filest ai l View the last part of the input filet cpdump Dump traffic on a network

t el net Display user interface to the TELNET protocolt er mi nal Change terminal typet r acepat h Traces path to a particular destination discovering MTU

along this patht r acer out e Print the route packets take to network hostver si on Display version of the CLIvl andump Display VLAN information


26/26

InnGate 3 Command Line Interface Reference r1.01

Documents

Transcript of InnGate 3 Command Line Interface Reference r1.01