topic Re: Testing Controls for Bash Scripts in API / CLI Discussion

Testing Controls for Bash Scripts

Nick_Doropoulos — Wed, 13 Nov 2019 08:43:31 GMT

Given the amount of resources a bash script can consume, along with any possible service impact it might have, I have been trying to compile a list of 'testing controls' to benchmark any script against before using it on any Check Point device by carrying out the following steps in a lab environment:

1) Observe the resources being consumed by the script. This can be done by having two additional Putty sessions open and run the following commands :

- watch free -m

- top

2) Ensure that there is no service impact by monitoring critical services such as VPN tunnels etc.

3) Ensure that only a specific group of admins have execution privileges over the script.

I would appreciate other people's feedback on this topic, particularly of guys like @Robert_Decker and @Danny who are well versed in the art of scripting. My point is that I am after a process to follow when creating scripts for Check Point devices in order to get the maximum value while causing the least possible amount of disruption.

Thanks in advance!

Re: Testing Controls for Bash Scripts

Danny — Wed, 13 Nov 2019 09:54:35 GMT

Thanks for the reference. I giggle when even R&D calls my ccc script a „piece of art“. To be honest, I‘m all about continuing my Check Point journey with SmartConsole Extensions, especially as Check Point is on its way to drop expert mode support somewhere in the future. I‘ll tell more about my new project @ CPX 2020 in Vienna if I get confirmed as a speaker.

Re: Testing Controls for Bash Scripts

Maik — Wed, 13 Nov 2019 09:22:51 GMT

Sorry for crashing in for this kinda off topic question... but you mentioned "Check Point is on its way to drop the expert mode entirely somewhere in the future.".
I remember when exactly this question got answered during a CheckMates webinar and the answer was that expert mode will stay - however they plan to move some expert commands to clish (starting with R80.40...?). Where did you hear about the complete drop of expert?

Re: Testing Controls for Bash Scripts

Martin_Valenta — Wed, 13 Nov 2019 10:02:13 GMT

expert commands are on clish since r80.20

Re: Testing Controls for Bash Scripts

Maik — Wed, 13 Nov 2019 10:32:34 GMT

nvm thought this would be an optional package for R80.20 and fully integrated with R80.40. Thanks for the info

Re: Testing Controls for Bash Scripts

Maik — Wed, 13 Nov 2019 10:37:28 GMT

Cant edit my post as I receive an HTTP error when doing so.
Just found sk144112 that still mentions this feature to be manually installed for version<R80.40 https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.SearchResultMainAction&eventSubmit_doGoviewsolutiondetails=&solutionid=sk144112
But enough off topic I guess

Re: Testing Controls for Bash Scripts

PhoneBoy — Wed, 13 Nov 2019 17:59:55 GMT

Directly from R&D.
I've also heard it on a few occasions as well.
I don't think expert mode will be dropped anytime soon, however.

Re: Testing Controls for Bash Scripts

Maik — Thu, 14 Nov 2019 06:42:08 GMT

Thanks for your reply... interesting.