Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 7 replies
  • Subscribers 29 subscribers
  • Views 1529 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

CLI - which settings are changed?

Guenter

Hi there,

I have to manage a XG Box which was configured by a competitor.

Is there a way to find out which CLI settings a changed by them?

On a Cisco ASA the is a  "sh running-config" command.

THX

Guenter



This thread was automatically locked due to age.
  • 0

    Never had the use case of showing the altered configuration. I assume, there is no way to see this. You would (and should) do a call with the customer to get a current status and review the config. If you think, there is an issue, you should consider to change that (Security or config issue). 

  • 0 in reply to LuCar Toni

    Hi,

    @Never had the use case ...

    Realy, this is my daily/weekly business. Many of my customers are not aware about the config of a firewall. And why should the competitor document all things what they had configured? This is not the reality.

    Cisco, Juniper, Fortinet, PaloAlto - all these manufacures are able to run a "sh running-config" with all current settings.

    I know, Sophos is GUI driven, but there a many settings which are not reflected onto the GUI, like UDP Streamin Timeouts, and so on.

    It is very unpracticable to run for EACH CLI Setting a show command. And in that case we have to compare it with the default settings.

    For SOPHOS, it should be easy to produce a settingslist which differs from the defaults.

    This is a neccessarry - not a feature.

    THX.

  • 0 in reply to Guenter

    Most of my customers, i talked to, have there fixed Partner. Happy you can win customers and take them under your guidelines but that seems not the case for the people i talk to. 

    Agree there is always room for improvements and CLI (cish) not the best documented config. But most of your vendors have a full config interface in CLI, which SFOS does not. You have on CISH basically just config settings, which never made it into the GUI for whatever reason. 

  • 0 in reply to LuCar Toni

    This is a ideal situation which I never had bevore. We win many customers for some reasons. Most of this cases are "cold" takeovers.

    So we have to dive into each CLI setting.

    I mean, this can't be.

    THX

    Guenter.

  • +1 in reply to Guenter

    you could decrypt a config and compare it with a blank appliance config of the same SFOS Version.

    Decryption explained here: https://medium.com/@gmanual/sophos-xg-decrypt-backup-file-2c5bc8d6347f

    This works with win32openssl-1_1_0f if you are on windows.

    But I don't know where you would find console changes in that config. I found several CLI changes in the db.dump file (unencryptedconfig\unencryptedconfig~\.\\conf\backupdata\\device.backup\)

    An other approach would be to study CLI Reference (Hey Sophos where is that documentation for v18?)

    and execute all commands that have a show parameter. No nice work.

  • 0 in reply to LHerzog

    THX - this is very helpful.

    It seems all CLI settings are stored in the tabe tblconfiguration.

    Unbelivable that Sophos is not able to create a simple Tool which shows these settings in on command like, sh cli-changed-settings.

    Mybe it is too simple.

  • 0 in reply to Guenter

    It is not about "Able to create", its about the priority. Because there are other items more important right now. Sophos is currently highly investing in XDR. See: https://community.sophos.com/intercept-x-endpoint/early-access-program/b/blog/posts/xdr---detection-and-investigation-early-access-program and other tools like upcoming V19. 

    As mentioned earlier, never had this query in the first place. CLI is something still under review, how to interact with this better and properly redesigning the CLI for a configuration API.