Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Replies 170 replies
  • Subscribers 33 subscribers
  • Views 24830 views
  • Users 0 members are here
Options
Suggested

Restricted Advance Shell - examples of challenges

PMParth

Hi Community contributors,

Starting Sophos Firewall v19, with the addition of many comprehensive logging enhancements in the GUI, and in-line with industry best-practices, access to the Advance Shell is restricted to licensed commercial versions of the product.

Partners and certified architect engineers have an option with Not-for-Resale license to set up labs or customer PoC with unrestricted advanced shell. Also, Sophos Support is able access the Advanced Shell via support access channel. Hence, in case of critical issues, support can still can access it.

Sophos Firewall has been incrementally improved since v18 with comprehensive logging enhancements in the GUI (Better search, filtering, configurations, SD-WAN logs, VPN logs, gateway logs etc). However, we acknowledge that Advance Shell restriction might have created challenges in certain database related configurations, especially for home users.

Please help us understand the specific examples of challenges you face due to this restriction - configurations where GUI and console tools are reaching the limits. We will suggest the possible workaround for the specific scenario. We will also plan and gradually improve the product for those scenario.

Sincerely,

Sophos Firewall Product Team

Parents
  • 0

    Hi there,

    So industry best practices apply to unsupported home users? Fully licensed admin can bork their appliance and support will fix it and industry best practices seem moot?

    Here are my use cases that I use shell for all the time.

    1.Run top, just to check whats happening on my machine including hung daemons etc which can happen with any software.

    2. Run iftop to get a quick snapshot of whats happening on my network. 

    3. Change different kernel parameters like swappiness and change my IO scheduler to noop since I run under esxi.

    4. Look at logs since its much easier to grep them in the shell.

    5. People have mentioned WAF but luckily UTM is not EOL yet.

    There maybe other reasons but other than industry best practices, can you guys give a solid reason for restricting home license only. Unless theft of software is a big issue and you guys can't fix it by using better methods. This one is a total head scratcher.

    Regards,

    Bill

  • 0 in reply to Billybob

    I don't understand your confusion: Sophos needs to make money, and they give more support and more features to folks who pay them. Home users get free firewall software that is commercial-quality with few restrictions, which I'm not aware any other major vendor (Fortinet, Cisco, PAN, etc) provides.

    There is no "theft of software" issue: Home is free. There may be issues with non-home users using the free version -- which is quite capable and can run on fairly powerful hardware -- instead of paying. But "better methods" to prevent or discourage this would involve intrusive mechanisms. Would you want your home version to shut down or throttle throughput because it thinks it detects corporate use by you? This approach is a train wreck in the making that would generate a lot of issues and complaints. Better to remove some features that commercial users would need and home users don't need (though they may want/appreciate them).

    Also, free folks who bork their system are not actually free. They come here and poorly explain what's going on and take a lot of time and effort from volunteers and Sophos staff as well.

    Your points are valid desires -- which I share -- but they aren't really required-to-haves for a free home system. For a hobby, pfsense or OPNsense make a lot of sense -- particularly if you already have capable hardware sitting around, and you can customize it to your hearts content.

Reply
  • 0 in reply to Billybob

    I don't understand your confusion: Sophos needs to make money, and they give more support and more features to folks who pay them. Home users get free firewall software that is commercial-quality with few restrictions, which I'm not aware any other major vendor (Fortinet, Cisco, PAN, etc) provides.

    There is no "theft of software" issue: Home is free. There may be issues with non-home users using the free version -- which is quite capable and can run on fairly powerful hardware -- instead of paying. But "better methods" to prevent or discourage this would involve intrusive mechanisms. Would you want your home version to shut down or throttle throughput because it thinks it detects corporate use by you? This approach is a train wreck in the making that would generate a lot of issues and complaints. Better to remove some features that commercial users would need and home users don't need (though they may want/appreciate them).

    Also, free folks who bork their system are not actually free. They come here and poorly explain what's going on and take a lot of time and effort from volunteers and Sophos staff as well.

    Your points are valid desires -- which I share -- but they aren't really required-to-haves for a free home system. For a hobby, pfsense or OPNsense make a lot of sense -- particularly if you already have capable hardware sitting around, and you can customize it to your hearts content.

Children
Unfiltered HTML