Page 1 of 1

Enable firewall rule via SSH

Posted: Mon Dec 25, 2017 12:07 am
by BrandonSk
Hello all,

I am trying to enable a firewall rule via ssh, but for some reason this is not working.
What I have:
-> a user who can ssh into the mikrotik box (let's call him autobot)
-> the user uses ssh key for authentication (passwordless, because it's run from script)
-> for testing purposes the autobot user for now belongs to the "full" group

What IS working:
-> ssh login is working, I can login into the mikrotik and execute commands
-> once logged in I can enable the firewall rule by running:
/ip firewall nat enable [/ip firewall nat find comment="enable me"]
-> I can run a command as a direct input of the ssh command, for example
ssh -i autobot_private_rsa autobot@10.10.10.1 /system script add name=test
(creates an empty script named test)

What IS NOT working:
-> when I try to execute the enable firewall rule command from above as a direct input of the ssh
ssh -i autobot_private_rsa autobot@10.10.10.1 /ip firewall nat enable [/ip firewall nat find comment="enable me"]
I was searching the web but I could not find a similar issue mentioned anywhere. Most searches lead to links dealing with enabling ssh access and similar.
Reading through the wiki I did not find a note which would mention that such operation is not allowed via ssh (I thought it could be perhaps disallowed for security reasons), but maybe I've missed it.

So now I am stuck. In console it works, but direct execution via ssh not (but other commands do work this way).
Your help is appreciated!

EDIT:
Seems that there is a parsing problem or perhaps I need to escape something.
If I change the comment to "enable_me", then everything works as expected.
So, if I replace spaces with underscores, then it is ok.
But still would like to know how this could be done with comments containing spaces.


Thank you,
Brandon.

Re: Enable firewall rule via SSH  [SOLVED]

Posted: Mon Dec 25, 2017 2:19 am
by BrandonSk
OK, so it turns out to be a linux quoting issue rather than mikrotik related one.

So for anyone coming across the smae thing, here is how to get it working with comments containing spaces as well.

As I am running the line from a shell script, I defined variable for the command part (note that comment quotes need to be escaped):
STR="/ip firewall nat enable [/ip firewall nat find comment=\"enable me\"]"
ssh -i autobot_private_rsa autobot@10.10.10.1 "${STR}"
Cheers everyone.
B.