15.5. TLS Serial Server configuration

15.5. TLS Serial Server configuration
	Chapter 15. System Services

The TLS serial server allows connection via TLS to the FB2500 command-line interface (CLI). The CLI is documented in Chapter 21 and in Appendix J.

You will need a client to send commands to this service. We recommend using our open source client, which can be found on Codeberg. This client supports all the functionality of the FireBrick CLI.

15.5.1. Access control

Access control can be restricted in the same way as the HTTP (web) service, including per user access restrictions.

The example XML below shows the TLS serial server service configured with restricted access :-

<tls-serial allow="10.0.0.0/24 10.1.0.3-98 10.100.100.88 10.99.99.0/24"
          comment="TLS serial service access restricted by IP address"
          local-only="false"/>

Note

By default, the FB2500 will only allow access from machines that are on one of the locally-attached Ethernet subnets^[a]. To allow access from other interfaces, set local-only="false"

15.5.2. Alternative clients

The underlying protocol for communicating with the FB2500 using this service is simply to send text via a TLS stream. However, in order to use all of the features of the CLI, key presses should be sent unbuffered. This is what our own open-source TLS serial client does.

Clients which send 'line buffered' output to the FireBrick can also be used to issue CLI commands, but useful features such as tab-completion, question-mark help, console logging, command editing and command history will be unavailable or will not work as intended.

One readily available line-buffering client that allows this partial functionality is s_client from the OpenSSL package:

openssl s_client -quiet <your_firebrick_ip>:230

Be aware that your login password will be visible on screen when using line buffered clients.

Note

If you're using a client that does local line buffering, all command lines will be echoed back to you and console logging will interact badly with command input. The set line-buffered command (see Section J.1.3) can be used to slightly improve the terminal experience with such a client.


15.4. Telnet Server configuration		15.6. DNS configuration