[BUG] so-firewall usage displays addhostgroup command, which is currently non-operational

[luehm]

Version

2.4.160

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

airgap

Hardware Specs

Meets minimum requirements

CPU

4

RAM

16

Storage for /

64

Storage for /nsm

100

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

The so-firewall utility lists the addhostgroup command in the usage / help output, however this functionality appears to have been removed from the script (seen to be present in 2.3).

Provided output:

Usage: /sbin/so-firewall [OPTIONS] <COMMAND> [ARGS...]
  Options:
   --apply         - After updating the firewall configuration files, apply the new firewall state

  General commands:
    help           - Prints this usage information.
    apply          - Apply the firewall state.

  Host commands:
    includehost    - Includes the given IP in the given group. Args: <GROUP_NAME> <IP>
    addhostgroup   - Adds a new, custom host group. Args: <GROUP_NAME>

  Where:
   GROUP_NAME    - The name of an alias group (Ex: analyst)
   IP            - Either a single IP address (Ex: 8.8.8.8) or a CIDR block (Ex: 10.23.0.0/16).

Observed supported commands within bash script:

  commands = {
    "help": showUsage,
    "includehost": includehost,
    "removehost": removehost,
    "apply": apply
  }

I attempted to determine when and why this functionality was removed, but was unable to discover in the git history, discussions, or issue reports. If this is a slight typo in the usage / help output, I'd be happy to push up a PR to remove.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

This should be done in SOC now - https://docs.securityonion.net/en/2.4/firewall.html#creating-a-custom-host-group-with-a-custom-port-group

Having said the above, I passed this on to the devs to look at.