Sophos Firewall database tables

This article was created with the help of a translation tool. Although we check the translation, errors in the content cannot be ruled out. Please bear this in mind when using the content. Thank you for your understanding.

A (complete) list of Sophos Firewall database tables from SFOS v20.0.0.

Introduction

In my past projects, I have repeatedly encountered issues where it is necessary to access the database - be it for information purposes, for scripting, or to correct errors that can no longer be corrected in the GUI. There are several examples. In my research, I never really found what I was looking for.

I had already compiled a few tables via the official community or by analyzing files in the firewall's file system. However, I never had a complete list. In retrospect, I would have been very surprised at the number of tables. The number of tables is almost 540! WOW! 😮

In this post I would like to present you the complete list of tables for SFOS v20.0.0. What you do with it in the end and whether you can do anything with it is entirely up to you. But I think that the list might be quite interesting for some people.

Please note that improper use of SQL commands can lead to errors or total failure of the firewall! Therefore, please use the information with the utmost care and always use a demo environment for testing! Use at your own risk.
I do not guarantee the completeness of the information. But it should be 99.x%.

How do you get the list?

First of all, let's find out how to get the list. To do this, I took a backup and decrypted it as described in my article"Decrypting and unpacking a backup". This backup contains the SQL structure in a file. With a little effort, I imported the structure into a demo environment and... TADA.... the list of tables is available.

If you also want to do this, please note that the PostgreSQL version runs on a Sophos Firewall with version 9.2.24 to avoid any incompatibilities. I have used the oldest version of EDB (9.3.25).

Download

In the following download I offer you the list of SFOS v20.0.0. It is a simple text file in which all tables are listed.

SFOS 20.0.0 DB.txt (Version: 1.0)
10.40 KB
Tags

Other articles from this category

8 Comments

Leave a Reply

Comments are not displayed directly, as they are released in moderation.


  2. Hallo Sebastian,

    weisst du zufällig in welcher Datenbank bzw. Tabelle die STAS LiveUser gespeichert werden?
    Leider kann man über die API immer nur 50 abrufen.
    Ich habe dank deiner Tabellenübersicht leider nur die tbllivesslvpnusers gefunden.
    Danke dir für die tolle Arbeit!
    Markus

    • Hallo Markus,
      nein, eine Tabelle ist mir dazu nicht bekannt. Sorry. Adhoc fällt mir auch kein anderer Weg ein.
      Mit welchem Aufruf holst du die Infos über die API?

      Gruß,
      Sebastian

      • userpassword
        Die 50 sind hartcodiert, dass hat Sophos leider inzwischen bestätigt und man kann auch keine Filter anwenden, dass ist ein known issue 🙁

            • Danke für die Info! Scheinbar gibt es noch eine zweite Datenbank mit SQLite. War mir garnicht bewusst bisher. Es gibt hier auch nicht viele Tabellen wie es aussieht. Diese hier habe ich gefunden:

              tblliveuser
              tblliveuser_otherattr
              tblliveuseraccounting
              tbladminaccess
              tblwifiliveconnections

              Mit diesem Befehl lässt sich herausfinden was die Spaltennamen sind:
              sqlite_client 127.0.0.1 6061 1 "PRAGMA table_info(tblliveuser);"

Popular posts

WAF 1MB limit on Sophos Firewall
Sophos Firewall CLI commands (part 1)
Sophos Firewall FQDN Object Import Generator
Sophos Firewall reverseproxy.log analysis script
WordPress Cookie Plugin by Real Cookie Banner