How to create an executable bash script for these commands?

Question

I wish to create an executable bash script that will run the following commands as root, that is, using sudo su

iptables-save | awk '/^[*]/ { print $1 } 
                     /^:[A-Z]+ [^-]/ { print $1 " ACCEPT" ; }
                     /COMMIT/ { print $0; }' | iptables-restore

My first attempt at bash scripting is as follows:

#!/bin/bash
sudo su
iptables-save | awk '/^[*]/ { print $1 } 
                     /^:[A-Z]+ [^-]/ { print $1 " ACCEPT" ; }
                     /COMMIT/ { print $0; }' | iptables-restore
sleep 3;
exit 0

Could someone correct the above and make it workable?

Answer 1

Shell scripts aren't quite the same as typing at a terminal.
What's going to happen here is that iptables-save is going to wait for sudo su to complete, and then run. What you want is to run iptables-save inside the sudo.

Secondly, sudo su is among the ranks of 'useless use of' examples. The proper equivalent is
sudo -i.

There are 2 approaches you can take to solving this.

Method 1

sudo -i <<'EOF'
iptables-save | awk '/^[*]/ { print $1 } 
                 /^:[A-Z]+ [^-]/ { print $1 " ACCEPT" ; }
                 /COMMIT/ { print $0; }' | iptables-restore
EOF

This basically launches a root shell and sends that command through the shell.
The reason we don't don't just add a sudo in front of both the iptables-save and iptables-restore commands is that it will launch 2 sudos at the same time. This does not work well if they both end up trying to prompt for the password.
So this solution works around the issue by only launching a single sudo.

One line
As requested in your comment, you can do this in a single line, but it becomes much harder to read.

sudo -i sh -c 'iptables-save | awk '\''/^[*]/ { print $1 }; /^:[A-Z]+ [^-]/ { print $1 " ACCEPT" ; }; /COMMIT/ { print $0; }'\'' | iptables-restore'

 

Method 2

sudo -v
sudo -n iptables-save | awk '/^[*]/ { print $1 } 
             /^:[A-Z]+ [^-]/ { print $1 " ACCEPT" ; }
             /COMMIT/ { print $0; }' | sudo -n iptables-restore

This solution runs sudo the first time, without any command, simply a -v. This causes sudo to prompt for your password if your session is expired. Then any commands run within that session expiration window won't require a password. So launching 2 sudos at the same time is no longer an issue as neither of them will prompt (we add -n to make absolutely sure of this. It'll throw an error if it tries).