1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
5
>Security Issues</TITLE
8
CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+
11
TITLE="Advanced Bash-Scripting Guide"
12
HREF="index.html"><LINK
15
HREF="miscellany.html"><LINK
18
HREF="assortedtips.html"><LINK
20
TITLE="Portability Issues"
21
HREF="portabilityissues.html"><META
22
HTTP-EQUIV="Content-Style-Type"
23
CONTENT="text/css"><LINK
25
HREF="common/kde-common.css"
27
HTTP-EQUIV="Content-Type"
28
CONTENT="text/html; charset=iso-8859-1"><META
29
HTTP-EQUIV="Content-Language"
32
HREF="common/kde-localised.css"
34
TITLE="KDE-English"><LINK
36
HREF="common/kde-default.css"
38
TITLE="KDE-Default"></HEAD
46
STYLE="font-family: sans-serif;"
50
SUMMARY="Header navigation table"
59
>Advanced Bash-Scripting Guide: An in-depth exploration of the art of shell scripting</TH
67
HREF="assortedtips.html"
75
>Chapter 36. Miscellany</TD
81
HREF="portabilityissues.html"
97
>36.8. Security Issues</H1
103
NAME="INFECTEDSCRIPTS"
105
>36.8.1. Infected Shell Scripts</H2
108
NAME="INFECTEDSCRIPTS1"
112
>A brief warning about script security is indicated.
113
A shell script may contain a <I
124
>. For that reason, never run
128
> a script (or permit it to
129
be inserted into the system startup scripts in <TT
132
>) unless you have obtained
133
said script from a trusted source or you have carefully analyzed
134
it to make certain it does nothing harmful.</P
136
>Various researchers at Bell Labs and other sites, including M.
137
Douglas McIlroy, Tom Duff, and Fred Cohen have investigated the
138
implications of shell script viruses. They conclude that it is
139
all too easy for even a novice, a <SPAN
141
>"script kiddie,"</SPAN
151
>Here is yet another reason to learn scripting. Being able to
152
look at and understand scripts may protect your system from
153
being compromised by a rogue script.</P
162
>36.8.2. Hiding Shell Script Source</H2
164
>For security purposes, it may be necessary to render a script
165
unreadable. If only there were a utility to create a stripped
166
binary executable from a script. Francisco Rosales' <A
167
HREF="http://www.datsi.fi.upm.es/~frosal/sources/"
170
generic shell script compiler</A
171
> does exactly that.</P
173
>Unfortunately, according to <A
174
HREF="http://www.linuxjournal.com/article/8256"
178
the October, 2005 <SPAN
185
the binary can, in at least some cases, be decrypted to recover
186
the original script source. Still, this could be a useful
187
method of keeping scripts secure from all but the most skilled
197
>36.8.3. Writing Secure Shell Scripts</H2
210
> suggests the following
211
guidelines for writing (relatively) secure shell scripts.</P
216
>Don't put secret data in <A
217
HREF="othertypesv.html#ENVREF"
218
>environment variables</A
223
>Don't pass secret data in an external
224
command's arguments (pass them in via a <A
225
HREF="special-chars.html#PIPEREF"
228
HREF="io-redirection.html#IOREDIRREF"
235
HREF="variables2.html#PATHREF"
238
carefully. Don't just trust whatever path you
239
inherit from the caller if your script is running as
243
>. In fact, whenever you use
244
an environment variable inherited from the caller, think
245
about what could happen if the caller put something
246
misleading in the variable, e.g., if the caller set
248
HREF="variables2.html#HOMEDIRREF"
274
HREF="securityissues.html#AEN20573"
282
>See Marius van Oers' article, <A
283
HREF="http://www.virusbtn.com/magazine/archives/200204/malshell.xml"
286
Shell Scripting Malware</A
289
HREF="biblio.html#DENNINGREF"
311
SUMMARY="Footer navigation table"
322
HREF="assortedtips.html"
340
HREF="portabilityissues.html"
356
HREF="miscellany.html"
364
>Portability Issues</TD
b'\\ No newline at end of file'
added
removed
HTML/securityissues.html
