Visit Our UNIX and Linux User Community


Secure coding standards for Shell Programming


 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting Secure coding standards for Shell Programming
# 1  
Old 04-21-2009
Secure coding standards for Shell Programming

Hi,

Can anyone point me to Secure coding standards for shell programming guides, links etc etc...

Thanks and regards,
Vamsi K Surampalli.
# 2  
Old 04-22-2009
I have no link but here are some thoughts:
  • Check if file permissions that can be set with chmod and chown/chgrp are ok for your needs.
  • Going remote should always use encrypted communication like with ssh/scp.
  • If you have a more "complicate" setup with different users, think of using sudo to fit your needs.
# 3  
Old 04-22-2009
We just had a case where finding script output files in /tmp or /var/tmp or other world writeable dirs, could be written as symlinks by an unprivileged user to cause harm.

It's not easily exploitable due to the output file having to NOT exist and also the user knowing what name it will be, but it is possible.

e.g

If user1 (normal user) wrote a symlink in /tmp to /etc/passwd

user1# ln -s /tmp/script.out /etc/passwd

Then a script came along running as root and created output or debug or anything to /tmp/script.out then it would overwrite /etc/passwd and obviously cause trouble to the system.

As said the user would need to know what scripts would be ran as root and where to output but people sometimes forget to chmod 750 ot 700 certain scripts.

If therefore check any output file i'm going to create as below :-

Code:
output_security()
{
# Check any file to be used is not a symlink elswhere. 
# If exceptions are needed dont call this function
# This is an e.g so doesn't include checking $@
for FILE in $@
do
   if [ -h ${FILE} ];then
       print "ERROR: File [${FILE}] is a sym link and not a regular file" >&2
       print "Potential Security Risk so exiting" >&2
       exit 2
}

outputfile=/tmp/$(basename $0).out
tmpfile=/tmp/$(basename $0).tmp

output_security "${outputfile} ${tmpfile}"

....blah blah


Last edited by lavascript; 04-22-2009 at 11:28 AM.. Reason: dont want " " around $@ in function

Previous Thread | Next Thread

8 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Help with understand shell script coding

Good afternoon everyone, I am very new to UNIX shell scripting and I am trying to understand the following code. I know what it does but I need to modify it so it will allow me to pass a file name as *FILENAME* Thank for any guidance offered. if ] ; then match=`expr "$file" :... (2 Replies)
Discussion started by: Walter Barona
2 Replies

2. Shell Programming and Scripting

Need help in shell script coding

I have a file f1.txt that contains string: f1.txt aaa bbb ccc ... I want to write code to search that each string in file f2.txt(this file contains 1000+line codes). file f2.txt .. .. ....aaa...xyz.. ... ... ...ppp... (dots . can be characters ot blank spaces) If particular... (2 Replies)
Discussion started by: Sanchit
2 Replies

3. UNIX for Dummies Questions & Answers

GUI via secure shell

Hi i am connected to remote system using putty over ssh-1 version. i can see the command line and able to perform the operations through it. is it possible to have a GUI interface of my login rather than terminal access? do i need to use any client other than putty ? any help is much... (5 Replies)
Discussion started by: rakeshkumar
5 Replies

4. AIX

AIX and Secure Shell

I just installed 5.3 TL0 on a B50 server. I need to get ssh installed. I tried the links at http://sourceforge.net/projects/openssh-aix] I downloaded openssh_5.2p1_aix53.tar and openssh-4.5_srcpatch.tar. The installation failed. The notes say that this was compiled for TL 8, and mine is... (3 Replies)
Discussion started by: Geekasaurus
3 Replies

5. Shell Programming and Scripting

Unix Shell Scripting Standards

Would anyone have details of pre-existing Unix shell scripting standards. I've been asked to prepare a document outlining standards when writing korn shell scripts & don't really know where to start. Thanks. (6 Replies)
Discussion started by: janmolby
6 Replies

6. Shell Programming and Scripting

Coding Standard For Unix Shell Scripting!!!

Is there any site on Coding Standard for Shell Scripting in UNIX. Please help me know!!!!! Thanks Om (1 Reply)
Discussion started by: Omkumar
1 Replies

7. Shell Programming and Scripting

Shell Coding question for any experts out there

Given this one long stream of data (all one line): <TransactionDetail><TransactionHeader><ErrorLogging>YES</ErrorLogging><HistoryLogging>YES</HistoryLogging><ErrorDetection>NO</ErrorD... (4 Replies)
Discussion started by: dfran1972
4 Replies

8. UNIX for Dummies Questions & Answers

Unix Coding Standards

Hi, I am looking for some coding standards for Unix Shell Scripting. Can anyone help me out in this? Regards, Himanshu (3 Replies)
Discussion started by: himanshu_s
3 Replies

Featured Tech Videos