📄 securityissues.html
字号:
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><HTML><HEAD><TITLE>Security Issues</TITLE><METANAME="GENERATOR"CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+"><LINKREL="HOME"TITLE="Advanced Bash-Scripting Guide"HREF="index.html"><LINKREL="UP"TITLE="Miscellany"HREF="miscellany.html"><LINKREL="PREVIOUS"TITLE="Assorted Tips"HREF="assortedtips.html"><LINKREL="NEXT"TITLE="Portability Issues"HREF="portabilityissues.html"><METAHTTP-EQUIV="Content-Style-Type"CONTENT="text/css"><LINKREL="stylesheet"HREF="common/kde-common.css"TYPE="text/css"><METAHTTP-EQUIV="Content-Type"CONTENT="text/html; charset=iso-8859-1"><METAHTTP-EQUIV="Content-Language"CONTENT="en"><LINKREL="stylesheet"HREF="common/kde-localised.css"TYPE="text/css"TITLE="KDE-English"><LINKREL="stylesheet"HREF="common/kde-default.css"TYPE="text/css"TITLE="KDE-Default"></HEAD><BODYCLASS="SECT1"BGCOLOR="#FFFFFF"TEXT="#000000"LINK="#AA0000"VLINK="#AA0055"ALINK="#AA0000"STYLE="font-family: sans-serif;"><DIVCLASS="NAVHEADER"><TABLESUMMARY="Header navigation table"WIDTH="100%"BORDER="0"CELLPADDING="0"CELLSPACING="0"><TR><THCOLSPAN="3"ALIGN="center">Advanced Bash-Scripting Guide: An in-depth exploration of the art of shell scripting</TH></TR><TR><TDWIDTH="10%"ALIGN="left"VALIGN="bottom"><AHREF="assortedtips.html"ACCESSKEY="P">Prev</A></TD><TDWIDTH="80%"ALIGN="center"VALIGN="bottom">Chapter 33. Miscellany</TD><TDWIDTH="10%"ALIGN="right"VALIGN="bottom"><AHREF="portabilityissues.html"ACCESSKEY="N">Next</A></TD></TR></TABLE><HRALIGN="LEFT"WIDTH="100%"></DIV><DIVCLASS="SECT1"><H1CLASS="SECT1"><ANAME="SECURITYISSUES"></A>33.9. Security Issues</H1><DIVCLASS="SECT2"><H2CLASS="SECT2"><ANAME="INFECTEDSCRIPTS"></A>33.9.1. Infected Shell Scripts</H2><P><ANAME="INFECTEDSCRIPTS1"></A></P><P>A brief warning about script security is indicated. A shell script may contain a <ICLASS="FIRSTTERM">worm</I>, <ICLASS="FIRSTTERM">trojan</I>, or even a <ICLASS="FIRSTTERM">virus</I>. For that reason, never run as <ICLASS="FIRSTTERM">root</I> a script (or permit it to be inserted into the system startup scripts in <TTCLASS="FILENAME">/etc/rc.d</TT>) unless you have obtained said script from a trusted source or you have carefully analyzed it to make certain it does nothing harmful.</P><P>Various researchers at Bell Labs and other sites, including M. Douglas McIlroy, Tom Duff, and Fred Cohen have investigated the implications of shell script viruses. They conclude that it is all too easy for even a novice, a <SPANCLASS="QUOTE">"script kiddie,"</SPAN> to write one. <ANAME="AEN19140"HREF="#FTN.AEN19140">[1]</A> </P><P>Here is yet another reason to learn scripting. Being able to look at and understand scripts may protect your system from being compromised by a rogue script.</P></DIV><DIVCLASS="SECT2"><H2CLASS="SECT2"><ANAME="HIDINGSOURCE"></A>33.9.2. Hiding Shell Script Source</H2><P>For security purposes, it may be necessary to render a script unreadable. If only there were a utility to create a stripped binary executable from a script. Francisco Rosales' <AHREF="http://www.datsi.fi.upm.es/~frosal/sources/"TARGET="_top">shc -- generic shell script compiler</A> does exactly that.</P><P>Unfortunately, according to <AHREF="http://www.linuxjournal.com/article/8256"TARGET="_top">an article</A> in the October, 2005 <SPANCLASS="emphasis"><ICLASS="EMPHASIS">Linux Journal</I></SPAN>, the binary can, in at least some cases, be decrypted to recover the original script source. Still, this could be a useful method of keeping scripts secure from all but the most skilled hackers.</P></DIV><DIVCLASS="SECT2"><H2CLASS="SECT2"><ANAME="SECURITYTIPS"></A>33.9.3. Writing Secure Shell Scripts</H2><P><ANAME="SECURITYTIPS1"></A></P><P><SPANCLASS="emphasis"><ICLASS="EMPHASIS">Dan Stromberg</I></SPAN> suggests the following guidelines for writing (relatively) secure shell scripts.</P><P> <UL><LI><P>Don't put secret data in <AHREF="othertypesv.html#ENVREF">environment variables</A>.</P></LI><LI><P>Don't pass secret data in an external command's arguments (pass them in via a <AHREF="special-chars.html#PIPEREF">pipe</A> or <AHREF="io-redirection.html#IOREDIRREF">redirection</A> instead).</P></LI><LI><P>Set your <AHREF="variables2.html#PATHREF">$PATH</A> carefully. Don't just trust whatever path you inherit from the caller if your script is running as <ICLASS="FIRSTTERM">root</I>. In fact, whenever you use an environment variable inherited from the caller, think about what could happen if the caller put something misleading in the variable, e.g., if the caller set <AHREF="variables2.html#HOMEDIRREF">$HOME</A> to <TTCLASS="FILENAME">/etc</TT>.</P></LI></UL> </P></DIV></DIV><H3CLASS="FOOTNOTES">Notes</H3><TABLEBORDER="0"CLASS="FOOTNOTES"WIDTH="100%"><TR><TDALIGN="LEFT"VALIGN="TOP"WIDTH="5%"><ANAME="FTN.AEN19140"HREF="securityissues.html#AEN19140">[1]</A></TD><TDALIGN="LEFT"VALIGN="TOP"WIDTH="95%"><P>See Marius van Oers' article, <AHREF="http://www.virusbtn.com/magazine/archives/200204/malshell.xml"TARGET="_top">Unix Shell Scripting Malware</A>, and also the <AHREF="biblio.html#DENNINGREF"><SPANCLASS="emphasis"><ICLASS="EMPHASIS">Denning</I></SPAN> reference</A> in the <ICLASS="FIRSTTERM">bibliography</I>.</P></TD></TR></TABLE><DIVCLASS="NAVFOOTER"><HRALIGN="LEFT"WIDTH="100%"><TABLESUMMARY="Footer navigation table"WIDTH="100%"BORDER="0"CELLPADDING="0"CELLSPACING="0"><TR><TDWIDTH="33%"ALIGN="left"VALIGN="top"><AHREF="assortedtips.html"ACCESSKEY="P">Prev</A></TD><TDWIDTH="34%"ALIGN="center"VALIGN="top"><AHREF="index.html"ACCESSKEY="H">Home</A></TD><TDWIDTH="33%"ALIGN="right"VALIGN="top"><AHREF="portabilityissues.html"ACCESSKEY="N">Next</A></TD></TR><TR><TDWIDTH="33%"ALIGN="left"VALIGN="top">Assorted Tips</TD><TDWIDTH="34%"ALIGN="center"VALIGN="top"><AHREF="miscellany.html"ACCESSKEY="U">Up</A></TD><TDWIDTH="33%"ALIGN="right"VALIGN="top">Portability Issues</TD></TR></TABLE></DIV></BODY></HTML>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -