Classic Shell Scripting

Summary

Writing secure shell scripts is just one part of keeping a Unix system secure. This chapter merely scratches the surface of the issues involved, and we recommend reading up on Unix system security. As a beginning, we presented a list of tips for writing secure shell scripts provided by a recognized expert in the field of Unix security.

We then described restricted shells, which disable a number of potentially dangerous operations. The environment for a restricted shell should be built within the user's .profile file, which is executed when a restricted user logs in. In practice, restricted shells are difficult to set up correctly and use, and we recommend finding a different way to set up restricted environments.

Trojan horses are programs that look harmless but that actually perform an attack on your system. We looked at some of the ways that Trojan horses can be created, but there are others.

Setuid shell scripts are a bad idea, and just about all modern Unix systems disallow them, since it's very difficult to close the security holes they open up. It is worth verifying, however, that your system does indeed disallow them, and if not, to periodically search your system for such files.

Finally, we looked briefly at the Korn shell's privileged mode, which attempts to solve many of the security issues associated with shell scripts.