Checking scripts security

[Mihails Nikitins]

Hello,

Using 3rd party or freeware shell scripts is always a security issue.
Please recommend me another script that warns about all suspicious commands inside the script being checked ('rm -f', 'kill', etc.). I would not like re-ivent the wheel.

Many thanks in advance!

[Tim Malnati · Accepted solution]

I would suggest that where you obtain this type of code is your first line of defense. The HP Porting Center at http://hpux.cs.utah.edu/ and the mirrors to this in other countries are a solid source of freeware that exists in the communty. Most freeware of any value tends to end up here. In most cases the code has been completely ported to various versions of HPUX (fully compiled and ready to run) and is in use by a somewhat wide group of HP users. Obviously, no freeware is guaranteed, but I have found the applications and utilities to be very reliable from this source.

The second line of defence would be to lock down the directories that are part of the systemwide path (see /etc/PATH). In my mind nobody other than root should typically be modifying anything here. There is a variety of software out there to detect changes to this environment as wells (COPS, etc). The places to watch in particular are /usr/local, /usr/contrib, and /opt. I don't know of any security software that performs a search of shell script coding, but hopefully what I've stated here is of some use.

[Rick Garland]

Entries I would like to include are traps so the user cannot break out of a script. If a user is in a captive menu or application and that app allows, say a break as example, trap it so the user cannot get shell prompt

[Anthony Goonetilleke]

If you are waooried about security what you probably should be more concerned about is SUID files, I mean people cannot really do an rm on files owned by root or another user etc.

Run something like this

find . ( -perm -004000 -o -perm -002000 ) -type f -print -exec ls -l {} ;

and probably check for files with bad permissions i.e 777 etc...

[Mihails Nikitins]

Thanks to all of you, your answers are very helpful. The question was inspired by the recent discussion "System Inventory Script needed". Such scripts require to be run from an account with root privilleges. So, I should consider all security aspects before running them on a mission-critical system. I guess the best security policy is not to run any staff that does not come directly from HP. :)