SHC compiles with error

[tom quach_1]

Hi All,
hope that you can help me with this free compiler
i've been using this compiler SHC on HP-UX 11.11 for quite few years and it works very well.
my co-worker just created a scripts to generate the password for our servers the script worked fine with out compiling, but if i compiled and ran the compiled version, it always thrown and error.

/etc/profile[225]: Syntax error: `(' is not expected.
the compiled script, we inserted it at the last line of global profile.
below is a portion of the scripts.
in the whole script there are only two bracket
locate at the " getpass () " function.

#!/bin/sh
Sgid=`id -gn`
Suid=`id -un`
Ssid1=`id -Gn | awk '{print $2}'`
Ssid2=`id -Gn | awk '{print $3}'`
pwdcode="zyxwvutsrqponmlkjihgfedcba"
getpass ()
{
i="1"
while [ $i -le 26 ]
do
alpha=`echo $pwdcode | cut -c -$i-$i`
if [ "$alpha" = "$1" ]
then
break
else
i=`expr $i + 1`
fi
done

}
--------
-------there are few getpass -
getpass u
pass1=$i
getpass s
pass2=$i
pass3=`expr $pass1 + $pass2`
export PSWDUS="SUN"$pass3
fi

please advice us how to fix this error or if you know of any commercial product please also advice.
we use this SHC to hide the password inside the script.

Thanks in advance.
Tom

[Peter Godron]

Tom,
you can debug by using "set -x" in the line following the #!/bin/sh.

Also if you vi /etc/profile and go to line 225 that might give you some clue.
To go to line 225 in vi use : 225

Please don't forget:
http://forums1.itrc.hp.com/service/forums/helptips.do?#33 on how to reward any useful answers given to your questions.

[Ralph Grothe]

As Peter wrote,
most likely a syntax error in /etc/profile around line 225.
Btw, you can directly jump to this line when loading the file into vi,
e.g.

# vi +225 /etc/profile

Out of curiousity, what is shc?
Is it a compiler that converts shell scripts into executable binaries that need not be interpreted by the shell anymore?

[Ralph Grothe]

Forgot,
"'(' not expected", somehow implies to me that you put the invocation of a shell function in /etc/profile with round parentheses, wheras in common shell syntax parenths are completely omitted and arguments only whitespace separated passed.

[tom quach_1]

Thanks for the replies,

sorry, my question was not clear.
This is the last line of /etc/profile
. /opt/shc/bin/pp.sh.x

this file, when not compile is working just fine "pp.sh"
after compiled, i got the error as above.

"out of curiousity, what is shc?
Is it a compiler that converts shell scripts into executable binaries that need not be interpreted by the shell anymore?"
Ralph you were right. we use this free program to compile scripts with password so users could not see it.
so the error was not from /etc/profile it was from the file after compiled.

Please advice.
Thank you very much.
Tom

[A. Clay Stephenson]

Are you certain that users cannot see the passwords in your executable? Have you executed the strings command against your executable? You may not be nearly as secure as you think you are. You can make your executables more secure by disabling the read bits on the file. Unlike shell scripts, true executabes need only the executable bit set.

[tom quach_1]

Thanks A. Clay,

i will keep that in mind.
the problem i have now
the script is working as expected without a problem but when i use the free compile software " shc" to create an executable file
from pp.sh to pp.sh.x
then it shown an error when i executed it
"/etc/profile[225]: Syntax error: `(' is not expected."

Thanks,
Tom

[tom quach_1]

thank you for all your helps.

there was a bug in our script and we are working on this error.

thanks again,
Tom

[Ralph Grothe]

Though this thread has already been closed,
the intervention Clay made is worth considering.
Clear text passwords should be avoided.
You could for instance store a hashed password like it is also kept in passwd or shadow files.
There are numerous ways to create those hashes.

Probably you already have got installed the openssl binary, either as part of the separate depot of the whole lib like the free HP Internet Express is offering it, or as part of the HP apache depot.
The openssl binary is a kind of crypto swiss army knife.
For instance it can generate MD5 hashes of passwords (like many Linux distros store them in their shadow files), but legacy DES like the Unix crypt() syscall is using it is also available.
Though the MD5 algorithm has been challenged recently (I think some Chinese crypto analysts could lower the brute force combinations to abt. 2^31 which gets tangible to large scale grid computing attacks) for normal environments with usual processing resources it still is quite secure.

For instance the MD5 hash of the password "secret" looks like this:

$ /opt/hpws/apache/bin/openssl passwd -1
Password:
Verifying - Password:
$1$k10b0ykK$Vs.OTE9RAy5pQS/8Vbzi5/

You could store such hashes safely even in a world readable file.

For a more programmatic or scriptable approach I personally would recommend Perl modules such as Crypt::MD5 etc. but any decent programming or scripting language should come with an API for these tasks.