Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am trying to identify how safe the free shell accounts provided by the likes of shellmix.com are. I have never used one myself but want to suggest it to someone interested in learning shell programming. Are they safe to use for this purpose? What should I watch out for?

share|improve this question
5  
Consider the advantages of a Live CD distribution too. No privacy issues, no security restrictions, no network speed annoyances. –  manatwork Sep 12 '11 at 6:45
    
ive used shellmix. its ok. a livecd is better imho, or even better install virtualbox (if you have a multi-core cpu) –  Sirex Sep 12 '11 at 8:32
    
VirtualBox and a Linux distro of your choice are free. Unlike mucking around with cygwin or mingw, you have a complete native OS to work with and the security worries from rogue admins go away. –  Fiasco Labs May 2 '12 at 2:51
add comment

3 Answers 3

up vote 12 down vote accepted

A general rule of thumb I go by is only trust a machine as much as you trust its root user(s), both in terms of technical competence (especially in security), and general trustworthiness. Since it is unlikely you know the admins of shellmix very well, it's probably a bad idea to trust the machine(s) your account is on any more than you would any random box on the Internet. If all you do is write shell scripts and compile the occasional hello world, you should be fine. Assume everything you type into the remote shell can potentially be read by others. Do not put anything you wouldn't want public there, even temporarily. This includes hard-coding personal information or information about your own computer like host names, user names, directory layout, etc. in shell scripts. As mentioned by @SamBisbee in the comments, use a unique password you never reuse for anything else. Also, there are security risks to forwarding X11 connections (i.e. ssh -X to the shellmix machine) from an untrusted machine so I'd avoid doing that as well.

share|improve this answer
1  
I agree with you general paranoia, but are there any documented cases of folks setting up a full-featured shell environment as a honeypot? I mean, I've had nyx.net and sdf.lonestar.org accounts over the years, and I've never heard of such weirdness as you propose could happen. –  Bruce Ediger Sep 11 '11 at 21:13
4  
I also have never heard of such honeypots but there is always the possibility of a user who manages privilege escalation or even a rogue admin. Nevertheless, "it's never happened before" is not exactly the most sound security principle to lean on. –  jw013 Sep 11 '11 at 21:58
1  
Also, use a throw away password. As root they can see your unshadowed password and rip that sucker. And under NO circumstances should you EVER have private keys (GPG, SSH, etc.) on that box. –  Sam Bisbee Sep 13 '11 at 17:49
1  
Note that even semi-modern ssh has both -X and -Y. In those versions, -X is much safer. See the ssh docs. –  derobert Sep 12 '12 at 20:03
add comment

Have you considered Cygwin? Most likely you can do whatever you're trying to do within the comfort of your Windows OS (and your own machine).

share|improve this answer
add comment

Here is a bash-like shell for Windows, which might be an alternative or extension to a shell account. A benefit is, that you can watch in a GUI-filemanager what effect your mkdir, touch, rmdir ... - commands had from a second perspective.

Another benefit is the rich toolset (grep, sed, awk, ...) of the GNU-toolkit, if you work on Windows. After being used to it, you will be happy not to miss them.

share|improve this answer
2  
Why only a handful of utils? Install Cygwin and be done with it. –  Aaron D. Marasco Sep 12 '11 at 1:30
1  
Because it is lean, and convenient, if you rarely use windows. For real work, I use Linux with virtual Desktops and so on - I never liked cygwin. –  user unknown Sep 12 '11 at 21:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.