0

I'm new to linux/bash, and spent many weeks trying to solve how to enable a virtual appliance (linux/bash based) to automatically authenticate and execute a command on a network target.

I got it to work, but am new to linux and dont understand the security implications of what I wrote. Its a homelab, but I would like it to mimic good principles of device security.

My script is stored in /home/userX/bin/ as 'scriptX' and contains the following:

#! /bin/bash
source $HOME/.bashrc
source *commands to authenticate to target*
source *command to scan adapters*

This works when I'm logged into SSH and do ./ to run in an interactive environment. However, as a cron job, it wouldn't work until I sourced $HOME among some other things. I have a cron job setup like the following:

sudo crontab -e

Then inside the cron job

@reboot . /etc/skel/.bashrc ; bash -l -c '/home/UserX/bin/scriptX'

So it works as intended, but I mishmashed parts of scripts I found online until it worked.

Besides changing the account from root to a less privileged user, is there anything I could improve upon with how this operation is handeled?

2

1 Answer 1

2

Sourcing any file (e.g. $HOME/.bashrc) is as secure as what have been written in that file.

For an extreme example, if your .bashrc contains /bin/rm -rf $HOME it is very unsecure.

Notice that sourcing won't affect any parent shell.

Maybe you need to learn more about SSH and how to use it with public/private keys; read some SSH tutorial.

4
  • Do you think I should dig into more what parts of the bashrc environment made it work, or explore public/private keys and keep as is?
    – ZZTest
    Commented Sep 16, 2017 at 14:16
  • You need to learn both: shell scripting & SSH Commented Sep 16, 2017 at 17:02
  • Totally agree. But to accomplish not leaving the front door unlocked, so to speak, what do you think I should do first to tighten up the above script scenario? Implement a public key system, or clean up how the script was written?
    – ZZTest
    Commented Sep 17, 2017 at 19:27
  • You won't implement a public key system. You'll use one (and it is called ssh) Commented Sep 17, 2017 at 19:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .