Script Security

Introduction

In the world of scripting, especially with Bash, security is paramount. Scripts are often used to automate tasks that involve sensitive data or system-level operations. A poorly written script can expose your system to vulnerabilities and attacks. This tutorial will guide you through best practices for securing Bash scripts against common threats.

Concept

1. Input Validation

One of the most critical aspects of script security is input validation. Unchecked user inputs can lead to command injection, which allows attackers to execute arbitrary commands on your system.

Example:

#!/bin/bash

# Vulnerable script
read -p "Enter a filename: " filename
cat $filename

In the above script, if an attacker enters ; rm -rf /, they can delete all files on the system. To prevent this, always validate and sanitize inputs.

Secure Example:

#!/bin/bash

# Secure script
read -p "Enter a filename: " filename
if [[ $filename =~ ^[a-zA-Z0-9._-]+$ ]]; then
    cat "$filename"
else
    echo "Invalid filename."
fi

2. Use of set Options

The set command in Bash can be used to enable various options that enhance script security.

Example:

#!/bin/bash

# Enable error handling and strict mode
set -euo pipefail

# Rest of the script...

• -e: Exit immediately if a command exits with a non-zero status.
• -u: Treat unset variables as an error when substituting.
• -o pipefail: The return value of a pipeline is the status of the last command to exit with a non-zero status.

3. Environment Variables

Environment variables can be used to store sensitive information like API keys or database credentials. Ensure these are stored securely and not hard-coded in your scripts.

Example:

#!/bin/bash

# Use environment variables
API_KEY=${API_KEY:-"default_key"}
curl -H "Authorization: Bearer $API_KEY" https://api.example.com/data

4. File Permissions

Ensure that the permissions on your scripts and sensitive files are set correctly to prevent unauthorized access.

Example:

# Set executable permission for the script owner only
chmod 700 myscript.sh

# Set read-only permission for the script owner only
chmod 400 sensitive_data.txt

5. Logging and Monitoring

Implement logging within your scripts to monitor activities and detect suspicious behavior.

Example:

#!/bin/bash

LOGFILE="/var/log/myscript.log"

# Log function
log() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" >> "$LOGFILE"
}

log "Script started."

# Script logic...

log "Script finished."

Examples

Example 1: Secure File Copying Script

#!/bin/bash

set -euo pipefail

SOURCE="/path/to/source/file"
DESTINATION="/path/to/destination"

if [[ ! -f $SOURCE ]]; then
    echo "Source file does not exist."
    exit 1
fi

cp "$SOURCE" "$DESTINATION"
echo "File copied successfully."

Example 2: Secure User Input Handling

#!/bin/bash

set -euo pipefail

read -p "Enter your username: " USERNAME
read -s -p "Enter your password: " PASSWORD
echo

# Validate input
if [[ $USERNAME =~ ^[a-zA-Z0-9._-]+$ ]] && [[ ${#PASSWORD} -ge 8 ]]; then
    echo "Login successful."
else
    echo "Invalid username or password."
fi

What's Next?

In the next section, we will cover "Script Audit," where you will learn how to systematically review and test your scripts for vulnerabilities. This will ensure that your scripts are not only functional but also secure.

By following these best practices, you can significantly enhance the security of your Bash scripts and protect your systems from potential threats.