Standardised usage of Linux and Unix
This commit is contained in:
dcoomber
parent
b0578d2541
commit
072dfa4213
14
README.html
14
README.html
|
|
@ -287,9 +287,9 @@ Written by Drew (@topkecleon) and Kay M (@gnadelwartz).
|
|||
<li><a href="examples/README.md">Examples Dir</a></li>
|
||||
</ul>
|
||||
<h3>Your really first bashbot in a nutshell</h3>
|
||||
<p>To install and run bashbot you need access to a linux/unix command line with bash, a <a href="https://telegram.org">Telegram client</a> and a mobile phone <a href="https://telegramguide.com/create-a-telegram-account/">with a Telegram account</a>.</p>
|
||||
<p>To install and run bashbot you need access to a Linux/Unix command line with bash, a <a href="https://telegram.org">Telegram client</a> and a mobile phone <a href="https://telegramguide.com/create-a-telegram-account/">with a Telegram account</a>.</p>
|
||||
<p>First you need to <a href="doc/1_firstbot.md">create a new Telegram Bot token</a> for your bot and write it down.</p>
|
||||
<p>Now open a linux/unix terminal with bash, create a new directory, change to it and install telegram-bot-bash:</p>
|
||||
<p>Now open a Linux/Unix terminal with bash, create a new directory, change to it and install telegram-bot-bash:</p>
|
||||
<div class="sourceCode" id="cb1"><pre class="sourceCode bash"><code class="sourceCode bash"><span id="cb1-1"><a href="#cb1-1" aria-hidden="true" tabindex="-1"></a><span class="co"># create bot dir</span></span>
|
||||
<span id="cb1-2"><a href="#cb1-2" aria-hidden="true" tabindex="-1"></a><span class="fu">mkdir</span> mybot</span>
|
||||
<span id="cb1-3"><a href="#cb1-3" aria-hidden="true" tabindex="-1"></a><span class="bu">cd</span> mybot</span>
|
||||
|
|
@ -340,13 +340,13 @@ It features background tasks and interactive chats, and can serve as an interfac
|
|||
<p>Running a Telegram Bot means it is connected to the public and you never know what's send to your Bot.</p>
|
||||
<p>Bash scripts in general are not designed to be bullet proof, so consider this Bot as a proof of concept. Bash programmers often struggle with 'quoting hell' and globbing, see <a href="https://unix.stackexchange.com/questions/171346/security-implications-of-forgetting-to-quote-a-variable-in-bash-posix-shells">Implications of wrong quoting</a></p>
|
||||
<p>Whenever you are processing input from untrusted sources (messages, files, network) you must be as careful as possible, e.g. set IFS appropriate, disable globbing (set -f) and quote everything. In addition remove unused scripts and examples from your Bot, e.g. everything in <code>example/</code> and disable/remove all not needed bot commands.</p>
|
||||
<p>It's important to escape or remove <code>$</code> in input from user, files or network (<em>as bashbot does</em>) One of the powerful features of unix shells are variable and command substitution using <code>${}</code> and<code>$()</code>, this can lead to remote code execution (RCE) or remote information disclosure (RID) bugs if unescaped <code>$</code> is included in untrusted input, e.g. <code>$$</code> or <code>$(rm -rf /*)</code></p>
|
||||
<p>It's important to escape or remove <code>$</code> in input from user, files or network (<em>as bashbot does</em>) One of the powerful features of Unix shells are variable and command substitution using <code>${}</code> and<code>$()</code>, this can lead to remote code execution (RCE) or remote information disclosure (RID) bugs if unescaped <code>$</code> is included in untrusted input, e.g. <code>$$</code> or <code>$(rm -rf /*)</code></p>
|
||||
<p>A powerful tool to improve your scripts is <code>shellcheck</code>. You can <a href="https://www.shellcheck.net/">use it online</a> or <a href="https://github.com/koalaman/shellcheck#installing">install shellcheck locally</a>. Shellcheck is used extensively in bashbot development to ensure a high code quality, e.g. it's not allowed to push changes without passing all shellcheck tests. In addition bashbot has a <a href="doc/7_develop.md">test suite</a> to check if important functionality is working as expected.</p>
|
||||
<h3>Use printf whenever possible</h3>
|
||||
<p>If you're writing a script and it is taking external input (from the user as arguments or file system...), you shouldn't use echo to display it. <a href="https://unix.stackexchange.com/a/6581">Use printf whenever possible</a></p>
|
||||
<h3>Run your Bot as a restricted user</h3>
|
||||
<p><strong>I recommend to run your bot as a user, with almost no access rights.</strong> All files your Bot have write access to are in danger to be overwritten/deleted if your bot is hacked. For the same reason every file your Bot can read is in danger to be disclosed. Restrict your Bots access rights to the absolute minimum.</p>
|
||||
<p><strong>Never run your Bot as root, this is the most dangerous you can do!</strong> Usually the user 'nobody' has almost no rights on unix/linux systems. See <a href="doc/4_expert.md">Expert use</a> on how to run your Bot as an other user.</p>
|
||||
<p><strong>Never run your Bot as root, this is the most dangerous you can do!</strong> Usually the user 'nobody' has almost no rights on Linux/Unix systems. See <a href="doc/4_expert.md">Expert use</a> on how to run your Bot as an other user.</p>
|
||||
<h3>Secure your Bot installation</h3>
|
||||
<p><strong>Your Bot configuration must no be readable from other users.</strong> Everyone who can read your Bots token is able to act as your Bot and has access to all chats the Bot is in!</p>
|
||||
<p>Everyone with read access to your Bot files can extract your Bots data. Especially your Bot config in<code>config.jssh</code> must be protected against other users. No one except you should have write access to the Bot files. The Bot should be restricted to have write access to<code>count.jssh</code> and <code>data-bot-bash</code> only, all other files must be write protected.</p>
|
||||
|
|
@ -356,10 +356,10 @@ It features background tasks and interactive chats, and can serve as an interfac
|
|||
<p>Bashbot is not more (in)secure as any Bot written in an other language, we have done our best to make it as secure as possible. But YOU are responsible for the bot commands you wrote and you should know about the risks ...</p>
|
||||
<p><strong>Note:</strong> Up to version 0.941 (mai/22/2020) telegram-bot-bash had a remote code execution bug, please update if you use an older version!</p>
|
||||
<h3>Why Bash and not the much better xyz?</h3>
|
||||
<p>Well, that's a damn good question ... may be because I'm an unix admin from stone age. Nevertheless there are more reasons from my side:</p>
|
||||
<p>Well, that's a damn good question... maybe because I'm a Unix admin from stone age. Nevertheless there are more reasons from my side:</p>
|
||||
<ul>
|
||||
<li>bashbot will run everywhere where bash and (gnu) sed is available, from embedded linux to mainframe</li>
|
||||
<li>easy to integrate with other shell script, e.g. for sending system message / health status</li>
|
||||
<li>bashbot will run everywhere where bash and (gnu) sed is available, from embedded Linux to mainframe</li>
|
||||
<li>easy to integrate with other shell scripts, e.g. for sending system message / health status</li>
|
||||
<li>no need to install or learn a new programming language, library or framework</li>
|
||||
<li>no database, not event driven, not object oriented ...</li>
|
||||
</ul>
|
||||
|
|
|
|||
14
README.md
14
README.md
|
|
@ -67,11 +67,11 @@ Bashbot [Documentation](https://github.com/topkecleon/telegram-bot-bash) and [Do
|
|||
|
||||
### Your really first bashbot in a nutshell
|
||||
|
||||
To install and run bashbot you need access to a linux/unix command line with bash, a [Telegram client](https://telegram.org) and a mobile phone [with a Telegram account](https://telegramguide.com/create-a-telegram-account/).
|
||||
To install and run bashbot you need access to a Linux/Unix command line with bash, a [Telegram client](https://telegram.org) and a mobile phone [with a Telegram account](https://telegramguide.com/create-a-telegram-account/).
|
||||
|
||||
First you need to [create a new Telegram Bot token](doc/1_firstbot.md) for your bot and write it down.
|
||||
|
||||
Now open a linux/unix terminal with bash, create a new directory, change to it and install telegram-bot-bash:
|
||||
Now open a Linux/Unix terminal with bash, create a new directory, change to it and install telegram-bot-bash:
|
||||
|
||||
```bash
|
||||
# create bot dir
|
||||
|
|
@ -146,7 +146,7 @@ e.g. set IFS appropriate, disable globbing (set -f) and quote everything. In add
|
|||
from your Bot, e.g. everything in `example/` and disable/remove all not needed bot commands.
|
||||
|
||||
It's important to escape or remove `$` in input from user, files or network (_as bashbot does_)
|
||||
One of the powerful features of unix shells are variable and command substitution using `${}` and`$()`,
|
||||
One of the powerful features of Unix shells are variable and command substitution using `${}` and`$()`,
|
||||
this can lead to remote code execution (RCE) or remote information disclosure (RID) bugs if unescaped `$` is included in untrusted input, e.g. `$$` or `$(rm -rf /*)`
|
||||
|
||||
A powerful tool to improve your scripts is `shellcheck`. You can [use it online](https://www.shellcheck.net/) or
|
||||
|
|
@ -164,7 +164,7 @@ you shouldn't use echo to display it. [Use printf whenever possible](https://uni
|
|||
All files your Bot have write access to are in danger to be overwritten/deleted if your bot is hacked.
|
||||
For the same reason every file your Bot can read is in danger to be disclosed. Restrict your Bots access rights to the absolute minimum.
|
||||
|
||||
**Never run your Bot as root, this is the most dangerous you can do!** Usually the user 'nobody' has almost no rights on unix/linux systems. See [Expert use](doc/4_expert.md) on how to run your Bot as an other user.
|
||||
**Never run your Bot as root, this is the most dangerous you can do!** Usually the user 'nobody' has almost no rights on Linux/Unix systems. See [Expert use](doc/4_expert.md) on how to run your Bot as an other user.
|
||||
|
||||
### Secure your Bot installation
|
||||
**Your Bot configuration must no be readable from other users.** Everyone who can read your Bots token is able to act as your Bot and has access to all chats the Bot is in!
|
||||
|
|
@ -181,10 +181,10 @@ Bashbot is not more (in)secure as any Bot written in an other language, we have
|
|||
**Note:** Up to version 0.941 (mai/22/2020) telegram-bot-bash had a remote code execution bug, please update if you use an older version!
|
||||
|
||||
### Why Bash and not the much better xyz?
|
||||
Well, that's a damn good question ... may be because I'm an unix admin from stone age. Nevertheless there are more reasons from my side:
|
||||
Well, that's a damn good question... maybe because I'm a Unix admin from stone age. Nevertheless there are more reasons from my side:
|
||||
|
||||
- bashbot will run everywhere where bash and (gnu) sed is available, from embedded linux to mainframe
|
||||
- easy to integrate with other shell script, e.g. for sending system message / health status
|
||||
- bashbot will run everywhere where bash and (gnu) sed is available, from embedded Linux to mainframe
|
||||
- easy to integrate with other shell scripts, e.g. for sending system message / health status
|
||||
- no need to install or learn a new programming language, library or framework
|
||||
- no database, not event driven, not object oriented ...
|
||||
|
||||
|
|
|
|||
14
README.txt
14
README.txt
|
|
@ -81,14 +81,14 @@ available on www.github.com
|
|||
|
||||
### Your really first bashbot in a nutshell
|
||||
|
||||
To install and run bashbot you need access to a linux/unix command line with
|
||||
To install and run bashbot you need access to a Linux/Unix command line with
|
||||
bash, a [Telegram client](https://telegram.org) and a mobile phone [with a
|
||||
Telegram account](https://telegramguide.com/create-a-telegram-account/).
|
||||
|
||||
First you need to [create a new Telegram Bot token](doc/1_firstbot.md) for your
|
||||
bot and write it down.
|
||||
|
||||
Now open a linux/unix terminal with bash, create a new directory, change to it
|
||||
Now open a Linux/Unix terminal with bash, create a new directory, change to it
|
||||
and install telegram-bot-bash:
|
||||
|
||||
```bash
|
||||
|
|
@ -183,7 +183,7 @@ bot commands.
|
|||
|
||||
It's important to escape or remove `$` in input from user, files or network
|
||||
(_as bashbot does_)
|
||||
One of the powerful features of unix shells are variable and command
|
||||
One of the powerful features of Unix shells are variable and command
|
||||
substitution using `${}` and`$()`,
|
||||
this can lead to remote code execution (RCE) or remote information disclosure
|
||||
(RID) bugs if unescaped `$` is included in untrusted input, e.g. `$$` or `$(rm
|
||||
|
|
@ -214,7 +214,7 @@ For the same reason every file your Bot can read is in danger to be disclosed.
|
|||
Restrict your Bots access rights to the absolute minimum.
|
||||
|
||||
**Never run your Bot as root, this is the most dangerous you can do!** Usually
|
||||
the user 'nobody' has almost no rights on unix/linux systems. See [Expert
|
||||
the user 'nobody' has almost no rights on Linux/Unix systems. See [Expert
|
||||
use](doc/4_expert.md) on how to run your Bot as an other user.
|
||||
|
||||
### Secure your Bot installation
|
||||
|
|
@ -243,12 +243,12 @@ bot commands you wrote and you should know about the risks ...
|
|||
execution bug, please update if you use an older version!
|
||||
|
||||
### Why Bash and not the much better xyz?
|
||||
Well, that's a damn good question ... may be because I'm an unix admin from
|
||||
Well, that's a damn good question... maybe because I'm a Unix admin from
|
||||
stone age. Nevertheless there are more reasons from my side:
|
||||
|
||||
- bashbot will run everywhere where bash and (gnu) sed is available, from
|
||||
embedded linux to mainframe
|
||||
- easy to integrate with other shell script, e.g. for sending system message /
|
||||
embedded Linux to mainframe
|
||||
- easy to integrate with other shell scripts, e.g. for sending system message /
|
||||
health status
|
||||
- no need to install or learn a new programming language, library or framework
|
||||
- no database, not event driven, not object oriented ...
|
||||
|
|
|
|||
|
|
@ -123,7 +123,7 @@ debug_checks(){ {
|
|||
} >>"${DEBUGLOG}"
|
||||
}
|
||||
|
||||
# some linux, e.g. manajro seems not to have C locale activated by default
|
||||
# some Linux distributions (e.g. Manjaro) doesn't seem to have C locale activated by default
|
||||
if _exists locale && [ "$(locale -a | grep -c -e "^C$" -e "^C.utf8$")" -lt 2 ]; then
|
||||
printf "${ORANGE}Warning: locale ${NC}${GREY}C${NC}${ORANGE} and/or ${NC}${GREY}C.utf8${NC}${ORANGE} seems missing, use \"${NC}${GREY}locale -a${NC}${ORANGE}\" to show what locales are installed on your system.${NN}"
|
||||
fi
|
||||
|
|
|
|||
|
|
@ -214,7 +214,7 @@ Location of the files `commands.sh`, `mycommands.sh`, `botconfig.jssh`, `botacl`
|
|||
unset BASHBOT_ETC # keep in telegram-bot-bash (default)
|
||||
export BASHBOT_ETC "" # keep in telegram-bot-bash
|
||||
|
||||
export BASHBOT_ETC "/etc/bashbot" # unix like config location
|
||||
export BASHBOT_ETC "/etc/bashbot" # Unix-like config location
|
||||
|
||||
export BASHBOT_ETC "/etc/bashbot/bot1" # multibot configuration bot 1
|
||||
export BASHBOT_ETC "/etc/bashbot/bot2" # multibot configuration bot 2
|
||||
|
|
@ -228,7 +228,7 @@ Location of runtime data `data-bot-bash`, `count.jssh`
|
|||
unset BASHBOT_VAR # keep in telegram-bot-bash (default)
|
||||
export BASHBOT_VAR "" # keep in telegram-bot-bash
|
||||
|
||||
export BASHBOT_VAR "/var/spool/bashbot" # unix like config location
|
||||
export BASHBOT_VAR "/var/spool/bashbot" # Unix-like config location
|
||||
|
||||
export BASHBOT_VAR "/var/spool/bashbot/bot1" # multibot configuration bot 1
|
||||
export BASHBOT_VAR "/var/spool/bashbot/bot2" # multibot configuration bot 2
|
||||
|
|
@ -253,7 +253,7 @@ This is also useful if you want to force bashbot to always use full pathnames in
|
|||
unset BASHBOT_HOME # autodetection (default)
|
||||
export BASHBOT_HOME "" # autodetection
|
||||
|
||||
export BASHBOT_HOME "/usr/local/telegram-bot-bash" # unix like location
|
||||
export BASHBOT_HOME "/usr/local/telegram-bot-bash" # Unix-like location
|
||||
export BASHBOT_HOME "/usr/local/bin" # Note: you MUST set ETC, VAR and JSONSH to other locations to make this work!
|
||||
```
|
||||
|
||||
|
|
|
|||
|
|
@ -220,9 +220,9 @@ A typical bashbot develop loop looks as follow:
|
|||
|
||||
#### common commands
|
||||
We state bashbot is a bash only bot, but this is not true. bashbot is a bash script using bash features PLUS external commands.
|
||||
Usually bash is used in a unix/linux environment where many (GNU) commands are available, but if commands are missing, bashbot may not work.
|
||||
Usually bash is used in a Linux/Unix environment where many (GNU) commands are available, but if commands are missing, bashbot may not work.
|
||||
|
||||
To avoid this and make bashbot working on as many platforms as possible - from embedded linux to mainframe - I recommend to restrict
|
||||
To avoid this and make bashbot working on as many platforms as possible - from embedded Linux to mainframe - I recommend to restrict
|
||||
ourself to the common commands provided by bash and coreutils/busybox/toybox.
|
||||
See [Bash Builtins](https://www.gnu.org/software/bash/manual/html_node/Shell-Builtin-Commands.html),
|
||||
[coreutils](https://en.wikipedia.org/wiki/List_of_GNU_Core_Utilities_commands),
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ MYSHEBANG=""
|
|||
|
||||
################
|
||||
# uncomment one of the following lines to make the conversion
|
||||
# linux/unix bash
|
||||
# Linux/Unix bash
|
||||
# MYSHEBANG="#!/bin/bash"
|
||||
|
||||
# BSD bash
|
||||
|
|
|
|||
|
|
@ -21,7 +21,7 @@ if true; then
|
|||
VAR="${BINDIR}"
|
||||
|
||||
else
|
||||
# alternative linux like locations
|
||||
# alternative Linux-like locations
|
||||
BINDIR="/usr/local/bin"
|
||||
ETC="/etc/bashbot"
|
||||
VAR="/var/bashbot"
|
||||
|
|
|
|||
Loading…
Reference in New Issue