To install and run bashbot you need access to a linux/unix command line with bash, a Telegram client and a mobile phone with a Telegram account.
+To install and run bashbot you need access to a Linux/Unix command line with bash, a Telegram client and a mobile phone with a Telegram account.
First you need to create a new Telegram Bot token for your bot and write it down.
-Now open a linux/unix terminal with bash, create a new directory, change to it and install telegram-bot-bash:
+Now open a Linux/Unix terminal with bash, create a new directory, change to it and install telegram-bot-bash:
# create bot dir
mkdir mybot
cd mybot
@@ -340,13 +340,13 @@ It features background tasks and interactive chats, and can serve as an interfac
Running a Telegram Bot means it is connected to the public and you never know what's send to your Bot.
Bash scripts in general are not designed to be bullet proof, so consider this Bot as a proof of concept. Bash programmers often struggle with 'quoting hell' and globbing, see Implications of wrong quoting
Whenever you are processing input from untrusted sources (messages, files, network) you must be as careful as possible, e.g. set IFS appropriate, disable globbing (set -f) and quote everything. In addition remove unused scripts and examples from your Bot, e.g. everything in example/ and disable/remove all not needed bot commands.
-It's important to escape or remove $ in input from user, files or network (as bashbot does) One of the powerful features of unix shells are variable and command substitution using ${} and$(), this can lead to remote code execution (RCE) or remote information disclosure (RID) bugs if unescaped $ is included in untrusted input, e.g. $$ or $(rm -rf /*)
+It's important to escape or remove $ in input from user, files or network (as bashbot does) One of the powerful features of Unix shells are variable and command substitution using ${} and$(), this can lead to remote code execution (RCE) or remote information disclosure (RID) bugs if unescaped $ is included in untrusted input, e.g. $$ or $(rm -rf /*)
A powerful tool to improve your scripts is shellcheck. You can use it online or install shellcheck locally. Shellcheck is used extensively in bashbot development to ensure a high code quality, e.g. it's not allowed to push changes without passing all shellcheck tests. In addition bashbot has a test suite to check if important functionality is working as expected.
Use printf whenever possible
If you're writing a script and it is taking external input (from the user as arguments or file system...), you shouldn't use echo to display it. Use printf whenever possible
Run your Bot as a restricted user
I recommend to run your bot as a user, with almost no access rights. All files your Bot have write access to are in danger to be overwritten/deleted if your bot is hacked. For the same reason every file your Bot can read is in danger to be disclosed. Restrict your Bots access rights to the absolute minimum.
-Never run your Bot as root, this is the most dangerous you can do! Usually the user 'nobody' has almost no rights on unix/linux systems. See Expert use on how to run your Bot as an other user.
+Never run your Bot as root, this is the most dangerous you can do! Usually the user 'nobody' has almost no rights on Linux/Unix systems. See Expert use on how to run your Bot as an other user.
Secure your Bot installation
Your Bot configuration must no be readable from other users. Everyone who can read your Bots token is able to act as your Bot and has access to all chats the Bot is in!
Everyone with read access to your Bot files can extract your Bots data. Especially your Bot config inconfig.jssh must be protected against other users. No one except you should have write access to the Bot files. The Bot should be restricted to have write access tocount.jssh and data-bot-bash only, all other files must be write protected.
@@ -356,10 +356,10 @@ It features background tasks and interactive chats, and can serve as an interfac
Bashbot is not more (in)secure as any Bot written in an other language, we have done our best to make it as secure as possible. But YOU are responsible for the bot commands you wrote and you should know about the risks ...
Note: Up to version 0.941 (mai/22/2020) telegram-bot-bash had a remote code execution bug, please update if you use an older version!
Why Bash and not the much better xyz?
-Well, that's a damn good question ... may be because I'm an unix admin from stone age. Nevertheless there are more reasons from my side:
+Well, that's a damn good question... maybe because I'm a Unix admin from stone age. Nevertheless there are more reasons from my side:
-- bashbot will run everywhere where bash and (gnu) sed is available, from embedded linux to mainframe
-- easy to integrate with other shell script, e.g. for sending system message / health status
+- bashbot will run everywhere where bash and (gnu) sed is available, from embedded Linux to mainframe
+- easy to integrate with other shell scripts, e.g. for sending system message / health status
- no need to install or learn a new programming language, library or framework
- no database, not event driven, not object oriented ...
diff --git a/README.md b/README.md
index b8648e7..1396a75 100644
--- a/README.md
+++ b/README.md
@@ -67,11 +67,11 @@ Bashbot [Documentation](https://github.com/topkecleon/telegram-bot-bash) and [Do
### Your really first bashbot in a nutshell
-To install and run bashbot you need access to a linux/unix command line with bash, a [Telegram client](https://telegram.org) and a mobile phone [with a Telegram account](https://telegramguide.com/create-a-telegram-account/).
+To install and run bashbot you need access to a Linux/Unix command line with bash, a [Telegram client](https://telegram.org) and a mobile phone [with a Telegram account](https://telegramguide.com/create-a-telegram-account/).
First you need to [create a new Telegram Bot token](doc/1_firstbot.md) for your bot and write it down.
-Now open a linux/unix terminal with bash, create a new directory, change to it and install telegram-bot-bash:
+Now open a Linux/Unix terminal with bash, create a new directory, change to it and install telegram-bot-bash:
```bash
# create bot dir
@@ -146,7 +146,7 @@ e.g. set IFS appropriate, disable globbing (set -f) and quote everything. In add
from your Bot, e.g. everything in `example/` and disable/remove all not needed bot commands.
It's important to escape or remove `$` in input from user, files or network (_as bashbot does_)
-One of the powerful features of unix shells are variable and command substitution using `${}` and`$()`,
+One of the powerful features of Unix shells are variable and command substitution using `${}` and`$()`,
this can lead to remote code execution (RCE) or remote information disclosure (RID) bugs if unescaped `$` is included in untrusted input, e.g. `$$` or `$(rm -rf /*)`
A powerful tool to improve your scripts is `shellcheck`. You can [use it online](https://www.shellcheck.net/) or
@@ -164,7 +164,7 @@ you shouldn't use echo to display it. [Use printf whenever possible](https://uni
All files your Bot have write access to are in danger to be overwritten/deleted if your bot is hacked.
For the same reason every file your Bot can read is in danger to be disclosed. Restrict your Bots access rights to the absolute minimum.
-**Never run your Bot as root, this is the most dangerous you can do!** Usually the user 'nobody' has almost no rights on unix/linux systems. See [Expert use](doc/4_expert.md) on how to run your Bot as an other user.
+**Never run your Bot as root, this is the most dangerous you can do!** Usually the user 'nobody' has almost no rights on Linux/Unix systems. See [Expert use](doc/4_expert.md) on how to run your Bot as an other user.
### Secure your Bot installation
**Your Bot configuration must no be readable from other users.** Everyone who can read your Bots token is able to act as your Bot and has access to all chats the Bot is in!
@@ -181,10 +181,10 @@ Bashbot is not more (in)secure as any Bot written in an other language, we have
**Note:** Up to version 0.941 (mai/22/2020) telegram-bot-bash had a remote code execution bug, please update if you use an older version!
### Why Bash and not the much better xyz?
-Well, that's a damn good question ... may be because I'm an unix admin from stone age. Nevertheless there are more reasons from my side:
+Well, that's a damn good question... maybe because I'm a Unix admin from stone age. Nevertheless there are more reasons from my side:
-- bashbot will run everywhere where bash and (gnu) sed is available, from embedded linux to mainframe
-- easy to integrate with other shell script, e.g. for sending system message / health status
+- bashbot will run everywhere where bash and (gnu) sed is available, from embedded Linux to mainframe
+- easy to integrate with other shell scripts, e.g. for sending system message / health status
- no need to install or learn a new programming language, library or framework
- no database, not event driven, not object oriented ...
diff --git a/README.txt b/README.txt
index bdb7a11..1d3d24b 100644
--- a/README.txt
+++ b/README.txt
@@ -81,14 +81,14 @@ available on www.github.com
### Your really first bashbot in a nutshell
-To install and run bashbot you need access to a linux/unix command line with
+To install and run bashbot you need access to a Linux/Unix command line with
bash, a [Telegram client](https://telegram.org) and a mobile phone [with a
Telegram account](https://telegramguide.com/create-a-telegram-account/).
First you need to [create a new Telegram Bot token](doc/1_firstbot.md) for your
bot and write it down.
-Now open a linux/unix terminal with bash, create a new directory, change to it
+Now open a Linux/Unix terminal with bash, create a new directory, change to it
and install telegram-bot-bash:
```bash
@@ -183,7 +183,7 @@ bot commands.
It's important to escape or remove `$` in input from user, files or network
(_as bashbot does_)
-One of the powerful features of unix shells are variable and command
+One of the powerful features of Unix shells are variable and command
substitution using `${}` and`$()`,
this can lead to remote code execution (RCE) or remote information disclosure
(RID) bugs if unescaped `$` is included in untrusted input, e.g. `$$` or `$(rm
@@ -214,7 +214,7 @@ For the same reason every file your Bot can read is in danger to be disclosed.
Restrict your Bots access rights to the absolute minimum.
**Never run your Bot as root, this is the most dangerous you can do!** Usually
-the user 'nobody' has almost no rights on unix/linux systems. See [Expert
+the user 'nobody' has almost no rights on Linux/Unix systems. See [Expert
use](doc/4_expert.md) on how to run your Bot as an other user.
### Secure your Bot installation
@@ -243,12 +243,12 @@ bot commands you wrote and you should know about the risks ...
execution bug, please update if you use an older version!
### Why Bash and not the much better xyz?
-Well, that's a damn good question ... may be because I'm an unix admin from
+Well, that's a damn good question... maybe because I'm a Unix admin from
stone age. Nevertheless there are more reasons from my side:
- bashbot will run everywhere where bash and (gnu) sed is available, from
-embedded linux to mainframe
-- easy to integrate with other shell script, e.g. for sending system message /
+embedded Linux to mainframe
+- easy to integrate with other shell scripts, e.g. for sending system message /
health status
- no need to install or learn a new programming language, library or framework
- no database, not event driven, not object oriented ...
diff --git a/bashbot.sh b/bashbot.sh
index 9c82a0b..fc2334c 100755
--- a/bashbot.sh
+++ b/bashbot.sh
@@ -123,7 +123,7 @@ debug_checks(){ {
} >>"${DEBUGLOG}"
}
-# some linux, e.g. manajro seems not to have C locale activated by default
+# some Linux distributions (e.g. Manjaro) doesn't seem to have C locale activated by default
if _exists locale && [ "$(locale -a | grep -c -e "^C$" -e "^C.utf8$")" -lt 2 ]; then
printf "${ORANGE}Warning: locale ${NC}${GREY}C${NC}${ORANGE} and/or ${NC}${GREY}C.utf8${NC}${ORANGE} seems missing, use \"${NC}${GREY}locale -a${NC}${ORANGE}\" to show what locales are installed on your system.${NN}"
fi
diff --git a/doc/4_expert.md b/doc/4_expert.md
index 4d137f3..f6d2d9a 100644
--- a/doc/4_expert.md
+++ b/doc/4_expert.md
@@ -214,7 +214,7 @@ Location of the files `commands.sh`, `mycommands.sh`, `botconfig.jssh`, `botacl`
unset BASHBOT_ETC # keep in telegram-bot-bash (default)
export BASHBOT_ETC "" # keep in telegram-bot-bash
- export BASHBOT_ETC "/etc/bashbot" # unix like config location
+ export BASHBOT_ETC "/etc/bashbot" # Unix-like config location
export BASHBOT_ETC "/etc/bashbot/bot1" # multibot configuration bot 1
export BASHBOT_ETC "/etc/bashbot/bot2" # multibot configuration bot 2
@@ -228,7 +228,7 @@ Location of runtime data `data-bot-bash`, `count.jssh`
unset BASHBOT_VAR # keep in telegram-bot-bash (default)
export BASHBOT_VAR "" # keep in telegram-bot-bash
- export BASHBOT_VAR "/var/spool/bashbot" # unix like config location
+ export BASHBOT_VAR "/var/spool/bashbot" # Unix-like config location
export BASHBOT_VAR "/var/spool/bashbot/bot1" # multibot configuration bot 1
export BASHBOT_VAR "/var/spool/bashbot/bot2" # multibot configuration bot 2
@@ -253,7 +253,7 @@ This is also useful if you want to force bashbot to always use full pathnames in
unset BASHBOT_HOME # autodetection (default)
export BASHBOT_HOME "" # autodetection
- export BASHBOT_HOME "/usr/local/telegram-bot-bash" # unix like location
+ export BASHBOT_HOME "/usr/local/telegram-bot-bash" # Unix-like location
export BASHBOT_HOME "/usr/local/bin" # Note: you MUST set ETC, VAR and JSONSH to other locations to make this work!
```
diff --git a/doc/7_develop.md b/doc/7_develop.md
index 8212f0d..f2323e4 100644
--- a/doc/7_develop.md
+++ b/doc/7_develop.md
@@ -220,9 +220,9 @@ A typical bashbot develop loop looks as follow:
#### common commands
We state bashbot is a bash only bot, but this is not true. bashbot is a bash script using bash features PLUS external commands.
-Usually bash is used in a unix/linux environment where many (GNU) commands are available, but if commands are missing, bashbot may not work.
+Usually bash is used in a Linux/Unix environment where many (GNU) commands are available, but if commands are missing, bashbot may not work.
-To avoid this and make bashbot working on as many platforms as possible - from embedded linux to mainframe - I recommend to restrict
+To avoid this and make bashbot working on as many platforms as possible - from embedded Linux to mainframe - I recommend to restrict
ourself to the common commands provided by bash and coreutils/busybox/toybox.
See [Bash Builtins](https://www.gnu.org/software/bash/manual/html_node/Shell-Builtin-Commands.html),
[coreutils](https://en.wikipedia.org/wiki/List_of_GNU_Core_Utilities_commands),
diff --git a/examples/bash2env.sh b/examples/bash2env.sh
index 18c647e..85a0e59 100755
--- a/examples/bash2env.sh
+++ b/examples/bash2env.sh
@@ -19,7 +19,7 @@ MYSHEBANG=""
################
# uncomment one of the following lines to make the conversion
-# linux/unix bash
+# Linux/Unix bash
# MYSHEBANG="#!/bin/bash"
# BSD bash
diff --git a/examples/bashbot-multi.sh b/examples/bashbot-multi.sh
index d48da65..f9f0ee5 100755
--- a/examples/bashbot-multi.sh
+++ b/examples/bashbot-multi.sh
@@ -21,7 +21,7 @@ if true; then
VAR="${BINDIR}"
else
- # alternative linux like locations
+ # alternative Linux-like locations
BINDIR="/usr/local/bin"
ETC="/etc/bashbot"
VAR="/var/bashbot"