mirror of
https://github.com/octoleo/telegram-bot-bash.git
synced 2024-12-28 20:52:36 +00:00
Security considerations and Typos
This commit is contained in:
Kay Marquardt (Gnadelwartz)
parent
851be83518
commit
0a90edbe52
41
README.md
41
README.md
@ -8,7 +8,7 @@ Written by Drew (@topkecleon), Daniil Gentili (@danogentili), and Kay M (@gnadel
|
||||
|
||||
Contributions by JuanPotato, BigNerd95, TiagoDanin, and iicc1.
|
||||
|
||||
[Download from github](https://github.com/topkecleon/telegram-bot-bash)
|
||||
[Download from github](https://github.com/topkecleon/telegram-bot-bash/releases)
|
||||
|
||||
Released to the public domain wherever applicable.
|
||||
Elsewhere, consider it released under the [WTFPLv2](http://www.wtfpl.net/txt/copying/).
|
||||
@ -99,7 +99,7 @@ To use the functions provided in this script in other scripts simply source bash
|
||||
Have FUN!
|
||||
|
||||
|
||||
### Receive data
|
||||
### Recieve data
|
||||
Evertime a Message is recieved, you can read incoming data using the following variables:
|
||||
|
||||
* ```$MESSAGE```: Incoming messages
|
||||
@ -242,7 +242,7 @@ To insert a linebreak in your message you can insert ```mynewlinestartshere``` i
|
||||
```
|
||||
echo "Text that will appear in one message mynewlinestartshere with this text on a new line"
|
||||
```
|
||||
|
||||
Note: Interactive Chats run independent from main bot and continue running until your script exits or you /cancel if from your Bot.
|
||||
|
||||
#### Background Jobs
|
||||
|
||||
@ -265,7 +265,7 @@ If you want to kill all background jobs permantly run:
|
||||
./bashbot.sh killback
|
||||
|
||||
```
|
||||
Note: If your run bashbot as an other user or system service, see Expert use.
|
||||
Note: Background Jobs run independent from main bot and continue running until your script exits or you stop if from your Bot. Backgound Jobs will continue running if your Bot is stoped (kill)!.
|
||||
|
||||
#### Inline queries
|
||||
The following commands allows users to interact with your bot via *inline queries*.
|
||||
@ -366,7 +366,7 @@ export LANGUAGE=den_US.UTF-8
|
||||
|
||||
To display all availible locales on your system run ```locale -a | more```. [Gentoo Wiki](https://wiki.gentoo.org/wiki/UTF-8)
|
||||
|
||||
### UTF-8 in Telegram and Bash
|
||||
### UTF-8 in Telegram
|
||||
```UTF-8``` is a variable length encoding of Unicode. UTF-8 is recommended as the default encoding in JSON, XML and HTML, also Telegram make use of it.
|
||||
|
||||
The first 128 characters are regular ASCII, so it's a superset of and compatible with ASCII environments. The next 1,920 characters need
|
||||
@ -382,7 +382,7 @@ E.g. the Emoticons ``` 😁 😘 ❤️ 😊 👍 ``` are encoded as:
|
||||
'\uXXXX' and '\UXXXXXXXX' escaped endocings are supported by zsh, bash, ksh93, mksh and FreeBSD sh, GNU 'printf' and GNU 'echo -e', see [this Stackexchange Answer](https://unix.stackexchange.com/questions/252286/how-to-convert-an-emoticon-specified-by-a-uxxxxx-code-to-utf-8/252295#252295) for more information.
|
||||
|
||||
|
||||
## Expert Usage
|
||||
## Expert Use
|
||||
Bashbot is desingned to run manually by the user who installed it. Nevertheless it's possible to run it by an other user-ID, as a system service or sceduled from cron. This is onyl recommended for experiend linux users.
|
||||
|
||||
### Run as other user or system service
|
||||
@ -410,18 +410,39 @@ If you started bashbot by bashbot.rc you must use bashbot.rc also to manage your
|
||||
./bashbot.rc resumeback
|
||||
./bashbot.rc killback
|
||||
```
|
||||
To change back the environment to your user-ID run ```./bashbot.rc init``` again and enter your user-ID.
|
||||
To change back the environment to your user-ID run ```./bashbot.rc init``` again and enter your user name.
|
||||
|
||||
To use bashbot as a system servive include a working ```bashbot.rc``` in your init system (systemd, /etc/init.d).
|
||||
|
||||
### Scedule bashbot from Cron
|
||||
An example crontab is provided in ```bashbot.cron```.
|
||||
|
||||
- If you are running bashbot with your user-ID, copy the examples lines to your crontab and remove username ```www```.
|
||||
- if you run bashbot as an other user or a system service edit ```bashbot.cron``` to fit your needs and replace username````www``` with the username you want to run bashbot. copy the modified file to ```/etc/cron.d/bashbot```
|
||||
- If you are running bashbot with your user-ID, copy the examples lines to your crontab and remove username ```nobody```.
|
||||
- if you run bashbot as an other user or a system service edit ```bashbot.cron``` to fit your needs and replace username````nobody``` with the username you want to run bashbot. copy the modified file to ```/etc/cron.d/bashbot```
|
||||
|
||||
|
||||
## Security Considerations
|
||||
Running a Telegram Bot means you are conneted to the public, you never know whats send to your Bot.
|
||||
|
||||
Bash scripts in general are not designed to be bullet proof, so consider this Bot as a proof of concept. More concret examples of security problems is bash's 'quoting hell' and globbing. [Implications of wrong quoting](https://unix.stackexchange.com/questions/171346/security-implications-of-forgetting-to-quote-a-variable-in-bash-posix-shells)
|
||||
|
||||
Whenever you are processing input from outside your bot you should disable globbing (set -f) and carefully quote everthing.
|
||||
|
||||
### Run your Bot as a restricted user
|
||||
Every file your bot can write is in danger to be overwritten/deleted, In case of bad handling of user input every file your Bot can read is in danger of being disclosed.
|
||||
|
||||
Never run your Bot as root, this is the most dangerous you can do! Usually the user 'nobody' has almost no rigths on Unix/Linux systems. See Expert use on how to run your Bot as an other user.
|
||||
|
||||
### Secure your Bot installation
|
||||
Everyone who can read your Bot files can extract your Bots data. Especially your Bot Token in ```token``` must be protected against other users. No one exept you should have write access to the Bot files. The Bot itself need write access to ```count``` and ```tmp-bot-bash``` only, all other files should be write protected.
|
||||
|
||||
Runing ```./bashbot init``` sets the Bot permissions to reasonable default values as a starting point.
|
||||
|
||||
### Is this Bot insecure?
|
||||
No - its not more or less insecure as any other Bot written in any other language. But you should know about the implications ...
|
||||
|
||||
## That's it!
|
||||
|
||||
If you feel that there's something missing or if you found a bug, feel free to submit a pull request!
|
||||
|
||||
#### $$VERSION$$ v0.49-0-g64255eb
|
||||
#### $$VERSION$$ v0.49-1-g851be83
|
||||
|
||||
@ -7,7 +7,7 @@
|
||||
# This file is public domain in the USA and all free countries.
|
||||
# Elsewhere, consider it to be WTFPLv2. (wtfpl.net/txt/copying)
|
||||
#
|
||||
#### $$VERSION$$ v0.49-0-g64255eb
|
||||
#### $$VERSION$$ v0.49-1-g851be83
|
||||
|
||||
|
||||
SHELL=/bin/sh
|
||||
@ -28,9 +28,9 @@ MAILTO=root
|
||||
# * * * * * root echo "run every minute!"
|
||||
|
||||
# run as www every day at 0:00
|
||||
0 0 * * * www /usr/local/telegram-bot-bash/bashbot.sh start # (re)start bot
|
||||
0 0 * * * www /usr/local/telegram-bot-bash/bashbot.sh resumeback # (re)start background jobs
|
||||
0 0 * * * nobody /usr/local/telegram-bot-bash/bashbot.sh start # (re)start bot
|
||||
0 0 * * * nobody /usr/local/telegram-bot-bash/bashbot.sh resumeback # (re)start background jobs
|
||||
|
||||
# run as www on 24 of Dec, 12:00
|
||||
0 12 24 12 * www /usr/local/telegram-bot-bash/bashbot.sh broadcast "X-Mas shopping is over!" # broadcast qa message
|
||||
0 12 24 12 * nobody /usr/local/telegram-bot-bash/bashbot.sh broadcast "X-Mas shopping is over!" # broadcast qa message
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
#!/bin/sh
|
||||
# description: Start or stop telegram-bash-bot
|
||||
#
|
||||
#### $$VERSION$$ v0.49-0-g64255eb
|
||||
#### $$VERSION$$ v0.49-1-g851be83
|
||||
#
|
||||
### BEGIN INIT INFO
|
||||
# Provides: bashbot
|
||||
@ -16,7 +16,7 @@ runas="root" # not recommended!
|
||||
runcmd="echo" # not actived until you edit lines below
|
||||
|
||||
# uncomment the next line to run as other user, e.g. www
|
||||
# runas="www"
|
||||
# runas="nobody"
|
||||
|
||||
# uncomment one of the following lines
|
||||
# runcmd="su $runas -s /bin/bash -c " # runasuser with su
|
||||
|
||||
16
bashbot.sh
16
bashbot.sh
@ -10,7 +10,7 @@
|
||||
# This file is public domain in the USA and all free countries.
|
||||
# Elsewhere, consider it to be WTFPLv2. (wtfpl.net/txt/copying)
|
||||
#
|
||||
#### $$VERSION$$ v0.49-0-g64255eb
|
||||
#### $$VERSION$$ v0.49-1-g851be83
|
||||
|
||||
# get location of bashbot.sh an change to bashbot dir
|
||||
SCRIPT="./$(basename $0)"
|
||||
@ -394,12 +394,12 @@ checkproc() {
|
||||
|
||||
killback() {
|
||||
killproc "back-$1-"
|
||||
rm "$TMPDIR/${copname}$1-back.cmd"
|
||||
rm -f "$TMPDIR/${copname}$1-back.cmd"
|
||||
}
|
||||
|
||||
killproc() {
|
||||
local fifo="$1${copname}"
|
||||
(tmux kill-session -t "${fifo}"; echo imprettydarnsuredatdisisdaendofdacmd>$TMPDIR/${fifo}; tmux kill-session -t sendprocess_${fifo}; rm -r $TMPDIR/${fifo})2>/dev/null
|
||||
(tmux kill-session -t "${fifo}"; echo imprettydarnsuredatdisisdaendofdacmd>$TMPDIR/${fifo}; tmux kill-session -t sendprocess_${fifo}; rm -f -r $TMPDIR/${fifo})2>/dev/null
|
||||
}
|
||||
|
||||
inproc() {
|
||||
@ -519,7 +519,7 @@ case "$1" in
|
||||
read -t 10 line
|
||||
[ "$line" != "" -a "$line" != "imprettydarnsuredatdisisdaendofdacmd" ] && send_message "$2" "$line"
|
||||
done <$TMPDIR/$3
|
||||
rm -r $TMPDIR/$3
|
||||
rm -f -r $TMPDIR/$3
|
||||
;;
|
||||
"count")
|
||||
echo "A total of $(wc -l ${COUNT} | sed 's/count//g')users used me."
|
||||
@ -539,7 +539,7 @@ case "$1" in
|
||||
;;
|
||||
"init") # adjust users and permissions
|
||||
MYUSER="$USER"
|
||||
[[ $(id -u) -eq 0 ]] && MYUSER="www"
|
||||
[[ $(id -u) -eq 0 ]] && MYUSER="nobody"
|
||||
echo -n "Enter User to run basbot [$MYUSER]: "
|
||||
read TOUSER
|
||||
[ "$TOUSER" = "" ] && TOUSER="$MYUSER"
|
||||
@ -573,7 +573,7 @@ case "$1" in
|
||||
JOB="${JOB%:*}"
|
||||
fifo="back-${JOB}-${ME}_${CHAT[ID]}" # compose fifo from jobname, $ME (botname) and CHAT[ID]
|
||||
echo "restartbackground ${PROG} ${fifo}"
|
||||
( tmux kill-session -t "${fifo}"; tmux kill-session -t sendprocess_${fifo}; rm -r $TMPDIR/${fifo}) 2>/dev/null
|
||||
( tmux kill-session -t "${fifo}"; tmux kill-session -t sendprocess_${fifo}; rm -f -r $TMPDIR/${fifo}) 2>/dev/null
|
||||
mkfifo "$TMPDIR/${fifo}"
|
||||
TMUX= tmux new-session -d -s "${fifo}" "${PROG} &>$TMPDIR/${fifo}; echo imprettydarnsuredatdisisdaendofdacmd>$TMPDIR/${fifo}"
|
||||
TMUX= tmux new-session -d -s sendprocess_${fifo} "bash $SCRIPT outproc ${CHAT[ID]} ${fifo}"
|
||||
@ -597,8 +597,8 @@ case "$1" in
|
||||
JOB="${REMOVE#*:}"
|
||||
fifo="back-${JOB%:*}-${ME}_${REMOVE%%:*}"
|
||||
echo "killbackground ${fifo}"
|
||||
[ "$1" == "killback" ] && rm $FILE # remove job
|
||||
( tmux kill-session -t "${fifo}"; tmux kill-session -t sendprocess_${fifo}; rm -r $TMPDIR/${fifo}) 2>/dev/null
|
||||
[ "$1" == "killback" ] && rm -f $FILE # remove job
|
||||
( tmux kill-session -t "${fifo}"; tmux kill-session -t sendprocess_${fifo}; rm -f -r $TMPDIR/${fifo}) 2>/dev/null
|
||||
fi
|
||||
done
|
||||
;;
|
||||
|
||||
@ -4,7 +4,7 @@
|
||||
# This file is public domain in the USA and all free countries.
|
||||
# Elsewhere, consider it to be WTFPLv2. (wtfpl.net/txt/copying)
|
||||
#
|
||||
#### $$VERSION$$ v0.49-0-g64255eb
|
||||
#### $$VERSION$$ v0.49-1-g851be83
|
||||
|
||||
# adjust your language setting here, e.g.when run from other user or cron.
|
||||
# https://github.com/topkecleon/telegram-bot-bash#setting-up-your-environment
|
||||
@ -25,7 +25,7 @@ else
|
||||
[ ! -z ${URLS[*]} ] && {
|
||||
curl -s ${URLS[*]} -o $NAME
|
||||
send_file "${CHAT[ID]}" "$NAME" "$CAPTION"
|
||||
rm "$NAME"
|
||||
rm -f "$NAME"
|
||||
}
|
||||
[ ! -z ${LOCATION[*]} ] && send_location "${CHAT[ID]}" "${LOCATION[LATITUDE]}" "${LOCATION[LONGITUDE]}"
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user