Security Best Practices in Bash

# CHAPTER 18

Security Best Practices in Bash #

1. Introduction #

2. Learning Objectives #

• Identify and prevent Command Injection vulnerabilities in Bash.

• Sanitize and validate external user input mathematically and alphabetically.

• Understand the catastrophic security risks of unquoted variables.

• Securely create and manage temporary files using mktemp.

• Implement the Principle of Least Privilege regarding script execution.

3. The Threat of Command Injection #

#!/bin/bash
read -p "Enter IP to ping: " USER_IP
ping -c 1 $USER_IP

What happens if a hacker types: 8.8.8.8; cat /etc/shadow ? Bash sees the semicolon (;) as the end of the ping command and happily executes the next command, instantly printing your top-secret password hashes to the screen!

The Mitigation (Validation): You must validate that the user's input *only* contains numbers and dots before executing it.

# Check if input matches an IP address regex pattern
if [[ ! "$USER_IP" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
    echo "SECURITY ALERT: Invalid IP format detected."
    exit 1
fi

4. The Danger of Unquoted Variables #

Suppose you have a script to delete a temporary folder:

# Hacker sets the variable to: "/tmp/* *"
rm -rf $TEMP_FOLDER

If you do not quote the variable, Bash evaluates the asterisk (*) and deletes EVERYTHING in your current directory! The Mitigation: ALWAYS quote variables used in execution commands.

# Bash treats this as a single literal string, blocking the wildcard explosion.
rm -rf "$TEMP_FOLDER"

5. Secure Temporary Files (mktemp) #

The Mitigation: Use mktemp. mktemp generates a mathematically random, unpredictable, and securely permissioned file that hackers cannot exploit.

# Create a secure temp file
SECURE_FILE=$(mktemp -t my_script.XXXXXX)

# Write to it securely
echo "Data" > "$SECURE_FILE"

# Clean it up when done
rm -f "$SECURE_FILE"

6. The Principle of Least Privilege #

#!/bin/bash
# ... normal text processing happens here as a regular user ...

# Elevate privileges ONLY for this specific action
sudo systemctl restart nginx

7. Diagrams/Visual Suggestions #

8. Best Practices #

• Never use eval: The eval command is a built-in Bash function that forces the shell to evaluate a string as executable code. It is notorious in cybersecurity as the ultimate backdoor. If any user input touches an eval statement, your system is compromised. Avoid it entirely.

9. Common Mistakes #

• Hardcoding Passwords (Again): As mentioned in Chapter 17, hardcoding AWS API keys, database passwords, or SSH keys inside a .sh file is the fastest way to get hacked. Use .env files, or better yet, use secure Key Vaults (like HashiCorp Vault or AWS Secrets Manager) and use curl within your script to dynamically fetch the password into memory at runtime.

10. Mini Project: The Secure Input Validator #

1. 1. nano secure_lookup.sh

1. 2. Write the code:

#!/bin/bash
set -e

echo "--- SECURE DOMAIN LOOKUP ---"
read -p "Enter domain name to resolve: " DOMAIN

# 1. Sanitize: Block semicolons, ampersands, and pipes
if [[ "$DOMAIN" == *";"* ]] || [[ "$DOMAIN" == *"&"* ]] || [[ "$DOMAIN" == *"|"* ]]; then
    echo "SECURITY ERROR: Illegal characters detected. Incident logged." >&2
    exit 1
fi

# 2. Sanitize: Ensure it is not empty
if [ -z "$DOMAIN" ]; then
    echo "ERROR: Input cannot be empty."
    exit 1
fi

echo "Resolving domain securely..."
# 3. Secure Execution: Quote the variable to prevent word splitting
host "$DOMAIN"

1. 3. Run it and try to hack it by typing google.com; ls. The script will instantly shut you down!

11. Practice Exercises #

1. 1. Define "Command Injection" within the context of a Bash script. Provide an example of how a semicolon (;) can be weaponized by a malicious actor.

1. 2. Explain the security vulnerability involved in creating a statically named temporary file (e.g., /tmp/temp.txt), and describe how the mktemp utility mitigates this risk.

12. MCQs with Answers #

13. Interview Questions #

• Q: A web application passes user input from an HTML text box directly into a backend Bash script variable named $USERID. The script executes the command cat /var/data/$USERID.txt. Explain exactly how an attacker could utilize this vulnerability to read the /etc/passwd file, and how you would sanitize the input to prevent it.

• Q: Explain the mechanical difference between executing a variable as rm $TEMP versus rm "$TEMP". Why is the latter considered a mandatory security practice in Linux administration?

• Q: You review a colleague's script and find the command eval $CUSTOM_COMMAND. Explain the extreme cybersecurity implications of the eval command, and why it is almost universally banned in production environments.

14. FAQs #

15. Summary #

16. Next Chapter Recommendation #