learning script

Daniel McAferty wrote:
> I know a lot of people don't like to do this but I
> add the "." to may path. Then I don't have to type ./ to
> run a command located in my current directory.
>
> path = $path:.
>

Here's why you should not put "." in your path,
and why putting it at the end is a little better.

Suppose I want to root a system. I write a special version
of the 'ls' command, for example, that behaves like 'ls'
but collects some useful information for me as well.

Now, I find that I'm able to write into your home directory.
I plant my 'ls' command in your home directory. You have '.'
in your path, somewhere before /bin. The next time you type
'ls', the one in your home directory is executed, and my code
is running under your user ID.

OK, so if the dot is at the end of your path, you're
safe. Right? Well, maybe if you never mistype a command.
But the cracker may also plant a misspelled command in
your home directory, and if you use that common misspelling
by mistake, it won't be anywhere in your normal path ...
and you get to that dot at the end.

All this may seem improbable, but the art of cracking
is full of tricks like this that are proven to work.
Obviously not every time ... so the cracker will pepper
your system with all sorts of little trojans like this,
and if you're careless enough one of them will work.

These guys do this for fun, they have too much time on
their hands, and they have a lot of this automated by
scripts ... these are the Script Kiddies. They just
turn their scripts loose on enough systems and one of
them will crack. You don't want it to be yours.

So make sure you never have '.' in your path, at all,
when working as root! That's one good reason to use
the ./foo method for executing a command in your current
directory. It's something your fingers will learn
very quickly.

In general, the shorter your path is, the better.
More efficient, and less likely to run into old
junk that will get you into trouble.

Another rule of good scripting is not to rely on your
path. If all your commands use absolute paths,
such as /bin/rm, then nobody can hijack your script
by corrupting your path.

Vic