LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Enterprise (https://www.linuxquestions.org/questions/linux-enterprise-47/)
-   -   Shell script issue (https://www.linuxquestions.org/questions/linux-enterprise-47/shell-script-issue-657331/)

suvra82002 07-21-2008 11:40 PM
Shell script issue
 
Hi All,

Good morning....I need a help in writing one shell script....(RHEL5)

I will describe the scenario first..

I want to install jboss on various system on boot time install....

so my requirement is to write a script that will install jboss products as a root user only..If its any other user it should throw a error message and exit.....

The script is not supposed to take the username from the user himself. It is supposed to see which user it is running as (self). If any user other than root run this script it should give error and exit.......

Kindly any1 help me to do that....if any1 has written a script pls help me out.....

Regards
Suvra

Mr. C. 07-21-2008 11:52 PM
man id
man bash, search UID

Vit77 07-22-2008 05:14 AM
Code:
if [ "$LOGNAME" != "root" ]
then
  echo You are not root user!
  exit 1
fi

go on here...

Mr. C. 07-22-2008 11:41 AM
FYI: LOGNAME is not always a reliable test. Some users have root accounts that use different names, such as "toor", or "rot"; these convenience accounts are commonplace for many, and exist by default in some BSDs.

UID=0 will always be the correct test.

custangro 07-22-2008 11:46 AM
Quote:
Originally Posted by Mr. C. (Post 3222769)
FYI: LOGNAME is not always a reliable test. Some users have root accounts that use different names, such as "toor", or "rot"; these convenience accounts are commonplace for many, and exist by default in some BSDs.

UID=0 will always be the correct test.
Correct...

I always use...

Code:
if [ $(id -u) -ne 0 ]; then
  echo "You are not root"
  exit 1
fi
One caveat is that if you are on Solaris you have yo make sure that you use /usr/xpg4/bin/id

-C

Vit77 07-22-2008 11:45 PM
Quote:
Originally Posted by Mr. C. (Post 3222769)
FYI: LOGNAME is not always a reliable test.
...
UID=0 will always be the correct test.
Sure, You're right. It'll make the script stronger.
Just sometimes it's easier for beginners to understand with exact names instead of numbers.

Mr. C. 07-22-2008 11:57 PM
Actually, I disagree with this. Users *should* learn about UID/GID, as they are the key permissions-granting aspect of *nix systems. User names are simple, decorative candy above that.

custangro 07-23-2008 10:37 AM
Quote:
Originally Posted by Mr. C. (Post 3223339)
Actually, I disagree with this. Users *should* learn about UID/GID, as they are the key permissions-granting aspect of *nix systems. User names are simple, decorative candy above that.
I agree with your disagreement :D

-C

Vit77 07-23-2008 02:32 PM
Quote:
Originally Posted by Mr. C. (Post 3223339)
Users *should* learn about UID/GID, as they are the key permissions-granting aspect of *nix systems.
I'm agree with this point too, they should.
But I'm not sure you will memorize 150 UIDs instead of usernames.
Changing the name of root user is not a panacea, and it hardly could protect the system from an attack.

Quote:
Originally Posted by Mr. C. (Post 3223339)
User names are simple, decorative candy above that.
Do you register in your system using UID? Or do you writing e-mails to 1111@22.33.44.55? :)

Returning tho the original question, I'm still convenienced that my script was more understandable, and it could involve beginners in thinking, whereas these "weird" numbers usually have opposite effect.

Whar's more, suvra82002 has written about RHEL5, where by default root user is called exactly root.

And finally, even id could be substituted with mal-ware and return not so reliable values...

custangro 07-23-2008 02:55 PM
Quote:
Originally Posted by Vit77 (Post 3224079)
I'm agree with this point too, they should.
But I'm not sure you will memorize 150 UIDs instead of usernames.
Changing the name of root user is not a panacea, and it hardly could protect the system from an attack.


Do you register in your system using UID? Or do you writing e-mails to 1111@22.33.44.55? :)

Returning tho the original question, I'm still convenienced that my script was more understandable, and it could involve beginners in thinking, whereas these "weird" numbers usually have opposite effect.

Whar's more, suvra82002 has written about RHEL5, where by default root user is called exactly root.

And finally, even id could be substituted with mal-ware and return not so reliable values...
You're missing the point.

We are not memorizing UID's ... we are using the UID in the script so that it would be portable... in which case using the UID is preferable.

And if you are scared of malware/virus/root-kit then you should stop using computers...since it WILL happen to you one day...question is "when".

Mr. C. and i were just trying to give you "best practice"...don't take it personal...but if you ask around using UID is superior to login names...not that using login names is "wrong"...just that using UID is superior...

-C

Mr. C. 07-23-2008 02:58 PM
Quote:
Originally Posted by Vit77 (Post 3224079)
I'm agree with this point too, they should.
But I'm not sure you will memorize 150 UIDs instead of usernames.
Changing the name of root user is not a panacea, and it hardly could protect the system from an attack.
Who cares about 150 UIDs? Two concepts are necessary: 0 and non-zero.

Who said anything about attacks? I said "convenience accounts", and nothing about security via obfuscation techniques.

Quote:
Originally Posted by Vit77 (Post 3224079)
Do you register in your system using UID? Or do you writing e-mails to 1111@22.33.44.55? :)
Of course not - the point isn't that one should not use names, it is that names DO NOT imply permission. The entire OS uses UID/GID/EUID/EGUID internally, not names.

My mail accounts are virtual, so that point is moot.
Quote:
Originally Posted by Vit77 (Post 3224079)
Returning tho the original question, I'm still convenienced that my script was more understandable, and it could involve beginners in thinking, whereas these "weird" numbers usually have opposite effect.
Code that just sometimes works by design is bad code - period. Standard practice is to check UID. With almost +25 years of experience with *nix systems, I'm confident in my assessment. If you want to write code that we all can see *will* fail under certain circumstances, be my guest. I'll concede the battle that demonstrates anther's foolishness.

Quote:
Originally Posted by Vit77 (Post 3224079)
Whar's more, suvra82002 has written about RHEL5, where by default root user is called exactly root.
Again, many seasoned admins create UID=0 accounts that are not named "root". This is not an uncommon practice. It is done AFTER the default system has been setup, and code should accommodate this.
Quote:
Originally Posted by Vit77 (Post 3224079)
And finally, even id could be substituted with mal-ware and return not so reliable values...
Now this argument is just plain silly. So in that case could the shell (which provides your LOGNAME) and any other utility. You've switched into an entirely different ballpark with this one.

custangro 07-23-2008 02:59 PM
Quote:
Originally Posted by Mr. C. (Post 3224104)
Code that just sometimes works by design is bad code
Good Point.

-C

Vit77 07-25-2008 07:31 AM
Quote:
Originally Posted by custangro (Post 3224100)
And if you are scared of malware/virus/root-kit then you should stop using computers...since it WILL happen to you one day...question is "when".
I just said that changing root name hardly could protect the system from an attack. right?
Quote:
Originally Posted by custangro (Post 3224100)
Mr. C. and i were just trying to give you "best practice"...don't take it personal...but if you ask around using UID is superior to login names...not that using login names is "wrong"...just that using UID is superior...
I'm taking it easy, don't worry.
UID=0 is used often, but I doubt about regular users. Mr. C. is more proper in that.
Look at the Oracle Guides, for instance:
Code:
if [ $USER = "oracle" ]; then
        if [ $SHELL = "/bin/ksh" ]; then
              ulimit -p 16384
              ulimit -n 65536
        else
              ulimit -u 16384 -n 65536
        fi
fi
Quote:
Originally Posted by Mr. C. (Post 3224104)
Code that just sometimes works by design is bad code - period.
True. But not for this case.
This code works on standard systems. And renaming "root" is getting less common already AFAIK.

You've said about convenience accounts. Why is it more convenient than standard "root"? Or what else does it mean?

And thanks for your assertion about "anothers in the battle"...

Mr. C. 07-25-2008 02:57 PM
The oracle example requires usage of USER = oracle, because that is the name by which the system was installed. An installation cannot assume a UID/GID, but can default to certain username/groupnames for installation and runtime. This is the case where USER is the correct usage. The point to take note of is that *the most accurate* mechanism should be used. In the case of superuser privs, its UID=0, or for group wheel or root, its GID=0, and in the case of some software installation that uses specific username/groupnames, USER is correct.

Quote:
Originally Posted by Vit77
True. But not for this case.
This code works on standard systems. And renaming "root" is getting less common already AFAIK.
No, it doesn't. My NetBSD system BY DEFAULT comes with BOTH root and toor accounts, both with UID=0
Code:
root:*:0:0:Charlie &:/root:/bin/csh
toor:*:0:0:Bourne-again Superuser:/root:/bin/sh
If you look carefully, you will find there is utility there. This has nothing to do with renaming an account. This has been a practice for almost 25+ years.

Self-serving estimates of the state of the world are silly. "less common" and "not for this case" show your focus is not on portability and correctness, but rather sticking to your guns. Shoot on...

custangro 07-25-2008 04:50 PM
Quote:
Originally Posted by Mr. C. (Post 3226373)
The oracle example requires usage of USER = oracle, because that is the name by which the system was installed. An installation cannot assume a UID/GID, but can default to certain username/groupnames for installation and runtime. This is the case where USER is the correct usage. The point to take note of is that *the most accurate* mechanism should be used.
...And in the case of oracle I STILL wouldn't use the login name...I would do something similar to...

Code:
#!/bin/bash
#
oracleuser=oracle
oracleid=$(id -u oracle)
#
if [ $(id -u) -ne ${oracleid} ]; then
  echo "You are not the oracle user..."
  exit
fi
So if the oracle user EVER changes...for whatever reason..all you would have to change is the oracleuser= part in the script...this is also good for portability since I've run across installations of oracle where the user name was something weird like ora

My :twocents:

ghostdog74 07-25-2008 09:30 PM
Use the UID to test for root as Mr.C has stated. Any user with UID of 0 has superuser privilege, regardless of username.
You might also want to use some passwd checking utility to check for users that have their UIDs set to 0 besides root. (or write a script to parse /etc/passwd).

custangro 07-25-2008 10:50 PM
Quote:
Originally Posted by ghostdog74 (Post 3226557)
Use the UID to test for root as Mr.C has stated. Any user with UID of 0 has superuser privilege, regardless of username.
You might also want to use some passwd checking utility to check for users that have their UIDs set to 0 besides root. (or write a script to parse /etc/passwd).
I did something similar to this when I was at my last job...

Code:
#!/bin/bash
maxcount=1
currcount=$(awk -F':' '{print $3}' /etc/passwd | grep '^0' | wc -l)
#
if [ ${currcount} -gt ${maxcount} ]; then
  echo "MORE THAN ONE USER WITH UID OF 0" | mailx -s "SECURITY: ERROR" name@email.com
fi
There is probably a better way...but this is how I do it...

-C

Vit77 07-26-2008 07:07 AM
Quote:
Originally Posted by ghostdog74 (Post 3226557)
Any user with UID of 0 has superuser privilege, regardless of username.
The clearest point of all this discussion. I was agree with that initially.

Quote:
Originally Posted by Mr. C. (Post 3226373)
I said "convenience accounts"
Mr.C., I haven't still caught the convenience explanation. Or does it mean just switching between sh and csh by user name?

My estimates were built on my 9+ *Nix experience (not BSD, I've never used it). Thus, I know just one admin who renames root accounts, as he says, by force of habit (17years of nix experience, the age of R-commands...). Another one used it before, but gave up. But all others have never used renaming at all. That was the point of my statement. I didn't mean two or more uid=0 - accounts there.

What about "not for this case", I bet this code will work on the Suvra's box. User toor is in doubt in this situation, so checking for uid could allow hacker with uid=0 to perform the operation. It'd probably be stronger to check for both uid and username. Looks funny?
If a system is compromised, such ways don't work at all.
BTW, I remember that you said nothing about security...

And finally, Mr.C, sometimes you're trying to assure me of things I'm assured myself. So, let me express clearly my position.

I'm absolutely agree that uid=0 is more portable.
I'm agree that users should learn about UID/GID.
However, I'm afraid, Suvra has less than 25 nix experience, and he doesn't run some production server. So, I tried to make it easier, partially at the expense of some features which could never been used.
I'm agree about sometimes working code. Code should work stable in normal predefined conditions. However, there is no bug-free code in the world. Each program will fail in certain circumstances. Nevertheless, I agree that we should try to make it better.

I hope, it'll make the debates more constructive.

Vit77 07-26-2008 07:17 AM
Quote:
Originally Posted by custangro (Post 3226451)
...And in the case of oracle I STILL wouldn't use the login name...I would do something similar to...
Code:
#!/bin/bash
#
oracleuser=oracle
oracleid=$(id -u oracle)
#
if [ $(id -u) -ne ${oracleid} ]; then
  echo "You are not the oracle user..."
  exit
fi
In case of normal functioning, it looks like if Var1 is true then Var2 = true... So, checking the account by its name would work not worse.
If there is something wrong in a system, however, such script could make the situation even worse...

You assented about "Code that just sometimes works by design"? And made Four mistakes in 6 lines...
#1 You don't use defined variable oracleuser. Well, it's a slip.
Then, how do you think the script will behave if there are:
#2 No oracle accounts?
#3 Several Oracle accounts?
#4 Several users with oracle's uid?
Absolutely good code is not exist. Even if you correct these, some other will appear...

Quote:
Originally Posted by custangro (Post 3226451)
I've run across installations of oracle where the user name was something weird like ora
I've used Oracle from the version of 7 (with SCO), and I've never seen installations with non-'oracle' OS user... May be it was DB User? Or not *nix?

PS In the post #17, it'd be easier to get currcount this way:
awk -F':' '$3 == 0 {cnt++} END {print cnt}' /etc/passwd

ghostdog74 07-26-2008 07:31 AM
Quote:
Originally Posted by Vit77 (Post 3226828)
awk -F':' '$3 == 0 {cnt++} END {print cnt}' /etc/passwd
it needs to be emailed, OP's requirement
Code:
awk -F':' '$3 == 0 {cnt++} END {if(cnt>1) { cmd="mail ..."; system(cmd) }}' /etc/passwd

custangro 07-26-2008 10:56 AM
Quote:
Originally Posted by Vit77 (Post 3226828)
In case of normal functioning, it looks like if Var1 is true then Var2 = true... So, checking the account by its name would work not worse.
If there is something wrong in a system, however, such script could make the situation even worse...

You assented about "Code that just sometimes works by design"? And made Four mistakes in 6 lines...
#1 You don't use defined variable oracleuser. Well, it's a slip.
Then, how do you think the script will behave if there are:
#2 No oracle accounts?
#3 Several Oracle accounts?
#4 Several users with oracle's uid?
Absolutely good code is not exist. Even if you correct these, some other will appear...


I've used Oracle from the version of 7 (with SCO), and I've never seen installations with non-'oracle' OS user... May be it was DB User? Or not *nix?

PS In the post #17, it'd be easier to get currcount this way:
awk -F':' '$3 == 0 {cnt++} END {print cnt}' /etc/passwd
...So you are critiquing my "sample" code while your sample code looks like this?

Quote:
Originally Posted by Vit77
if [ "$LOGNAME" != "root" ]
then
echo You are not root user!
exit 1
fi

go on here...
Wow you are petty...


PS I never had good luck using a bang (!) in an echo...you may want to put it in quotes...(see I can be pathetic too...)

-C

Mr. C. 07-26-2008 11:40 AM
I think its time for this thread to rest.

custangro 07-26-2008 12:00 PM
Quote:
Originally Posted by Mr. C. (Post 3227007)
I think its time for this thread to rest.
Unsubscribing

-C

Vit77 07-26-2008 02:02 PM
Quote:
Originally Posted by custangro (Post 3226987)
...So you are critiquing my "sample" code while your sample code looks like this?
Unfortunately, nothing constructive again...


All times are GMT -5. The time now is 10:01 AM.