SUMMARY: Preventing shell escapes in FTP and Telnet

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Well, that was quick! This suggestion from Colin Wynne at
cwynne@mts.jhu.edu does the trick:

Despite my dislike for menu-driven Unix interfaces... Here's a
suggestion. Odds are that such programs use the SHELL variable for
determining the sub-process. Why not have the menu options call a
script that does something like

  #!/bin/sh

  SHELL=/bin/true
  export SHELL

  /usr/bin/real.telnet

Then, while shell escapes will still `work', they won't evaluate any
system commands. I just tried this myself and it seems to work fine.
I imagine ftp would be the same. In fact, just make a generic
front-end script that does something like

  #!/bin/sh

  BIN=$1
  shift

  SHELL=/bin/true
  export SHELL

  $BIN $*

or some such...

Hope this helps,

CJW

-----

I tried this on Solaris 2.5, and when you press ! to try to get a shell,
it just returns you to the ftp or telnet prompt. Works for me! Thanks!

Scott

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:11:13 CDT