Script security best practices in Bash Scripting - Cheat Sheet & Quick Revision

Recall & Review

beginner

Why should you avoid running scripts as the root user unless absolutely necessary?

Running scripts as root can cause serious damage if the script has errors or is malicious. It can change or delete important system files. Always use the least privilege needed to reduce risk.

beginner

What is the purpose of using 'set -e' at the start of a bash script?

'set -e' makes the script stop immediately if any command fails. This helps prevent the script from continuing in a broken state, which can cause security or data problems.

intermediate

How can you protect sensitive data like passwords in your scripts?

Avoid hardcoding passwords in scripts. Use environment variables, encrypted files, or secure vaults. Also, restrict script file permissions so only trusted users can read them.

intermediate

Why should you validate all user inputs in scripts?

Validating inputs prevents injection attacks and unexpected behavior. It ensures the script only processes safe and expected data, reducing security risks.

advanced

What is the risk of using 'eval' in bash scripts, and how can you avoid it?

'eval' executes strings as commands, which can be dangerous if the string contains malicious code. Avoid using 'eval' or sanitize inputs carefully before using it.

What does 'chmod 700 script.sh' do to the script file?

A Allows everyone to read and execute the script

B Allows only the owner to read, write, and execute the script

C Makes the script read-only for everyone

D Removes all permissions from the script

'chmod 700' sets permissions so only the file owner can read, write, and execute the script. This protects the script from unauthorized access.

Which of these is a good practice to avoid exposing passwords in scripts?

A Store passwords in environment variables

B Hardcode passwords directly in the script

C Print passwords to the console

D Share passwords in comments

Storing passwords in environment variables keeps them out of the script code and reduces the risk of accidental exposure.

What is the main reason to validate user input in scripts?

A To increase script size

B To make the script run faster

C To prevent injection attacks and errors

D To allow any input without restrictions

Validating input helps prevent malicious data from causing harm or unexpected behavior in the script.

What does the 'set -u' option do in a bash script?

A Disables error checking

B Ignores unset variables

C Prints all commands before executing

D Treats unset variables as an error and exits

'set -u' helps catch errors by stopping the script if it tries to use a variable that has not been set.

Why is it risky to use 'eval' with user input in bash scripts?

A It can execute malicious commands

B It makes the script shorter

C It slows down the script

D It prevents errors

'eval' runs the input as code, so if the input is malicious, it can harm the system or leak data.

Explain three best practices to keep bash scripts secure.

Think about permissions, input safety, and secrets.

Describe why 'set -e' and 'set -u' are useful in secure bash scripting.

Consider how these options help prevent unexpected script behavior.