Security / Implementing a Secure Server with GDC |
This section provides an example of the login script that is executed when users log in.
#! /bin/sh # Invoked directly by login mechanism such as telnetd, or sshd. # This file is specified in the /etc/passwd file as being the shell. This # gives us the control we need for users that should never be allowed a # shell prompt. # # For backward compatibility we check to see if we are coming from a # non-sshd source. If so then we invoke the shell as usual and have # it source all the login scripts # # Arguments passed are <COMMAND> <PORT> <FEID> <FEID2> # # <COMMAND> string must match the case statements. # # set your env vars here export FGLDIR=/fjs/f4gl/genero-training export FGLRUN=fglrun export FGLGUI=1 # The command line arguments passed from the GDC will be here. If there # aren't any then we abort. if [[ "$SSH_TTY" == "" && "$SSH_CONNECTION" == "" ]] then # coming in from telnet echo -n "$ " # fake shell prompt for GDC read APPLICATION FGLSERVER _FGLFEID _FGLFEID2 if [[ "$APPLICATION" == "" ]] then echo "exiting due to bad arguments" sleep 5 # give time to view error because window will close exit 0 fi export FGLSERVER export _FGLFEID export _FGLFEID2 else # coming in from ssh and sshd if [[ "$1" == "" || "$1" != "-c" ]] then echo "exiting due to bad arguments" sleep 5 # give time to view error because window will close exit 0 fi shift args=(`echo $1`) export APPLICATION="${args[0]}" export FGLSERVER="127.0.0.1:${args[1]}" export _FGLFEID="${args[2]}" export _FGLFEID2="${args[3]}" fi #echo "APPLICATION=$APPLICATION" #echo "FGLSERVER=$FGLSERVER" # Add case statements according to 1st value passed from the GDC command line. # Never execute the value passed directly as this would be a security hole # allowing the client to dictate what gets run. # case "$APPLICATION" in YOURAPP) cd $FGLDIR/demo /bin/bash --login -c "$FGLRUN demo" ;; DEMO) cd $FGLDIR/demo $FGLDIR/bin/$FGLRUN demo ;; # SHELL) /bin/bash # don't leave this in for production # ;; AUTOPORT) /home/portfind/autoportfind -e exit 0 ;; PASSWD) /usr/bin/passwd exit 0 ;; *) echo "Unknown application '$APPLICATION'" sleep 5 # allow time to read message ;; esac