| Security / Implementing a Secure Server with GDC | |
This section provides an example of the login script that is executed when users log in.
#! /bin/sh
# Invoked directly by login mechanism such as telnetd, or sshd.
# This file is specified in the /etc/passwd file as being the shell. This
# gives us the control we need for users that should never be allowed a
# shell prompt.
#
# For backward compatibility we check to see if we are coming from a
# non-sshd source. If so then we invoke the shell as usual and have
# it source all the login scripts
#
# Arguments passed are <COMMAND> <PORT> <FEID> <FEID2>
#
# <COMMAND> string must match the case statements.
#
# set your env vars here
export FGLDIR=/fjs/f4gl/genero-training
export FGLRUN=fglrun
export FGLGUI=1
# The command line arguments passed from the GDC will be here. If there
# aren't any then we abort.
if [[ "$SSH_TTY" == "" && "$SSH_CONNECTION" == "" ]]
then
# coming in from telnet
echo -n "$ " # fake shell prompt for GDC
read APPLICATION FGLSERVER _FGLFEID _FGLFEID2
if [[ "$APPLICATION" == "" ]]
then
echo "exiting due to bad arguments"
sleep 5 # give time to view error because window will close
exit 0
fi
export FGLSERVER
export _FGLFEID
export _FGLFEID2
else
# coming in from ssh and sshd
if [[ "$1" == "" || "$1" != "-c" ]]
then
echo "exiting due to bad arguments"
sleep 5 # give time to view error because window will close
exit 0
fi
shift
args=(`echo $1`)
export APPLICATION="${args[0]}"
export FGLSERVER="127.0.0.1:${args[1]}"
export _FGLFEID="${args[2]}"
export _FGLFEID2="${args[3]}"
fi
#echo "APPLICATION=$APPLICATION"
#echo "FGLSERVER=$FGLSERVER"
# Add case statements according to 1st value passed from the GDC command line.
# Never execute the value passed directly as this would be a security hole
# allowing the client to dictate what gets run.
#
case "$APPLICATION" in
YOURAPP) cd $FGLDIR/demo
/bin/bash --login -c "$FGLRUN demo"
;;
DEMO) cd $FGLDIR/demo
$FGLDIR/bin/$FGLRUN demo
;;
# SHELL) /bin/bash # don't leave this in for production
# ;;
AUTOPORT) /home/portfind/autoportfind -e
exit 0
;;
PASSWD) /usr/bin/passwd
exit 0
;;
*) echo "Unknown application '$APPLICATION'"
sleep 5 # allow time to read message
;;
esac