More 2¢ Tips!

In Linux Gazette, Issue # 42, I provided an answer to the question of getting an a.out binary to run. I suggested that typing "./a.out" (sans quotes) would do the trick. I went on to suggest that the "current directory" be added to the path to avoid the bother of typing ./ before the name of the binary to be run.

Several have written to me to point out that adding ./ to the path is not good practice from a security viewpoint. Therefore, I urge anyone who has added the ./ to their path after reading my answer, remove it. Instead, just get in the practice of typing ./myprogramname when one wants to run a binary in the current directory.

I'd like to take this opportunity to thank Alex B., Art W., and Pete in the UK for taking the time to write me notes explaining the pitfalls of putting dot slash (./) in one's PATH. This is especially true for root, but apparently not good practice for anyone. As I understand it, a transgressor could easily put a program with evil intentions, but with a common name, such as "ls," in one of your commonly used directories. Next time you type ls on the command line, the evil program is run rather than the ls directory display program. This is so if one had modified one's PATH to include ./. If one had to include ./ in one's path, make sure it is at the end of the PATH statement.

Thanks for giving me this opportunity to correct the bad information I presented. Also, thanks again to those who took the time to write to me to explain the consequences of adding ./ to the PATH statement.

Pete, NO2D

Date: Thu, 10 Jun 1999 13:19:05 +0100
From: Pat Neave

> Try running the a.out binary with the command line: ./a.out I recently
> installed RedHat 5.2 and found that its $PATH statement does not include
> a path of " ./: " ./ is the path of the current directory that you are
> in. Remarkably, RedHat does not set up paths so that your current path 
> is looked at to execute a file. 

There is a good reason for RedHat (and hopefully all the Linux distributers) not to include '.' in your PATH. Its a security risk. Now, you may be OK on a non-networked system but I don't think it is a good habit to get into. The following is quoted from the Path Mini HOWTO:

12. Security concerns

The path is sometimes a big security problem. It is a very common way to hack into a system using some mistakes in path settings. It is easy to make Trojan horse attacks if hacker gets root or other users to execute his versions of commands.

A common mistake in the past (?) was to keep '.' in the root's path. Malicious hacker makes program 'ls' in his home directory. If root makes

	     # cd ~hacker
	     # ls
	

he executes ls command of hacker's.

--
Pat

Date: Mon, 14 Jun 1999 19:31:48 +0100
From: Jeffrey Voight

If you find it absolutely necessary to include . in your path, at least put it as the last entry in your path so that the system binaries are searched before '.' is.

Date: Tue, 15 Jun 1999 10:34:52 +0100

From: Alexander Thorp, athorp@lucent.com

Peter Inskeep writes:

"Remarkably, RedHat does not set up paths so that your current path is looked at to execute a file", i.e. does not include the directory . in $PATH."

This would only be remarkable to a DOS user. The inclusion of . in $PATH exposes the user to trojan horses. It should never appear in root's $PATH, and I don't like it in mine either.

Alex Thorp

(This is a sample of many letters received on the dangers of '.'. I don't use it in the root path, but I like in my path. :) --Ed.)

More Vi .exrc stuff

	map #1 :set nu

#!/bin/sh
#
# This is part 2 of the ppp-on script. It will perform the connection
# protocol for the desired connection.
#
exec /usr/sbin/chat -v                                          \
        TIMEOUT         23                              \
        ABORT           '\nBUSY\r'                      \
        ABORT           '\nNO ANSWER\r'                 \
        ABORT           '\nRINGING\r\n\r\nRINGING\r'    \
        ''              ATZ                     \
        'OK'            ATL0M0                  \
        'OK'            ATX3 \
        'OK-+++\c-OK'   ATH0                    \
        TIMEOUT         50                              \
        OK              ATDT$TELEPHONE          \
        CONNECT         ''                              \
        rname:--rname:  $ACCOUNT                        \
        assword:        $PASSWORD

      man tcpd
      man 5 hosts_access (look for 'SERVER ENDPOINT PATTERNS')