More Fun With Security Through Obfuscation On Linux And Unix

Hey There,

A few months ago, we ran a post on security through obfuscation, regarding ways to make your code less comprehensible to folks who didn't understand it as well as you do. While, at the core, this does nothing to actually "secure" your code from anyone with the patience to unravel it, it can be useful for keeping folks who know "just enough to do a lot of damage" from messing with your scripts ;) And, on another level, it can be a useful stalling technique, since you'll be making anyone work to figure out how your script/code works before they can change it without risking destroying it.

While I'm sure there are many more points to cover (and, hopefully, we'll cover them all eventually ;), today's addition to the arsenal is pretty obvious: Messing with your variable names :)

Most decent and responsible scripters will try to have their variable names make sense (if for no one's benefit than for their own - writing a confusing script isn't going to be worth it if even you can't figure it out later ;). So, when they use a variable to use as a counter, they might name it $counter, or something like that. @array_of_files is another such descriptive name. Very helpful later on when you need to modify your own stuff, and good practice so that, if you ever leave a place of employment, you won't be screwing your friends and co-workers who will, inevitably, get stuck maintaining your code.

However, assuming you do something as simple as keeping a separate file with a simple legend, like:

VAR ORIG
a file
b count
...

and so forth, naming your variables as arcanely as possible is a great way to make long, convoluted, stream-of-consciousness scripts as close to incomprehensible as possible ;) Having this sort of legend available can make it easy for you to do variable replacement within the "confusing" version of the script to make it easily understandable once again.

For instance, this Perl script to reverse all lines in a file on Linux or Unix can be rewritten to be even more confusing that it may already be.

Following is a working, but awful looking, revision of the original code, modified to include meaningless variables (scalar, array and filehandle), no indentation, no spaces between lines and no comments (except at the top). I've opted not to include a legend, since we have the original code hosted on this blog (linked to above) and you won't need to go through the hassle of reversing it.

In a future post, we'll look at creating such a legend for any script and backward-applying changes to your code (even though it would be much easier to do with "patch" ;)

Enjoy :)





This work is licensed under a
Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License

#!/usr/bin/perl

# 2008 - Mike Golvach - eggi@comcast.net
#
# Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License
#

if ( $#ARGV != 0 )      {
exit(1);
}
$a=$ARGV[0];
open(A, "<$a");
@a = <A>;
close(A);
foreach $b (@a)      {
chomp($b);
@b = split(//, $b);
$c = @b;
undef(@c);
while ( $c > 0 )   {
push(@c, $b[$c-1]);
$c--;
}
$e = join(/ /, @c);
unshift(@f, "$e");
}
open(B, ">$a.reverse");
foreach $d (@f)    {
print B "$d\n";
}
close(B);
exit(0);

, Mike

Begin and Finish Script Unix Shell Variables For JumpStart

Today, we're going to finish up what we started in yesterday's and the previous day's posts detailing the customization of Solaris JumpStart using simple Unix shell scripting techniques.

Please, only go back there and read those if the specific topics are of interest to you. If you're just looking for a good collection of available scripting variables for Begin and Finish scripts, you'll thank me for saving you the time ;)

Both Begin and Finish scripts export a certain number of variables automatically. Following is a list of the ones I've discovered during the process of working with the program. The following sections are divided into CRASH (The environment you're left with if you crash to a restricted root shell at any point during the installation), BEGIN (The environment exported during the execution of your begin script) and FINISH (The environment exported during the execution of your finish script). I've denoted the more useful variables (insofar as scripting is concerned) by indenting them slightly more.

Note that all of these variables were found by terminating the execution of JumpStart at the given point and dumping the output of the commands "set" and "env" - I filtered out the variables that were off-topic. Please note, also, that these variables exclude the JASS and SST environment variables, as my aim here is to provide a listing of all available variables that can be used in Begin and Finish scripts no matter what your situation. You can use these whether or not you decide to avail yourself of the additional Solaris JumpStart custom packages Sun has put together over the years (Basically, to make it so you don't have to do any security hardening on your own. I'm not saying this is a bad thing; only that you may know what you want to control and not require that "convenience").

NOTE: Surprisingly enough, there is no SI_INSTALL_DIR or SI_INST_DIR variable provided to indicate your installation directory (e.g., /export/install).

Hopefully, having this list of Solaris Unix variables will prove useful to you at some point during your JumpStart scripting endeavors!

Good Luck and Best Wishes,

CRASH:

    HOME=/tmp/root 
PATH=/sbin:/usr/sbin/install.d:/usr/sbin:/usr/bin 
PLATFORM=sparc
SHELL=/sbin/sh
TEXTDOMAIN=SUNW_INSTALL_SCRIPTS
TZ=PST8PDT
_DVFS_RECONFIG=YES

BEGIN:

CHECK_INPUT=/tmp/install_config/rules.ok
    HOME=/tmp/root
LANG=en
LC_COLLATE=en_US
LC_CTYPE=en_US
LC_MESSAGES=C
LC_MONETARY=en_US
LC_NUMERIC=en_US
LC_TIME=en_US 
    PATH=/sbin:/usr/sbin/install.d:/usr/sbin:/usr/bin
PLATFORM=sparc
    SHELL=/sbin/sh
    SI_BEGIN=jclient_begin
    SI_CLASS=jclient_class 
    SI_CONFIG_DIR=/tmp/install_config (This is the default, but you should have set it to /export/install with the add_install_client command) 
SI_CONFIG_FILE=/tmp/install_config/rules.ok 
SI_CONFIG_PROG=rules.ok
    SI_FINISH=jclient_finish
    SI_HOSTNAME=jclient 
SI_INSTALL_APP=jumpstart 
    SI_PROFILE=/tmp/install_config/jclient_class 
    SI_SYS_STATE=/a/etc/.sysIDtool.state TERM=vt100
TEXTDOMAIN=SUNW_INSTALL_SCRIPTS
TZ=US/Central
_DVFS_RECONFIG=YES

FINISH:

CHECK_INPUT=/tmp/install_config/rules.ok
    HOME=/tmp/root
LANG= 
LC_COLLATE=en_US
LC_CTYPE=en_US
LC_MESSAGES=C
LC_MONETARY=en_US
LC_NUMERIC=en_US
LC_TIME=en_US 
    PATH=/sbin:/usr/sbin/install.d:/usr/sbin:/usr/bin
PLATFORM=sparc
    SHELL=/sbin/sh
    SI_BEGIN=jclient_begin
    SI_CLASS=jclient_class 
    SI_CONFIG_DIR=/tmp/install_config 
SI_CONFIG_FILE=/tmp/install_config/rules.ok 
SI_CONFIG_PROG=rules.ok
    SI_FINISH=jclient_finish
    SI_HOSTNAME=jclient 
SI_INSTALL_APP=jumpstart 
    SI_PROFILE=/tmp/install_config/jclient_class 
    SI_SYS_STATE=/a/etc/.sysIDtool.state
TERM=vt100
TEXTDOMAIN=SUNW_INSTALL_SCRIPTS
TZ=US/Central
_DVFS_RECONFIG=YES

, Mike

linux unix internet technology