Re: shell program menu

[Craig Sanders <cas@taz.net.au>]

On Fri, 23 Jan 1998, Remco Blaakmeer wrote:

> > I would like to implement a shell program (preferebly in C
> > programming.) where our users if they telnet to us, they would
> > be given a menu instead of a shell. They just press "1" they get
> > pine. They press "2" they get the vi editor, and so on and so forth.
> >
> > Is there a package for debian or anyone could point me to the right
> > direction where I could get the script or whatever.

there is a debian package called 'perlmenu' which will probably do what you
want.  perl, not c....but perl is better for this sort of thing anyway.

there's also a debian package for a bbs package called 'adbbs'.  it may be
useful to you.  (a bbs on unix is essentially just a menu system)


> Are you aware of the fact that any vi clone can give you a shell? Just
> type
> 
> :!sh
> 
> in command mode and you'll get the prompt of whatever is called 'sh' on
> the system.
>
> This is not only a problem with vi, but with many other programs as well.

if users can't be trusted with a shell, they can't be trusted with vi.
give 'em pico.


btw rbash is useful in situations like this. restricted shell, only
programs in the PATH can be executed, and user can not change PATH or
other variables. many other restrictions too.

test for rbash in /etc/profile:

	if [ "$SHELL" == "/bin/rbash" ] ; then 
		export PATH=whatever
		do anything else that is needed.
		. . .
		run the menu system.
	fi

even if they do manage to fork a shell somehow, they'll just get their
default shell which will source /etc/profile and end up with them
in another instance of the menu. there are probably ways for clever
users to get around this, but they all require the ability to execute
arbitrary commands...which is as good as having a shell anyway.

craig

--
craig sanders


--
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
debian-user-request@lists.debian.org . 
Trouble?  e-mail to templin@bucknell.edu .