4 ms·

A web server in a shell script

49 points by chaosmachine 16y ago

zbanks 16y ago
Bash is awesome. This is one of my favorite bash scripts, it's an IRC bot in about 12 lines: http://inamidst.com/code/shellbot http://inamidst.com/code/shellbot It's also pretty easy to add other commands & extend.
- roder 16y ago
  Unix is awesome. I recently had lunch with a friend and I asked him about if he was planning new features their key/value store and I loved his answer: (paraphrased) I'm a unix-guy. I want small bits of software that does one thing and does it really well. His point was that software these days is rarely "finished". However in Unix so much of the software are small pieces. Each piece does one job and does it well. Then you can fit those pieces together in all sorts of configurations to do new and interesting things.
  - iuguy 16y ago
    The unixlike nature of certain tools is what makes the Unix architecture more or less unique. Look at binutils and you'll find heaps of tools with amazing abilities like dd, cat and echo. For me, vim wins over emacs precisely because ultimately it's an editor. Emacs for me is a whole operating environment like Gnome (although I use both and appreciate that vim can be heavily extended).
- js2 16y ago
  Odd, I don't see any bash'isms in that; I think that script would run in Bourne shell. And in fact, it could be shorter and more efficient in bash. For example, it could probably use /dev/tcp instead of telnet. And it could pattern match with [[ $var == ]] or case instead of grep. And no need to use tail if you do appropriate redirections. I think. :)
- nwmcsween 16y ago
  Sorry bash is horrid. The extensions on on posix sh are completely brain dead except for associative arrays and a few other things. Most of the extensions in bash were already built into posix sh just with a different syntax. But then again posix sh is bad as well.
cosgroveb 16y ago
The author points this out but it probably bears repeating: this implementation is insecure as it exposes your entire filesystem to anyone who can connect to your port 80. Use with caution :)
- adamdecaf 16y ago
  The joy of VM's.
  - adambyrtek 16y ago
    Yeah, you should totally deploy a separate virtual machine just to serve files from a toy Bash web server (irony).
    - scotth 16y ago
      He's right. The joy of VMs is that they let you play while throwing caution to the wind. Tone down the snarkiness.
      - adambyrtek 16y ago
        Virtual machines are great for isolation and defense in depth, not as the only security measure. It's like believing that a firewall will magically solve all your network security problems. For experiments relying on that is fine, but not for anything more serious.
- notaddicted 16y ago
  Use with caution ... and chroot.
robertduncan 16y ago
I prefer: cd $WEB_DIR; python -m SimpleHTTPServer
- JonnieCache 16y ago
  twistd -n web --path . for evented goodness.
cstross 16y ago
cat "$filename" ... Oh dear. Ohdearohdearohdear. Now all we need to do is make sure that the first character in $filename is "&" followed by some privilege escalation exploit and ... (Am I missing something?)
- rix0r 16y ago
  Well the variable expansion is quoted, so afaik it could only be interpreted as a single argument to cat.
  - Erwin 16y ago
    The double quote quoting, while allowing you to do e.g. rm "file with spaces" still expands $ and `. Compare: echo none:`date` echo double: "`date`" echo single: '`date`'
    - js2 16y ago
      But it doesn't expand recursively, so "$var" is safe to protect against special characters in var. That said, one should really read one's shell's documentation, because there be dragons.
- msbarnett 16y ago
  Nothing about this is intended to be the least bit secure. It's a fun hack, nothing more.
- sjs 16y ago
  Not saying there isn't an exploit here, but that's not it. % foo="& do_evil" % cat "$foo" cat: & do_evil: No such file or directory Now if the request was for the path /../../../../../../etc/passwd ... that's a different story. edit: and with the CGI stuff it might be possible to execute rm or something else dangerous/destructive.
drv 16y ago
This is a neat hack, but the title is a little misleading - most of the real work is handled by inetd, not the shell script.
- silentbicycle 16y ago
  Should every server re-implement inetd, though? Why not let that handle connections, daemontools/runit handle process supervision & logging, and focus on what you're actually trying to do? You don't need OOP for reusability. In the few cases where scalability matters, you can re-implement the relevant behavior, but that's a performance trade-off.
LiveTheDream 16y ago
> you don't want the hassle of installing the full Apache package sudo apt-get install apache2 sudo vim /usr/lib/cgi-bin/hello_world sudo chmod a+x $_ Not that much of a hassle.
- adambyrtek 16y ago
  Not to mention there are numerous minimalistic yet secure web servers available. http://en.wikipedia.org/wiki/Comparison_of_lightweight_web_servers http://en.wikipedia.org/wiki/Comparison_of_lightweight_web_s...
- mariana 16y ago
  Install Apache on a VPS with 64MB or 128MB of RAM is a hassle.
  - haldean 16y ago
    Okay, replace the first line with: sudo apt-get install lighttpd
  - nwmcsween 16y ago
    Don't blame Apache. Use the event mpm and don't use so many modules.
tlrobinson 16y ago
See also: http://github.com/tlrobinson/wwwoosh http://github.com/tlrobinson/wwwoosh It includes a netcat-based webserver written in bash (that speaks CGI) as well as a Sinatra-like micro "framework" for shell (that also speaks CGI) that lets you do things like this: get "/DeanMartin.jpg" dean_handler function dean_handler () { header "Content-Type" "image/jpeg" cat "DeanMartin.jpg" } Unfortunately I haven't figure out a way to get rid of that placeholder function name (e.x. "dean_handler" above). Ideas?

49 points by chaosmachine 16y ago

Bash is awesome. This is one of my favorite bash scripts, it's an IRC bot in about 12 lines: http://inamidst.com/code/shellbot http://inamidst.com/code/shellbot It's also pretty easy to add other commands & extend.

roder 16y ago
Unix is awesome. I recently had lunch with a friend and I asked him about if he was planning new features their key/value store and I loved his answer: (paraphrased) I'm a unix-guy. I want small bits of software that does one thing and does it really well. His point was that software these days is rarely "finished". However in Unix so much of the software are small pieces. Each piece does one job and does it well. Then you can fit those pieces together in all sorts of configurations to do new and interesting things.
- iuguy 16y ago
  The unixlike nature of certain tools is what makes the Unix architecture more or less unique. Look at binutils and you'll find heaps of tools with amazing abilities like dd, cat and echo. For me, vim wins over emacs precisely because ultimately it's an editor. Emacs for me is a whole operating environment like Gnome (although I use both and appreciate that vim can be heavily extended).
js2 16y ago
Odd, I don't see any bash'isms in that; I think that script would run in Bourne shell. And in fact, it could be shorter and more efficient in bash. For example, it could probably use /dev/tcp instead of telnet. And it could pattern match with [[ $var == ]] or case instead of grep. And no need to use tail if you do appropriate redirections. I think. :)
nwmcsween 16y ago
Sorry bash is horrid. The extensions on on posix sh are completely brain dead except for associative arrays and a few other things. Most of the extensions in bash were already built into posix sh just with a different syntax. But then again posix sh is bad as well.

cosgroveb 16y ago

The author points this out but it probably bears repeating: this implementation is insecure as it exposes your entire filesystem to anyone who can connect to your port 80. Use with caution :)

adamdecaf 16y ago
The joy of VM's.
- adambyrtek 16y ago
  Yeah, you should totally deploy a separate virtual machine just to serve files from a toy Bash web server (irony).
  - scotth 16y ago
    He's right. The joy of VMs is that they let you play while throwing caution to the wind. Tone down the snarkiness.
    - adambyrtek 16y ago
      Virtual machines are great for isolation and defense in depth, not as the only security measure. It's like believing that a firewall will magically solve all your network security problems. For experiments relying on that is fine, but not for anything more serious.
notaddicted 16y ago
Use with caution ... and chroot.

robertduncan 16y ago

I prefer: cd $WEB_DIR; python -m SimpleHTTPServer

JonnieCache 16y ago
twistd -n web --path . for evented goodness.

cstross 16y ago

cat "$filename" ... Oh dear. Ohdearohdearohdear. Now all we need to do is make sure that the first character in $filename is "&" followed by some privilege escalation exploit and ... (Am I missing something?)

rix0r 16y ago
Well the variable expansion is quoted, so afaik it could only be interpreted as a single argument to cat.
- Erwin 16y ago
  The double quote quoting, while allowing you to do e.g. rm "file with spaces" still expands $ and `. Compare: echo none:`date` echo double: "`date`" echo single: '`date`'
  - js2 16y ago
    But it doesn't expand recursively, so "$var" is safe to protect against special characters in var. That said, one should really read one's shell's documentation, because there be dragons.
msbarnett 16y ago
Nothing about this is intended to be the least bit secure. It's a fun hack, nothing more.
sjs 16y ago
Not saying there isn't an exploit here, but that's not it. % foo="& do_evil" % cat "$foo" cat: & do_evil: No such file or directory Now if the request was for the path /../../../../../../etc/passwd ... that's a different story. edit: and with the CGI stuff it might be possible to execute rm or something else dangerous/destructive.

drv 16y ago

This is a neat hack, but the title is a little misleading - most of the real work is handled by inetd, not the shell script.

silentbicycle 16y ago
Should every server re-implement inetd, though? Why not let that handle connections, daemontools/runit handle process supervision & logging, and focus on what you're actually trying to do? You don't need OOP for reusability. In the few cases where scalability matters, you can re-implement the relevant behavior, but that's a performance trade-off.

LiveTheDream 16y ago

> you don't want the hassle of installing the full Apache package sudo apt-get install apache2 sudo vim /usr/lib/cgi-bin/hello_world sudo chmod a+x $_ Not that much of a hassle.

adambyrtek 16y ago
Not to mention there are numerous minimalistic yet secure web servers available. http://en.wikipedia.org/wiki/Comparison_of_lightweight_web_servers http://en.wikipedia.org/wiki/Comparison_of_lightweight_web_s...
mariana 16y ago
Install Apache on a VPS with 64MB or 128MB of RAM is a hassle.
- haldean 16y ago
  Okay, replace the first line with: sudo apt-get install lighttpd
- nwmcsween 16y ago
  Don't blame Apache. Use the event mpm and don't use so many modules.

tlrobinson 16y ago

See also: http://github.com/tlrobinson/wwwoosh http://github.com/tlrobinson/wwwoosh It includes a netcat-based webserver written in bash (that speaks CGI) as well as a Sinatra-like micro "framework" for shell (that also speaks CGI) that lets you do things like this: get "/DeanMartin.jpg" dean_handler function dean_handler () { header "Content-Type" "image/jpeg" cat "DeanMartin.jpg" } Unfortunately I haven't figure out a way to get rid of that placeholder function name (e.x. "dean_handler" above). Ideas?