Understanding part of Linux Bash Script

Question

I´m trying to understand a Linux Bash Script. The aim of the script is to limit the access to server services only for some dyndns users (by use of ufw rules). Part of the script:

ALLOWEDUSERS="client1.dyndns.org client2.dyndns.org"

for host in $ALLOWEDUSERS ; do
    ip=`host $host | cut -d ' ' -f 4`
    if [ $? -eq 0 ]; then
       ufw allow proto tcp from $ip to any
    fi
done

okay

for host in $ALLOWEDUSERS ; do

is clear, it loops through ALLOWEDUSERS,

as far as I understand

if [ $? -eq 0 ]; then

checks if the command executed before is true (if so the ufw rule is added)

but how does the rest of the snippet

ip=`host $host | cut -d ' ' -f 4`

checks if the client ip is the one from the allowed dyndns account?

thanks a lot for your help,

tony

This script is badly written and probably broken. Why waste time with it? — gniourf_gniourf
– gniourf_gniourf, Commented Nov 11, 2013 at 21:30
The programmer apparently thought he was checking the exit status of the host command, which is 0 if the hostname lookup is successful. But it's actually checking the exit status of cut, because the status of a pipeline is the status of the last command. So it doesn't work as intended. — Barmar
– Barmar, Commented Nov 11, 2013 at 21:33
@tBook Then learn from other better written scripts. This thing is a bug nest. cut will always return true in this case, hence ufw will always run. Oh dear. — gniourf_gniourf
– gniourf_gniourf, Commented Nov 11, 2013 at 21:34

exilit · Accepted Answer · 2013-11-11 21:51:53Z

1

It doesn't realy check anything.

The output from host $host is anything like $host has address xxx.xxx.xxx.xxx.

For example:

$ host localhost
localhost has address 127.0.0.1

Afterwards cut -d ' ' -f 4 isolates the fourth part, which is the ip address. This is used as the ip address for the ufw command.

answered Nov 11, 2013 at 21:51

exilit

1,17611 silver badges23 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Barmar · Accepted Answer · 2013-11-11 22:05:38Z

0

The script is essentially equivalent to:

ALLOWEDUSERS="client1.dyndns.org client2.dyndns.org"

for host in $ALLOWEDUSERS ; do
    ip=`host $host | cut -d ' ' -f 4`
    ufw allow proto tcp from $ip to any
done

The if in the original script was checking the result of cut, not host, and it was always successful, so it served no useful purpose.

When the DynDNS hostname is valid, a rule will be added to the firewall to allow it.

When the hostname isn't found, the host command prints:

Host clientN.dyndns.org not found: 3(NXDOMAIN)

so $ip will be found:. This will try to do:

ufw allow proto tcp from found: to any

Since that's not a valid firewall rule, I expect it will be ignored and an error message issued.

If you want to do what the script was apparently trying to do, it should be:

ALLOWEDUSERS="client1.dyndns.org client2.dyndns.org"

for host in $ALLOWEDUSERS ; do
    hostresult=`host $host`
    if [ $? -eq 0 ]; then
        ip=`echo "$hostresult" | cut -d ' ' -f 4`
        ufw allow proto tcp from $ip to any
    fi
done

answered Nov 11, 2013 at 22:05

Barmar

789k57 gold badges555 silver badges669 bronze badges

1 Comment

Anatol Over a year ago

thanks for this extensive helpful answer! thumbs up.

Collectives™ on Stack Overflow

Understanding part of Linux Bash Script

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related