Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to download a script from: http://dl.dropbox.com/u/11210438/flockonus-stack.sh and execute it. My guess is, to use wget renaming it, chmod it, and execute.

What are the commands for doing that on Ubuntu?

share|improve this question

4 Answers 4

up vote 17 down vote accepted

Careful

Before running the script, do you trust the person who wrote it?

For example, did you expect the script to contain this?

echo "brain1" > /etc/hostname

That will try to change your hostname.


For future reference, if, after verifying the script is correct and not malicious, you can run it in one line like this:

wget -O - http://dl.dropbox.com/u/11210438/flockonus-stack.sh | bash

But download it separately and read it before running it the first time.

NOTICE: interactive prompts inside the downloaded script will not work properly using this method

share|improve this answer
6  
+1 for pointing out the (significant) security concerns with this. Be absolutely certain you trust the source. That echo "brain1" > /etc/hostname could just as easily be rm -rf /. –  Christopher Cashell Jan 24 '11 at 22:18
1  
+1 Thanks guys, that script is from me, it is safe.. Loved the one-liner, but, it has some interactive lines that didn't run.. dunno why? –  Fabiano PS Jan 24 '11 at 22:25
    
Your apt-get install lines? If apt-get would install any extra dependencies, it will ask you, and if it can't it will just exit to be safe. Either add all the dependent packages to the command line arguments, or consider adding -y, e.g. apt-get -y install... –  Mikel Jan 24 '11 at 22:30
    
the issue is not related to dependencies, it has to do with apt flushing stdin. –  Zoredache Jan 24 '11 at 23:31
    
You actually can't trust the source even if you do "trust the source" because of man in the middle attacks. That said, random private urls with bash scripts should be a narrow enough attack vector that nobody with the capability to pull it off cares enough to do it. –  SpamapS Jan 26 '11 at 9:51

That script is from me, it is safe.. Loved the one-liner, but, it has some interactive lines that didn't run.. dunno why?

When dpkg runs, called by apt-get, it flushes stdin. If you are using a command like curl blah | bash, then you are basically sending contents of the page to bash via STDIN. If one of your commands is apt-get, then runs, everything else will be flushed.

The trick is to use a command like this apt-get install --yes denyhosts </dev/null. This gives apt-get a different input, and it simply flushes /dev/null instead of the rest of your script.

If you want to see a complete example of installing something via a remote script you may want to look at this script for setting up denyhosts

For the record, I prefer curl over wget for this, but wget should also be fine.

share|improve this answer
    
+1 Thanks, adding -y did the job. I'm just recently starting to learn linux. –  Fabiano PS Jan 25 '11 at 16:33
    
I Tried with a dummy script with some interactive, it worked dude.. I don't get it xD dl.dropbox.com/u/11210438/lala.sh –  Fabiano PS Jan 25 '11 at 16:37
#!/bin/sh
if [ ! -f "/tmp/flockonus-stack.sh" ]
then
    wget -O /tmp/flockonus-stack.sh http://dl.dropbox.com/u/11210438/flockonus-stack.sh
fi

sh /tmp/flockonus-stack.sh
share|improve this answer

Try simply downloading it as you have specified with wget and then executing it directly. You can get fancy and use variables for the script you want to download etc, but this will do the trick

For example:

!#/bin/bash

#Change to temp directory
cd /tmp

#Download file using wget
wget http://dl.dropbox.com/u/11210438/flockonus-stack.sh

#Execute the file

sh flockonus-stack.sh
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.