安全与隐私idontplaydarts.com
在服务端检测“curl | bash”的使用
Detecting the use of "curl | bash" server-side
2016 — 2020，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
这篇文章讨论如何从服务器端判断 `curl ... | bash` 是否正在被使用：通过分块传输、回调请求和时序，检测客户端是否边下载脚本边立即执行，而不是先保存或人工审阅。文中也涉及这种检测的绕过方式与 `curl | bash` 的安全争议。
为什么经久不衰：它把常见安装方式背后的可观测行为讲清楚，并引出检测与规避的攻防思路，对理解供应链安全和脚本安装风险仍有价值。
HN 评论精选
用分块传输加回调 ping 判断脚本是否边下载边执行，比依赖 sleep 更直接。
用 sleep 的巧妙设计有点过度了——你真正想知道的是，返回的脚本是否在被发送的同时就被执行。如果是，就能相当确信不是有人在逐行阅读。1. 用 `transfer-encoding: chunked` 和 `tcp_nodelay` 发送响应；2. 把第一条命令写成 `curl www.example.com/$unique_id`，然后服务器在发送下一条命令前等待——如果收到脚本发来的 ping，就知道执行脚本的东西是在命令一到达就运行，因此不太可能有人在执行下一条命令前先读过。若一秒左右没 ping，就继续发送无害载荷。为了多一层可推诿的恶意，把恶意载荷嵌入一段看似合法的命令序列中，然后在中间挂起 socket，日后调查会像是网络问题。
charleslmunger查看英文原文
The sleep cleverness is excessive though - what you really want to know is if the script you're returning is being executed as it's sent. If it is, then you can be pretty confident that a human isn't reading it line by line. 1. Send your response as transfer-encoding: chunked and tcp_nodelay 2. Send the first command as curl www.example.com/$unique_id Then the server waits before sending the next command - if it gets the ping from the script, we know that whatever is executing the script is running the commands as they're sent, and is therefore unlikely to be read by a human before the next command runs. If it doesn't ping within a second or so, proceed with the innocent payload. For extra evil deniability, structure your malicious payload as a substring of a plausibly valid sequence of commands - then simply hang the socket partway through. Future investigation will make it look like a network issue.
用 sponge 缓冲完整脚本可绕过“边下载边执行”的检测。
在规避检测方面，另一个简单办法是在 `curl` 和 `bash` 之间加 `sponge`，即 `curl ... | sponge | bash`。`sponge` 会先吞掉全部输入直到 EOF 再输出，阻止 bash 执行只下载了一半的脚本。
michaelmior查看英文原文
On the evading detection side, one other simple way to avoid this is to add sponge[0] between curl and bash in the pipeline, i.e. curl ... | sponge | bash. sponge consumes all input until EOF before outputting anything, stopping bash from executing a partially downloaded script. [0] https://linux.die.net/man/1/sponge
在已有 TLS 的前提下，curl|bash 的风险未必高于下载安装包。
不错！但这不显然是坏主意。你与下载站点有 TLS 连接；`curl | bash` 并不比从同一服务器下载 `.dmg` 或 `.deb` 更糟。
cjbprime查看英文原文
Neat! But it's not obviously a bad idea. You have a TLS connection with the site you're downloading from. `curl | bash` is no worse than downloading a .dmg or .deb from the same server would be.
跨平台安装的复杂性使 curl|bash 难以简单禁止，信任问题最终转移到软件源本身。
麻烦在于，直接管道给 bash 虽有被利用风险，仍是最简单的安装方式之一。以 RVM 为例，官方指令就是 `curl -sSL https://get.rvm.io | bash -s stable`，脚本 887 行，安装跨多操作系统、数百发行版，各包管理器差异大。问题变成：如何既方便安装又安全可维护？确保下载内容与维护者一致可用 SSL；而如果你不信任安装器，也就不该信任产品。
Velox查看英文原文
The unfortunate problem with this is that while piping directly into bash can be exploited, it remains as one of the easiest ways to install programs. Taking RVM for example. Their instructions are to run this: `curl -sSL https://get.rvm.io | bash -s stable`. The script that is executed is 887 lines long. The installation is "complex", requiring a lot of different stages. Now, the solution to this is "Use a package manager". Sure, that works in a lot of cases. However, when you have something like RVM which is used across several major operating systems, and hundreds of different flavours, each with their own quirks and package managers it suddenly gets difficult to manage each of these. The problem we face is, how can we make it easy to install something, while still being safe and maintainable? Breaking this down further, there are 2 issues to solve. The first is "How do we ensure what we download is what the maintainer says that we should download?". I.e. How do we make sure there are no malicious injections. That one is simple. Use SSL. The second issue is, "I want to install this thing but I don't know if I can trust the installer". Are you crazy!? This isn't an issue. If you don't trust the installer, you sure as hell can't trust the product. If you don't trust either of them, then you automatically don't trust the other and shouldn't be installing it. The result is that, yes, people can maliciously serve up code when you pipe the output of curl through bash without you realising. However, this is no different than blindly trusting and installing a script.
历次讨论
同类还值得读
非法素数
Illegal prime
维基百科条目，介绍“非法素数”：某些素数之所以被称为“非法”，是因为它们经特定编码后，恰好对应一段被法律禁止传播的数据——最著名的是 DVD 解密程序 DeCSS 的代码，有人把…
安全与隐私上首页 5 次 · 2010–2021en.wikipedia.org编辑精选关于 /dev/urandom 的常见误区
Myths about /dev/urandom
（Thomas Hühn 撰写，2014 年首发并持续更新）逐条反驳关于 /dev/urandom 的常见误解：它与 /dev/random 使用的是同一个 CSPRNG，一旦完…
安全与隐私上首页 5 次 · 2014–20202uo.de编辑精选AES 高级加密标准火柴人图解
A Stick Figure Guide to the Advanced Encryption Standard (AES)
一篇用火柴人漫画形式讲解 AES（高级加密标准）算法的经典科普文章。
安全与隐私上首页 5 次 · 2009–2022moserware.com编辑精选指纹是用户名，不是密码
Fingerprints are Usernames, not Passwords
作者（eCryptfs 维护者、Ubuntu 安全工程师）认为指纹等生物特征是公开、不可更改的标识，应视作用户名而非密码，不能当作秘密凭据用于认证。
安全与隐私上首页 4 次 · 2013–2017blog.dustinkirkland.comHTTPS 连接的最初几毫秒（2009）
The First Few Milliseconds of an HTTPS Connection (2009)
逐毫秒拆解一次 HTTPS 连接建立时发生了什么，重点讲 TLS 握手、证书验证、RSA 签名与密钥协商等机制，面向不熟悉该领域的读者。
安全与隐私上首页 4 次 · 2009–2020moserware.com编辑精选