1

Here's my dilemma, in a shell script I use to install or configure OpenVPN and/or just the client config files, I've expanded the script to include the installation of Google Authenticator.

The script creates the pam.d file for this add on using echo...

echo "auth requisite /lib/security/pam_google_authenticator.so secret=/etc/google-auth/${USER} user=openvpn account required  pam_permit.so">> /etc/pam.d/openvpn

After all is installed, and the file is created, the pam.d file above of course is created with the user instead of the expression as shown below

echo "auth requisite /lib/security/pam_google_authenticator.so secret=/etc/google-auth/root user=openvpn account required pam_permit.so">> /etc/pam.d/openvpn

Is there a way to preserve the expression as ${USER} within the file?

It would solve this post installation edit of changing secret=/etc/google-auth/root back to secret=/etc/google-auth/${USER}

1

As Kamil's comment notes, if you want to include the literal text ${USER}, you could use apostrophes instead of quotation marks.

echo "auth requisite /lib/security/pam_google_authenticator.so secret=/etc/google-auth/${USER} user=openvpn account required  pam_permit.so">> /etc/pam.d/openvpn

will cause the shell to expand ${USER}, which could be set to root. (If that's not desired, you might want to try preserving that variable with sudo's env_reset ability, or just set the desired value to a custom variable that sudo won't tend to overwrite.)

Actually, you get the same effect without the quotation marks.

echo auth requisite /lib/security/pam_google_authenticator.so secret=/etc/google-auth/${USER} user=openvpn account required  pam_permit.so>> /etc/pam.d/openvpn

Another option, though, is to use apostrophes instead of where you had quotation marks, as follows:

echo 'auth requisite /lib/security/pam_google_authenticator.so secret=/etc/google-auth/${USER} user=openvpn account required  pam_permit.so'>> /etc/pam.d/openvpn

Another option is to just escape the dollar sign.

echo auth requisite /lib/security/pam_google_authenticator.so secret=/etc/google-auth/\${USER} user=openvpn account required pam_permit.so>> /etc/pam.d/openvpn

That backslash before the dollar sign tells the shell to just treat the dollar sign as a regular character, not as the start of a variable name.

  • Thanks TOOGAM!! that worked....I ended up using the substitute of apostrophes vs. quotation marks.... – kcurry0210 Jun 3 '18 at 5:04
  • "you get the same effect without the quotation marks" – With echo it may work in many cases but it's a very bad practice in general. What if there's | in a string one wants to echo? or a forkbomb? or ;rm -rf ~/*;? You can't expect users who need help with their quotes to spot such a flaw. Even if they don't do any permanent damage, they will be confused by sudden command not found or another behavior they don't expect. I'd like to upvote the answer but I won't unless it's improved. – Kamil Maciorowski Jun 3 '18 at 7:59
  • I currently plan to leave my answer as is, because it directly addresses the question being asked (where the echo'ed text looks rather specific). However, I acknowledge the security concerns that @KamilMaciorowski made, and especially appreciate the sentence after Kamil's question mark. When dealing with unknown or otherwise-untrustable input, such security concerns are well worth the effort, but for this particular case, I don't deem such possible concern as worth making the answer substantially longer. Then again, I don't tend to blindly paste commands or reference unknown variables. – TOOGAM Jun 3 '18 at 18:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.