Differences

This shows you the differences between two versions of the page.

--- howto:linuxapps [2022/02/07 06:51] – [Links2 Web Browser] Added a warning about Links2's OS Shell feature. Andre
+++ howto:linuxapps [2022/02/08 07:03] (current) – [Links2 Web Browser] Added a "security considerations" section for the Links2 script. Andre
@@ Line 18: / Line 18: @@
 </code>
-=== Add links2 to SBBS ===
+=== Links2 Security Considerations ===
-:!: Note that links2 could give access to the host OS, such as with "OS Shell" from the File menu, which gives the BBS user a shell as the OS user the BBS runs as. At the very least this will likely give someone access to your [[util:scfg|scfg]] tool.
+:!: Note that links2 can give access to the host OS, such as with "OS Shell" from the File menu, which gives the BBS user a shell as the OS user the BBS runs as. At the very least this will likely give someone access to your [[util:scfg|scfg]] tool.
+Using the script below, anyone with a sysop [[access:level|security level]] will have access to the full Links2 experience, including running an OS shell as whatever user the BBS runs as. The code uses the is_sysop check, which will return true if the user's security level is 90-99 ([[https://synchro.net/docs/jsobjs.html|Object reference]]).
+Anyone without a sysop security level will run Links2 with the "-anonymous" switch, which disables numerous features, including the ability to use "OS Shell" from the menu.
+<code>
+-anonymous
+Restrict links so that it can run on an anonymous account. No local file browsing. No downloads. Executing of viewers is allowed, but user can't add or modify entries in association table.
+</code>
+This may be sufficient to secure the BBS' host system, but the user will still be allowed to browse the web from your system, potentially doing questionable things that could be attributed to your IP address.
+=== Add links2 to SBBS ===
 Add links2 to sbbs as an external program as any other door:

Trace:

Differences

Navigation

Search

Toolbox