Safely using su on weborigin servers

The easiest way to become a user, in their own environment, for debugging purposes is to use the su - <username> command.

Unfortunately, that executes the user’s /.profile', '/.bashrc and, on logout, their /.bash_logout files. These files can be compromised, meaning we can inadvertently re-infect a site simply by becoming a user.

To avoid that problem, you can become a user on a weborigin server with the command mf-su <user> (note, you don’t need the dash).

This command runs a checksum on the target users bash dot files and compares with a list of known good checksums. If there is a new checksum we haven’t seen, you will be shown the content of the file and prompted to approve it. Once approved, we won’t be bothered with it again. After completing a check successfully, it calls su - <user>.

This script has an empty approved checksum list when it is first installed, so the first time it is used on a server, you will have to approve the default values for these files.