Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

run.sh Diaries #2: The Bash Behind the Bootstrap

TL;DR In this post, I’ll walk through the internal logic of how my WSL bootstrap works and let’s focus on run.sh, utils.sh, and packages.conf. You’ll learn how I made the setup modular, safe to re-run, and easy to extend. The Bi…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

TL;DR



In this post, I’ll walk through the internal logic of how my WSL bootstrap works and let’s focus on run.sh, utils.sh, and packages.conf. You’ll learn how I made the setup modular, safe to re-run, and easy to extend.







The Big Picture



In Part 1, I talked about why I built this and now let’s explore how it works.



At the heart of it is a simple philosophy:




Don’t repeat yourself.



Don’t install what’s already there.



Keep everything scriptable and modular.




The setup revolves around three key components:





  1. run.sh – the orchestrator


  2. utils.sh – helper functions


  3. packages.conf – what to install



Let’s break each down.






1. run.sh – The Orchestrator



This script is the entry point of the whole bootstrap.






Responsibilities:




  • Define the list of setup scripts to run

  • Execute them one by one

  • Log their progress

  • Fail fast if something breaks






Structure:






readonly SCRIPTS=(
"node-setup.sh"
"rust-setup.sh"
"docker-setup.sh"
"lazygit-setup.sh"
"python-setup.sh"
"zoxide-setup.sh"
"tmux-config-setup.sh"
"tpm-setup.sh"
"nvim-setup.sh"
)






Each script is passed into the run_script() function from utils.sh, which:




  • Checks if the file exists

  • Makes it executable

  • Runs it and logs its completion






2. utils.sh – The Bash Toolkit



This file contains reusable helpers that keep the logic clean and DRY.






Key Functions:






is_installed_apt / is_installed_snap



Check if a package is already installed before trying to install it.




  dpkg-query -W -f='${Status}' "$1" 2>/dev/null | grep -q "install ok installed"









install_apt_packages / install_snap_packages



Take a list of packages, filter out the ones already installed, and install only what’s needed.



Includes logic to:




  • Run apt-get update only if required

  • Handle Snap not being installed

  • Try both normal and -classic Snap installs






die



A simple exit-on-error function to fail cleanly and loudly.




die() {
echo "ERROR: $*" >&2
exit 1
}







In the future, I plan to add features like color-coded logging, verbosity levels, timestamps, and WSL detection. But for now, the current setup does exactly what I need: simple, readable, and effective.







3. packages.conf – Centralized Package List



This is where all core APT and Snap packages are defined and grouped by category for clarity.






Example:






SYSTEM_UTILS_APT=(
wget curl fzf build-essential fd-find ripgrep
)

DEV_TOOLS_SNAP=(
nvim
)






Each package list is passed into the installer functions in utils.sh.



This structure makes it easy to:




  • Add/remove tools cleanly

  • See what’s included at a glance

  • Extend with new categories later






Why This Structure Works





  • Modularity: each setup script does one job

  • Reusability: helpers prevent duplication

  • Clarity: it’s easy to understand what gets installed and how

  • Safety: checks prevent reinstalling or breaking existing tools






Want to Try It?




⚠️Security Reminder



Never run scripts from the internet — including mine — without reading and understanding them first.

Even if you trust the source, it's good practice to inspect any Bash script before executing it.




I care about security too and my WSL bootstrap project is open source, transparent, and written to be as readable and modular as possible. Fork it, inspect it, tweak it.




git clone https://github.com/LazyDoomSlayer/os-bootstraps
cd os-bootstraps/ubuntu
chmod +x run.sh
./run.sh






Install time: ~5 minutes on a VM with 8GB RAM, 8-core CPU, and 50Mbps connection.



First-time runs may take longer if your system hasn’t been updated with apt-get update && upgrade.



Everything else happens automatically. Grab a coffee. ☕






What’s Next: The CLI Stack



In Part 3, I’ll show you the terminal tools I bootstrap like tmux, zoxide, lazygit, and neovim and how they fit into my daily workflow.




Want to go full terminal-first? This next part is for you.


1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - run.sh Diaries #2: The Bash Behind the Bootstrap
id: 118e3c70-23a9-4237-affd-ee60970a7f4e
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-26
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
  - attack.t1059
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-26"
        description = "YARA Signature for "
    strings:
        $str = "run.sh Diaries #2: The Bash Be" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("runsh Diaries 2 The Bash Behind the Boot")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*runsh Diaries 2 The Bash Behind the Boot*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "runsh Diaries 2 The Bash Behind the Boot"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

CTI Threat Relationship Graph3 Knoten / 2 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Identifiziert: T1059Command and Scripting Interpreter
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich run.sh Diaries #2: The Bash Behind the B.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten run.sh Diaries #2: The Bash Behind the Bootstrap

Thematisch verwandte Begriffe: runsh, Diaries, Bash, Behind · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-88003 | InvoicePlane is a self-hosted open source application for managing invoi…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag