Advanced Bash scripting: reliable and secure automation
You write production-grade Bash scripts that stop safely on errors, validate input and run several jobs at once.
Level 301 · 24 lessons · 21 practice labs
Lessons
Functions and scope
- Functions in depth: parameters, output and reuse: You build function libraries that take parameters, produce output and can be reused in other scripts via source.
- Variable scope: local, global variables and leaks: You limit function variables with local and prevent bugs caused by silently overwriting global variables.
- Return status: return, $? and getting results from functions: You return success or failure with a return code and data through standard output, without mixing the two.
- Short task: move repeated code into a function library
Error handling
- set -euo pipefail: strict mode and its limits: You make a script stop at the first error with set -euo pipefail and learn where this mode surprises you.
- Handling errors, exit and signals with trap: With trap you catch ERR, EXIT and signals so cleanup and logging always run, however the script ends.
- Error messages and an exit code contract: You build a helper that writes errors to stderr with line numbers and document meaningful exit codes.
- Short task: make a script that leaves a mess when interrupted safe
Strings and data structures
- String handling: slicing, replacing and changing case: Without calling external tools you slice, replace, measure and change the case of strings inside Bash.
- Arrays: appending, looping and slicing: You keep file and server lists in arrays and loop over or slice them without breaking items with spaces.
- Counting and lookup tables with associative arrays: With associative arrays you keep counts per address or a lookup table from user to department.
- Reading files line by line safely with mapfile and read: With mapfile and read -r you read lines intact and avoid traps with spaces and backslashes.
- Short task: a script that builds a user table from CSV
Input, output and flow
- Options and help text with getopts: You parse short options with getopts, catch missing values and show users clear help text.
- Templates and multi-line input with here-doc and here-string: You generate config files and report templates with here-docs and control when variables are expanded.
- Subshells and process substitution: ( ), $( ) and <( ): You learn why subshells lose variables and compare two command outputs without temp files using process substitution.
- Short task: a report tool with help text and options
Concurrent jobs
- Parallel jobs: &, wait and xargs -P: You start jobs checking many servers in the background, collect results with wait and cap how many run.
- Lock files and flock: stopping a script running twice: With flock you stop overlapping runs of the same script started by cron and safely clear stale locks.
- Short task: parallel checks against a hundred servers with a concurrency cap
Writing secure scripts
- Reviewing scripts with ShellCheck: You read ShellCheck warnings, fix common mistakes such as unquoted variables and make checking a habit.
- Input validation and quoting: defending against command injection: You validate every outside value against an allow list and quote correctly so the script never runs unintended commands.
- Safe temporary files and cleanup with mktemp: You see why predictable temp file names are risky and use mktemp with trap to create and always delete them.
- Final task: a log monitoring and alert script: You deliver a script that takes options, runs with a lock, scans logs, raises alerts on thresholds and passes ShellCheck.
Practice labs
- Move repeated code into a function library: Move logging and check code repeated in three scripts into a shared library file and source it from them.
- Fix a script broken by a leaking variable: Find the bug where a loop variable inside a function overwrites the caller's variable and fix it with local.
- Return a result and a status separately: Rewrite a function whose output and errors mix so the result goes to stdout, errors to stderr and status through return.
- Switch a script to strict mode: Fix the unset variable and swallowed error problems that surface when set -euo pipefail is added to a script.
- Define an exit code contract for a script: Rework a script called by monitoring so it gives distinct exit codes and a one-line message for ok, warning, critical and unknown.
- Set an ERR trap that reports the failing line: Add an ERR trap that logs the command, line number and call chain on failure and make it work in subshells too.
- Make a script safe to interrupt: Add rollback steps with EXIT and INT traps to a script that leaves half-written files and a mounted directory when interrupted.
- Fix a read loop that mangles lines with spaces: Fix a script that loops over cat output with for and splits paths with spaces, using mapfile or while read.
- Write a log monitoring and alert script: Write a script that watches a log, raises one alert when errors pass a threshold within a window and does not repeat it.
- Write a script that builds a user table from CSV: Read a CSV file safely line by line and print the name, department and email columns as an aligned table.
- Extract site and role from host names: Split host names that follow the naming convention with string slicing and replacement and list the non-conforming ones separately.
- Map error codes to descriptions with an associative array: Write a script that counts error codes in a log and reports them by frequency with descriptions from a lookup table.
- Write a report tool with help text and options: Write a tool that takes format, date range and output file options via getopts and prints help text from a here-doc.
- Generate configs from a here-doc template: Write a script that generates a virtual host file from a here-doc template for each domain in a site list.
- Fix a counter lost in a pipeline: Fix a counter that always prints zero because its while loop runs in a subshell, using process substitution.
- Run server checks in parallel: Run a check list that takes minutes in sequence in parallel with background jobs and wait, printing results in order.
- Run a hundred checks with a concurrency cap: Process a hundred-entry list with xargs -P at no more than eight jobs at a time and gather failures in a separate file.
- Stop a script running twice at once: Add a flock lock to a sync script that overlaps in cron so a second copy logs a note and exits.
- Clear the ShellCheck warnings: Clear the script's ShellCheck warnings without changing behaviour and confirm the tool reports clean.
- Close a command injection hole in a script: Demonstrate the injection hole in a script that handles a file name with eval, then close it with validation and quoting.
- Fix a predictable temp file weakness: Make a script that uses a fixed file name under /tmp safe against symlink attacks with mktemp and a clean-up trap.
About this course
You write production-grade Bash scripts that stop safely on errors, validate input and run several jobs at once.
What you will learn
- Functions and scope
- Error handling
- Strings and data structures
- Input, output and flow
- Concurrent jobs
- Writing secure scripts
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.