Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is there a security advantage to using a different shell for the root account, either a hardened shell program, or simply a shell binary stored in a non-standard location?

share|improve this question

1 Answer 1

up vote 7 down vote accepted

Depends. If there's a different set of attacks that can replace /bin/bash than some other files on your filesystem, then maybe there's a case for it. I used to make my root shell on Solaris a statically-linked /bin/sh. The reason was that /usr/lib was on a different physical disk than /, so in single-user mode it might not be possible to start a dynamically-linked shell. The fact that this also avoided touching any compromised shared objects was merely a side-effect.

In other words, if /bin/bash and your proposed alternative root shell are on the same partition, with similar permissions, there probably isn't much point. An attacker who can trojan one can trojan both.

share|improve this answer
1  
As Graham alludes, you can keep your shell (and system libraries, and essential apps...) on a non-writable partition/medium, but simply changing the shell is unlikely to add much security. –  Peter Stone Nov 19 '10 at 18:27
    
The only caveat would be if the default shell is considerably worse than bash (from a security perspective) then replace it. –  Rory Alsop Dec 7 '10 at 21:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.