10

Is there a security advantage to using a different shell for the root account, either a hardened shell program, or simply a shell binary stored in a non-standard location?

1 Answer 1

7

Depends. If there's a different set of attacks that can replace /bin/bash than some other files on your filesystem, then maybe there's a case for it. I used to make my root shell on Solaris a statically-linked /bin/sh. The reason was that /usr/lib was on a different physical disk than /, so in single-user mode it might not be possible to start a dynamically-linked shell. The fact that this also avoided touching any compromised shared objects was merely a side-effect.

In other words, if /bin/bash and your proposed alternative root shell are on the same partition, with similar permissions, there probably isn't much point. An attacker who can trojan one can trojan both.

1
  • 1
    As Graham alludes, you can keep your shell (and system libraries, and essential apps...) on a non-writable partition/medium, but simply changing the shell is unlikely to add much security. Nov 19, 2010 at 18:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .