0

Which shell is more secure, mksh or bash?

There has been some discussion pointing into the direction, that mksh is more secure.

How to come to that conclusion? By looking which code was more audited and which not? Have there been any professional comparisons of either shell or comparisons of the two?

(Asking from perspective of someone who writes shell scripts that parse untrusted input.)

Improve this question
4
  • It doesn't depend on the type of the shell you are accessing - it depends on the security of the medium you're accessing the shell with. For example, if your computer is infected with a virus, you can't simply mitigate it without knowledge of how to do so or an antivirus. The virus still can steal your ssh keys, passwords and other credentials.
    – H3lp3ingth3p33ps
    Sep 1, 2014 at 15:37
  • I am asking from perspective of someone who writes shell scripts that parse untrusted input.
    – adrelanos
    Sep 1, 2014 at 15:55
  • Perhaps the question could be answered from the standpoint of binary auditing. I.E which shell is more susceptible to stack smashing etc... ?
    – MrSynAckSter
    Sep 12, 2014 at 17:58
  • May be you have to read the comparison between these shells on security perspective here. Wikipedia
    – Anandu M Das
    Sep 17, 2014 at 5:54

1 Answer 1

Reset to default
4
+50

I am asking from perspective of someone who writes shell scripts that parse untrusted input

I would not recommend any of these shells to parse untrusted input, because it is far to easy to make errors with the shell syntax which can cause unwanted command execution. This is not a problem how secure the implementation of the shell itself is, but how hard it is for the developer of the shell to securely handle untrusted data - and bash and (m)ksh do not differ much in this case.

Have a look instead at languages like Perl, which offer a taint mode to handle untrusted data. This way you are forced to sanitize the data before you can run commands with it, which makes it much safer.

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .