0

Which shell is more secure, mksh or bash?

There has been some discussion pointing into the direction, that mksh is more secure.

How to come to that conclusion? By looking which code was more audited and which not? Have there been any professional comparisons of either shell or comparisons of the two?

(Asking from perspective of someone who writes shell scripts that parse untrusted input.)

  • It doesn't depend on the type of the shell you are accessing - it depends on the security of the medium you're accessing the shell with. For example, if your computer is infected with a virus, you can't simply mitigate it without knowledge of how to do so or an antivirus. The virus still can steal your ssh keys, passwords and other credentials. – H3lp3ingth3p33ps Sep 1 '14 at 15:37
  • I am asking from perspective of someone who writes shell scripts that parse untrusted input. – adrelanos Sep 1 '14 at 15:55
  • Perhaps the question could be answered from the standpoint of binary auditing. I.E which shell is more susceptible to stack smashing etc... ? – baordog Sep 12 '14 at 17:58
  • May be you have to read the comparison between these shells on security perspective here. Wikipedia – Anandu M Das Sep 17 '14 at 5:54
3
+50

I am asking from perspective of someone who writes shell scripts that parse untrusted input

I would not recommend any of these shells to parse untrusted input, because it is far to easy to make errors with the shell syntax which can cause unwanted command execution. This is not a problem how secure the implementation of the shell itself is, but how hard it is for the developer of the shell to securely handle untrusted data - and bash and (m)ksh do not differ much in this case.

Have a look instead at languages like Perl, which offer a taint mode to handle untrusted data. This way you are forced to sanitize the data before you can run commands with it, which makes it much safer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.