OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Shell Q
From: Gregory Hicks (ghicksCADENCE.COM)
Date: Mon Aug 14 2000 - 10:05:14 CDT

> Date: Mon, 14 Aug 2000 11:36:43 +0800
> From: "C.M. Wong" <wongcmEP.COM.MY>
>
> Hi All,
>
> Forgive my ignorance, but what is the diff between /sbin/sh and /bin/sh as

Difference is that /sbin/sh is statically linked. All libraries
required at runtime are already loaded.

> both are different in sizes? I was thinking of using another sh (tcsh
> actually) as a replacement for users and root alike. Security wise, is it

Actually, this would cause more problems than just for security.

If you ever have to go to single user mode, and /usr is not loaded,
you'll find that you cannot login to fix whatever needs fixing.

If you must use tcsh/csh/whatever as root's shell, I strongly using
something like the following code snippet in your .profile: (This one
is written for csh, but is easily modified for tcsh or whatever...)

#First if statement checks the system's running at run-level 3.

#First for loop uses ldd to get library dependencies for the csh
#executable and checks they're all there.

#Second if statement checks thats the csh binary itself is there and
#executable and then execs it.

#Put this code fragment at the very end of /.profile on your systems:-

if [ "`/usr/bin/who -r | /usr/bin/awk '{print $3}'`" = "3" ];then

        for LIB in `/usr/bin/ldd /usr/bin/csh | awk '{print $3}'`
        do
                if [ ! -f ${LIB} ]; then
                        exit 0
                fi
        done

        if [ -x /usr/bin/csh ]; then
                exec /usr/bin/csh
        fi
fi

> viable if I just replace root's sh at the passwd file? I have read somewhere
> that it's not advisable to replace root's shell since if the machine crashes
> etc, the replacement shell might not work and there is no where we can get
> back in. Probably a better place would be profile, but how do you guys
> normally do it? TIA.

All the startup scripts expect to use /sbin/sh as their shell...

Regards,
Gregory Hicks
---------------------------------------------------------------------
Gregory Hicks | Principal Systems Engineer
Cadence Design Systems | Direct: 408.576.3609
555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3479
San Jose, CA 95134 | Internet: ghickscadence.com