Re:Hacker's Guide to Setting Up Your Mac
by oinksoft on Thursday October 02, 2014 @04:14PM
(#8402839)
No, you change your user shell to the shell you want. You can do this in the "Accounts" preference pane by control-clicking a user, selecting "Advanced Options" from the context menu, and changing the "Login shell" setting to your preferred shell.
Re:Hacker's Guide to Setting Up Your Mac
by unspecified on Thursday October 02, 2014 @04:48PM
(#8403010)
Right....but your user shell has nothing to do with shellshock. Shellshock involves things like Apache invoking system calls that need a shell, and those system calls don't care what your user shell is. They care what /bin/sh and /bin/bash are (or wherever your system shells live, it's /bin for OSX).
This guide is claiming that updating your login shell to bash via Homebrew will mitigate shellshock, which is flat-out wrong, and dangerous to boot.
Re:Hacker's Guide to Setting Up Your Mac
by oinksoft on Thursday October 02, 2014 @07:48PM
(#8403738)
OK, but nothing in your comment implied that you were talking about the "Shellshock" vulnerability. I believe that a very recent OSX update patched this vulnerability, anyhow.
Re:Hacker's Guide to Setting Up Your Mac
by unspecified on Thursday October 02, 2014 @09:18PM
(#8403993)
Oops, a very good point. I should have mentioned that right off the bat: my issue was with calling this a "hacker's guide", when it contains a pretty blatant security issue.
I think the parent poster is talking about eliminating all known-vulnerable bash shells from his machine, not just having the default user shell change.
#!/bin/bash
Re:Hacker's Guide to Setting Up Your Mac
by oinksoft on Thursday October 02, 2014 @04:38PM
(#8402964)
That should be #!/usr/bin/env bash, particularly for BSD which does not install bash in /bin. Nothing new about absolute executable paths being non-portable, #!/bin/bash is as bad as #!/usr/bin/python.
I'm not saying you should use that. It's just that "#!/bin/bash" shows 18 million results on Google while "#!/usr/bin/env bash" shows only 121,000.
Or you can update your bash from Apple's Support Site,
http://support.apple.com/downloads/
I don't know if it fixes the more recently found bash vulnerabilities, but I know it fixes the first one that was reported.
You can find versions for Lion and Mountain Lion if you search.
...right? `brew install bash` will just give you /usr/local/bin/bash, and then use that as your interactive shell.