0

The security patch to Apple's root login security flaw — to 10.13.1 (17B1003) — has changed the shell setting reported by

dscl . list /Users UserShell

for root to /bin/sh (from /bin/bash). What does this accomplish? It's been suggested that for extra security I should set the shell for root to to /usr/bin/false. Does it still make sense to do that?

1

Basically bash and sh are two different shells, have a look here. Maybe an Apple employee liked sh more than bash and changed? :-)

This question and answer discuss login shells in some details. But the short answer is yes, it always makes sense to put the login shell for root to something non-existing.

(Technically it is not always, but in those cases you hopefully don't have to ask that question :-) )

  • So the change from bash to sh is of little consequence, right? (Importantly, unlikely to be a crucial component of the security fix.) – orome Dec 1 '17 at 13:45
  • @orome Indeed, the differences between sh and bash are mostly subjective (in that it is a matter of taste), if there was a bug in either sh or bash that would be more than huge. – flindeberg Dec 1 '17 at 14:02
  • On macOS, bash and sh are compiled from the same source code but sh is configured differently than bash. – fd0 Dec 1 '17 at 15:31
  • I'm getting conflicting advice. – orome Dec 1 '17 at 18:07
  • @orome If you ever need to use it, just change it by using sudo. If you ever need to log into root you can assume, safely, that you are doing something the wrong way. Sometimes it might be the faster way, but definitely not the right way. – flindeberg Dec 1 '17 at 21:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .