Xymon Mailing List Archive search

'Shell shock' mitigation

list Japheth Cleaver
Fri, 26 Sep 2014 17:32:31 -0700
Message-Id: <user-59eaa5a8d847@xymon.invalid>

On Fri, September 26, 2014 4:57 pm, user-dcee455aaab0@xymon.invalid wrote:
On Fri, 26 Sep 2014, J.C. Cleaver wrote:
/bin/sh to /bin/bash is standard on Red Hat-derived systems.

dash is present as a package in RHEL6 and Fedora, but not EL7 or EL5.
Prior to that (<=EL4) 'ash' was available.
So, is changing the shell in /etc/passwd for the xymon user to /bin/dash
sufficient to get xymon to use dash or are other changes required.
The key exposure is the shebang line for the wrappers in
~/server/xymon-cgi/ and/or ~/server/xymon-seccgi/. After that, ensure that
SHELL= in xymonserver.cfg is set to /bin/dash (if you're using at least
4.3.12).


The /etc/passwd shell is what the system account will use, but there's no
real need for the xymon user to have a valid shell at all there (unless
you're doing a remote login or something. I typically use /sbin/nologin
there.

I really do not want to change the symlink for /bin/sh to point to dash
as I am not sure what other things might break.

This is on a Centos 6.5 box.
I wouldn't advise switching /bin/sh to /bin/dash on a RH/CentOS box --
probably lots of small breakages here and there due to bashisms.


HTH,

-jc