From owner-freebsd-security@FreeBSD.ORG  Fri Jul  9 20:11:29 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 4E07B16A4CE
	for <freebsd-security@freebsd.org>;
	Fri,  9 Jul 2004 20:11:29 +0000 (GMT)
Received: from islet.dsl.unixan.com (islet.dsl.unixan.com [206.124.137.22])
	by mx1.FreeBSD.org (Postfix) with ESMTP id DF33F43D1F
	for <freebsd-security@freebsd.org>;
	Fri,  9 Jul 2004 20:11:28 +0000 (GMT)	(envelope-from djb@unixan.com)
Received: from mesa.dsl.unixan.com (djb@mesa.dsl.unixan.com [206.124.137.18])
	by islet.dsl.unixan.com (8.12.11/8.12.11) with SMTP id i69KBQ7L001827;
	Fri, 9 Jul 2004 13:11:26 -0700 (PDT)
	(envelope-from djb@unixan.com)
Date: Fri, 9 Jul 2004 13:11:26 -0700
From: Daniel Brown <djb@unixan.com>
To: "Peter C. Lai" <sirmoo@cowbert.net>
Message-Id: <20040709131126.3b8d6d7b.djb@unixan.com>
In-Reply-To: <20040709103342.GA2842@cowbert.net>
References: <!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAAQalskDVfo0WQ/a0WxfyYA8KAAAAQAAAAHZLwubL1IEW8iaIucc4elAEAAAAA@ntscom.com>
	<200407091158.35803.anders@kommandoraden.info>
	<20040709103342.GA2842@cowbert.net>
X-Mailer: Sylpheed version 0.9.10 (GTK+ 1.2.10; i686-pc-linux-gnu)
X-Face: ".E)>Dp:mH<OtVR$Zb)eCw;
	6LEM[iZr4],$RT.#eYE/LB{@vq?x2QV}zd{cIx$]:g!uKx$Nr/mgHeM'CVI?=_m$vhe>JC%;
	_j&|O(iET^Y#v)'R,3Th)?un#2[`x7J&@ClPD0?MlzHBP61gci=t1G!Jf8V9r+nMFv:GX&}5R2YZ@lzKO_S5,^.!^<^OijwA[0*`cfC'.Ft7-qcuK4^-Cu
X-Face-Credit: Saviour Machine; www.saviourmachine.com
X-Frustrated-Since: 999302400
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
cc: freebsd-security@freebsd.org
Subject: Re: Root users shell == no existant shell /bin/bash
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 09 Jul 2004 20:11:29 -0000

Wrote Peter C. Lai:

> On Fri, Jul 09, 2004 at 11:58:35AM +0200, Anders Dahlqvist wrote:
> > torsdagen den 8 juli 2004 17.29 skrev Brandon Grace:
> > > I made a mistake setting my shell and have set the root users shell to
> > > /bin/bash instead of /bin/sh. I am curiuos if anyone knows how to fix this.
> > > The machines is FreeBSD 4.8-RELEASE-p4 and does not have sudo only su.
> > 
> > ...and I gather that "su - toor" doesn't work either for some reason or other?
> 
> toor has a disabled (*) password by default. What Brannon should have done was
> set a password for toor in the beginning, without mucking around with root's 
> shell. But as a rule of thumb, you're probably superuser way too much if you 
> develop an urge to change it shell anyway. 

Some of us either have to do extensive work as root (I myself
extensively use shell programming on the command line -- which is not
easy nor sensible in either csh or tcsh), or find it extremely
annoying to use the least favorite shell during an emergency.

On the other hand, I've run across a sysadmin who always enables his
toor accounts -- and changes its shell to bash.  As a result, not only
is there an alternate root account (good in case 'root' trampled on by
accident or purpose), but you can get root bash as a login shell while
leaving the real root to its normal shell.

Since then I've adopted this tip on the BSD system I run.

      -Daniel