1 Topic by ajsekeris

  • ajsekeris
  • Member
  • Offline
  • Registered: 2012-07-09
  • Posts: 9

Topic: OpenBSD/bash/shellshock: which part of iRedMail requires bash?

==== Required information ====
- iRedMail version: any
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Linux/BSD distribution name and version: OpenBSD 5.4
- Related log if you're reporting an issue: n.a.
====

Hello,

No doubt you have heard of the shellshock vulnerability discovered in bash. I run iRedmail on OpenBSD and bash is only installed there to accommodate iRedMail. Because it is not part of the core OpenBSD install, there will be no patch quickly forthcoming. So I have two options:
- try to recompile bash on OpenBSD with fixes from some linux distro myself
- remove bash

I decided to simply try removing it and see what happens, and it seems iRedMail still works fine. This makes me pretty happy, but I am curious now which part of iRedMail then requires bash. Is that simply the installation process perhaps? Or should I be expecting other issues to occur now that bash is no longer present?

Thanks in advance,
Anton Sekeris

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: OpenBSD/bash/shellshock: which part of iRedMail requires bash?

Backup scripts under /var/vmail/backup. But you can try to replace the shabang line by ksh, it should work just fine.

3 Reply by ajsekeris

  • ajsekeris
  • Member
  • Offline
  • Registered: 2012-07-09
  • Posts: 9

Re: OpenBSD/bash/shellshock: which part of iRedMail requires bash?

Thank you for the quick response (as usual), indeed this works just fine.