Today, I don't know well the security level of a minimal debian installation... But on last September, wasn't bash the default shell of debian ?