You probably want to mask off the multicast bits.

That doesn't always work without a few extras, as explained on the page.

should redirect the error/warning output so that it isn't mashed into the command:

    openssl rand -hex 6 2>/dev/null | sed 's/\(..\)/\1:/g; s/.$//'

because if you are running this on startup there is a chance HOME or RANDFILE aren't set yet, the .rnd file doesn't exist or the permissions on it are not set properly - resulting in a warning such as "PRNG not seeded" or "unable to write 'random state'" that would be passed into the ifconfig command.

Command substitution does not capture standard error.

you're right, it is from my own script where I do it different with more sanity checks and my own errors, I just applied it to the line above.

I'm also in that habit for anything fired at startup or in cron so you don't pollute logs.

Just leave out the [mac] and it will give you a random address.

i.e. sudo python SpoofMAC.py en1