Even if user inputs "sh", I hope it can fork a bash that cover the default csh and then user can run their following commands in the bash.

"sh" runs Bash as a Bourne shell look-alike, you do not get full bash. sh is often a symbolic link to bash, but bash checks how it was called and acts accordingly (not uncommon).

Easiest was to override csh is to place "exec bash" in .login.