Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There are a couple commands I want to run in a terminal that require me to provide my password. I really don't want those commands ending up in any kind of history or anywhere else where they could be seen by someone after the command was run. Are there any shells/terminals for Ubuntu that I could use (or options to bash/zsh/etc) that would give me a secure environment where I don't have to worry about my history being kept?

share|improve this question
up vote 3 down vote accepted

Do you really mean that the commands require you to specify your password as an argument? Most commands prompt you for it, and that won't go into any history file.

Note that if you're using a multi-user machine, another user could see the commands that you execute if they call ps at the right time. So the battle is lost unless you call in reinforcements such as a virtual machine.

Ok, let's assume that your commands are really badly written, or that you don't want to leave a trace of these commands for some other reason.

All shells with a history saving feature allow you to switch it off (each has its own command for that), and many can exclude certain commands from the history list (i.e., not just exclude them from the history file but even make them inaccessible to the Up command (someone dumping your RAM might still find them). In bash and zsh, the history won't be saved when the shell exits if HISTFILE is not set (note that zsh may also save the history after each command if the inc_append_history option is on). In bash and lines matching the pattern in HISTIGNORE are not recorded in the history; in zsh, you can only decide to ignore commands beginning with a space with the hist_ignore_space option. Both shells allow you to edit your history with their fc builtin.

Anything that you type and that is visible onscreen is stored in your terminal's history. This is usually easy to clear (typically through a menu entry, or simply by exiting your terminal emulator). Of course you shouldn't use a terminal that logs all output, but if you are, it's probably because you configured it, so you'd know.

If you're concerned about a specific string such as a password, you can store it in a file (which you keep in an encrypted filesystem, of course), and recall its contents when you need it (that way someone looking over your shoulder won't get a chance to see the password):

mycommand -u herms -p "$(cat ~/encrypted/passwords/mycommand)"

It's possible that the command will leave other crumbs behind. You could try running a shell with the HOME environment variable set to a temporary directory where you just copy your shell rc and the configuration files for your command. After running the command, check if you want to keep any data that it's produced, then remove the temporary directory. Sample session:

mkdir /tmp/private
chmod 700 /tmp/private
cp -a ~/.zshrc ~/.config/mycommand /tmp/private
HOME=/tmp/private zsh
# subsequent commands are executed from the child shell started above
mycommand ...
# back to the parent shell
# inspect /tmp/private for files you want to keep
rm -rf /tmp/private

If you're concerned about more than protecting passwords, a more radical approach is to create a different user and run your command as that user. This has the advantage that even if the command is badly written, it won't leave compromising output in your home directory because it doesn't have the permission. You can configure that user's shell not to leave a history, and clean up its home directory as you see fit.

share|improve this answer
Yes, the commands require that I specify the password as an argument. It's not really an explicit argument to the command, but part of the data I have to pass in to the command. – Herms Jul 22 '10 at 21:11

with zsh you can put a space in front of your commandline which will prevent the commend being stored in the history:


   Remove command lines from the history list when the first 
   character on the line is a space, or when one of the expanded
   aliases contains a leading  space.   

   Note that  the  command  lingers in the internal history until
   the next command is entered before it vanishes, allowing you to
   briefly reuse or edit the line.  If you want to make it vanish 
   right away without entering another command, type a space and
   press return.

use setopt HIST_IGNORE_SPACE in your .zshrc to activate that feature.

share|improve this answer
Bash does the same thing when the variable HISTCONTROL includes ignorespace or ignoreboth in its value. – Dennis Williamson Jul 22 '10 at 21:05

This is all for the BASH shell: history -c

will clear the history list and

history -d N

will delete a history entry N.

Also you can modify your .bashrc file to include

export HISTIGNORE="[ ]*"

Which will force history to ignore any command that starts with a space.

export HISTIGNORE="&:[ ]*:exit"

will force history to ignore any duplicate commands, entries that start with a space, and exit.


share|improve this answer
Don't forget to "source .bashrc" before typing the commands. Or log out and back in, but that is too much work! – steve.lippert Jul 22 '10 at 20:28
Bash will ignore commands that start with a space when the variable HISTCONTROL includes ignorespace or ignoreboth in its value. – Dennis Williamson Jul 22 '10 at 21:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .