Secure shell/terminal for Ubuntu

Question

There are a couple commands I want to run in a terminal that require me to provide my password. I really don't want those commands ending up in any kind of history or anywhere else where they could be seen by someone after the command was run. Are there any shells/terminals for Ubuntu that I could use (or options to bash/zsh/etc) that would give me a secure environment where I don't have to worry about my history being kept?

Answer 1

Do you really mean that the commands require you to specify your password as an argument? Most commands prompt you for it, and that won't go into any history file.

Note that if you're using a multi-user machine, another user could see the commands that you execute if they call ps at the right time. So the battle is lost unless you call in reinforcements such as a virtual machine.

Ok, let's assume that your commands are really badly written, or that you don't want to leave a trace of these commands for some other reason.

All shells with a history saving feature allow you to switch it off (each has its own command for that), and many can exclude certain commands from the history list (i.e., not just exclude them from the history file but even make them inaccessible to the Up command (someone dumping your RAM might still find them). In bash and zsh, the history won't be saved when the shell exits if HISTFILE is not set (note that zsh may also save the history after each command if the inc_append_history option is on). In bash and lines matching the pattern in HISTIGNORE are not recorded in the history; in zsh, you can only decide to ignore commands beginning with a space with the hist_ignore_space option. Both shells allow you to edit your history with their fc builtin.

Anything that you type and that is visible onscreen is stored in your terminal's history. This is usually easy to clear (typically through a menu entry, or simply by exiting your terminal emulator). Of course you shouldn't use a terminal that logs all output, but if you are, it's probably because you configured it, so you'd know.

If you're concerned about a specific string such as a password, you can store it in a file (which you keep in an encrypted filesystem, of course), and recall its contents when you need it (that way someone looking over your shoulder won't get a chance to see the password):

mycommand -u herms -p "$(cat ~/encrypted/passwords/mycommand)"

It's possible that the command will leave other crumbs behind. You could try running a shell with the HOME environment variable set to a temporary directory where you just copy your shell rc and the configuration files for your command. After running the command, check if you want to keep any data that it's produced, then remove the temporary directory. Sample session:

mkdir /tmp/private
chmod 700 /tmp/private
cp -a ~/.zshrc ~/.config/mycommand /tmp/private
HOME=/tmp/private zsh
# subsequent commands are executed from the child shell started above
cd
mycommand ...
exit
# back to the parent shell
# inspect /tmp/private for files you want to keep
rm -rf /tmp/private

If you're concerned about more than protecting passwords, a more radical approach is to create a different user and run your command as that user. This has the advantage that even if the command is badly written, it won't leave compromising output in your home directory because it doesn't have the permission. You can configure that user's shell not to leave a history, and clean up its home directory as you see fit.

Answer 2

with zsh you can put a space in front of your commandline which will prevent the commend being stored in the history:

HIST_IGNORE_SPACE (-g)

   Remove command lines from the history list when the first 
   character on the line is a space, or when one of the expanded
   aliases contains a leading  space.   

   Note that  the  command  lingers in the internal history until
   the next command is entered before it vanishes, allowing you to
   briefly reuse or edit the line.  If you want to make it vanish 
   right away without entering another command, type a space and
   press return.

use setopt HIST_IGNORE_SPACE in your .zshrc to activate that feature.

Answer 3

This is all for the BASH shell: history -c

will clear the history list and

history -d N

will delete a history entry N.

Also you can modify your .bashrc file to include

export HISTIGNORE="[ ]*"

Which will force history to ignore any command that starts with a space.

export HISTIGNORE="&:[ ]*:exit"

will force history to ignore any duplicate commands, entries that start with a space, and exit.

Source