Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I believe that there are a large number of ways to prevent your bash history being recorded e.g. export HISTSIZE=0, how can I prevent users from hiding their bash history?

share|improve this question
4  
Replace bash with your own changes. Without doing that, you can not prevent people from hiding their history. Of course, if you do that and don't tell them, well there are other issues. The better approach is if you don't trust your users, don't allow them on the system. –  mah Dec 18 '12 at 1:10
    
Can't you prevent the export of HISTSIZE=0? –  user1166981 Dec 18 '12 at 1:11
    
You cannot prevent the user from changing an environment variable. You can set the initial value but the user can change it with no effort. –  mah Dec 18 '12 at 2:41
1  
Bash history is a security hole. As a user, I'd question the administrator's intentions and the sweet deal where he leaves the system open to compromise because passwords are not removable from the history. –  Fiasco Labs Dec 30 '12 at 4:41
1  
kill -9 $$ will always prevent .bash_history from being written, and you can't stop a user from executing it. So, you can't do it 100%. –  Michael Hampton Dec 30 '12 at 4:42
show 1 more comment

migrated from stackoverflow.com Dec 30 '12 at 3:13

This question came from our site for professional and enthusiast programmers.

3 Answers

up vote -2 down vote accepted

make it readonly HISTSIZE in your /etc/profile

share|improve this answer
    
You cannot prevent the user from changing an environment variable. –  mah Dec 18 '12 at 2:40
    
you can't prevent some users from changing environment variables... –  X.Jacobs Dec 18 '12 at 9:46
    
Isn't some enough to be going through a fruitless exercise on this subject though? It's like inventing copy protection that only some people are able to subvert. –  mah Dec 18 '12 at 10:46
    
$ bash --noprofile? (note: space before the command) –  J.F. Sebastian Dec 29 '12 at 20:54
1  
-1. There are a variety of ways for anyone who can read the bash man page to get around this. –  Michael Hampton Dec 30 '12 at 4:39
show 1 more comment

Use the Append-Only Attribute

You could use root to modify the attributes of the .bash_history file, but this will cause problems when Bash tries to truncate the file to HISTSIZE or otherwise overwrite the file. For example:

sudo chattr +a ~username/.bash_history

With this flag in place, even root can't delete or truncate the file without first remove the append-only flag.

share|improve this answer
add comment

A user can always do "HISTFILE=/some/innocuous/place" which will leave the default history file intact. Thus append-only on the default file will only prevent users from reducing the file, but it does not force users to save their history to the default.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.