Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I had to grep recently for a password that may have been saved in a file. I did not want that line to show up in the bash history.

How can I prevent a password or other sensitive information from being stored in the bash history when using grep? For example, how can I get grep to read the pattern from stdin or console?

share|improve this question

3 Answers 3

up vote 37 down vote accepted

If you put HISTCONTROL=ignorespace in your .bashrc, and you put a space before the command name, it will not be added to your history.

$ export HISTCONTROL=ignorespace
$ grep "passwd" secret_password_file.txt   # added to history
$  grep "passwd" secret_password_file.txt  # not added to history
share|improve this answer
3  
FWIW: The question in the title and the question in the body are completely different. I answered the question in the title. –  Brandon Invergo Jul 25 '13 at 17:12
    
Your criticism is appropriate. I just edited the title. Is it better now? I still think (and so it seems does the community) that your answer is the most relevant. –  Leo Jul 26 '13 at 5:11
1  
I made an edit to your question to clarify things, making both questions (preventing something from being stored in the history and reading from stdin with grep) available. This way, all answers are still valid, but the very different solutions won't be confusing. –  Brandon Invergo Jul 26 '13 at 9:32

Just for completeness, I answer the question in the body: how to get grep to read patterns from stdin:

You can use the -f option:

grep -f- /path/to/file

That will read any number of patterns from stdin, one per line. (- means stdin; you could also specify a file with patterns, one per line.) grep will match lines in /path/to/file which match any of the specified patterns.

share|improve this answer
    
Thanks for that. That is a good contribution and a handy trick to use elsewhere as well, say when an or'ed pattern is needed –  Leo Jul 26 '13 at 5:12

This is the best I could come up with:

grep $(read -p "Pattern: "; echo $REPLY) .*

Is this safe enough? Is there anyway to recover the pattern other than scrolling the terminal? Is there a nicer way?

share|improve this answer
3  
You can use read -s to prevent echo (see also this question). The secret will be visible in ps output though. You can use instead grep -f /dev/stdin * (or grep -f - *) so that grep will read the pattern(s) from a file instead, end input with ^D, or: (read -es; echo $REPLY) | grep -f - * –  mr.spuratic Jul 25 '13 at 16:47
    
The capture shell should have double quotation marks around it. At the moment, this will break if the user enters spaces or some special characters. –  paraxor Jul 25 '13 at 22:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.