2

I want to encrypt something without logging any part of the shell command to bash history. I don't want the password or any filenames or the command to appear in the shell history. How to do it using AES 256 with SHA2? (I believe this is the most secret configuration today, is it?)

5
  • This is actually 2 questions. You might consider opening another question for "the most secret configuration today".
    – RobertL
    Oct 30, 2017 at 16:29
  • Prefix your command with one space.
    – Cyrus
    Oct 31, 2017 at 14:29
  • @Cyrus, true, should mention that works only with bash, and also depends on configuration
    – RobertL
    Oct 31, 2017 at 18:33
  • @RobertL: That is correct. Variable HISTCONTROL should contain keyword ignorespace.
    – Cyrus
    Oct 31, 2017 at 18:37
  • See also: unix.stackexchange.com/questions/6094/…
    – BowlOfRed
    Nov 1, 2017 at 1:41

3 Answers 3

3
$ unset HISTFILE
$ cat something | openssl enc -e -aes256 > encrypted-something
enter aes-256-cbc encryption password:
Verifying - enter aes-256-cbc encryption password:
5
  • @GuerlandoOCs: something here is just the filename — you never said that the filename was sensitive. Oct 30, 2017 at 0:07
  • You should know that unsetting the HISTFILE variable will not save any of the history list to the file, even those commands before HISTFILE was unset. bash has an in memory "history list" that gets written to the HISTFILE when bash exits.
    – RobertL
    Oct 30, 2017 at 0:37
  • 2
    Can start the command line with a space as a way of not entering into the in-memory history list.
    – BowlOfRed
    Oct 30, 2017 at 5:37
  • 1
    @BowlOfRed, that depends on HISTCONTROL/HISTIGNORE
    – ilkkachu
    Oct 30, 2017 at 9:23
  • @BowlOfRed Good point. Note it works only in bash and depends on configuration of bash with environment variables as per @ilkkachu. Usually default bash configuration supports this usage.
    – RobertL
    Nov 1, 2017 at 1:36
7

The best way to turn off history temporarily is to start a subshell with the HISTSIZE environment variable set to 0:

HISTSIZE=0 $0
type your commands here
<ctrl-D>

History logging in your original login shell remains unaffected after exiting the subshell.

The $0 ensures that you start the same shell that you're using. You could replace $0 with the path to any shell, for example: /bin/sh.

This works with most common shells including bash, ksh, zsh, dash. I think this is a POSIX standard.

You can also type exit to exit the subshell.

Example

$ true 1
$ true 2
$ HISTSIZE=0 $0
$ true 3
$ true 4
$ exit
$ history 4
500  true 1
501  true 2
502  HISTSIZE=0 $0
503  history 4
0
2

If the file names in the command line bother you, you can read them from the terminal:

read infile; read outfile; cat $infile | openssl enc -e -aes256 > $outfile;

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .