I want to encrypt something without logging any part of the shell command to bash history. I don't want the password or any filenames or the command to appear in the shell history. How to do it using AES 256 with SHA2? (I believe this is the most secret configuration today, is it?)
3 Answers
$ unset HISTFILE
$ cat something | openssl enc -e -aes256 > encrypted-something
enter aes-256-cbc encryption password:
Verifying - enter aes-256-cbc encryption password:
-
@GuerlandoOCs:
something
here is just the filename — you never said that the filename was sensitive. Oct 30, 2017 at 0:07 -
You should know that
unset
ting theHISTFILE
variable will not save any of the history list to the file, even those commands beforeHISTFILE
wasunset
.bash
has an in memory "history list" that gets written to theHISTFILE
whenbash
exits.– RobertLOct 30, 2017 at 0:37 -
2Can start the command line with a space as a way of not entering into the in-memory history list. Oct 30, 2017 at 5:37
-
1
-
@BowlOfRed Good point. Note it works only in
bash
and depends on configuration ofbash
with environment variables as per @ilkkachu. Usually defaultbash
configuration supports this usage.– RobertLNov 1, 2017 at 1:36
The best way to turn off history temporarily is to start a subshell with the HISTSIZE
environment variable set to 0
:
HISTSIZE=0 $0
type your commands here
<ctrl-D>
History logging in your original login shell remains unaffected after exiting the subshell.
The $0
ensures that you start the same shell that you're using. You could replace $0
with the path to any shell, for example: /bin/sh
.
This works with most common shells including bash
, ksh
, zsh
, dash
. I think this is a POSIX standard.
You can also type exit
to exit the subshell.
Example
$ true 1
$ true 2
$ HISTSIZE=0 $0
$ true 3
$ true 4
$ exit
$ history 4
500 true 1
501 true 2
502 HISTSIZE=0 $0
503 history 4
If the file names in the command line bother you, you can read them from the terminal:
read infile; read outfile; cat $infile | openssl enc -e -aes256 > $outfile;
bash
, and also depends on configurationHISTCONTROL
should contain keywordignorespace
.