3

I believe that there are a large number of ways to prevent your bash history being recorded e.g. export HISTSIZE=0, how can I prevent users from hiding their bash history?

migrated from stackoverflow.com Dec 30 '12 at 3:13

This question came from our site for professional and enthusiast programmers.

  • 4
    Replace bash with your own changes. Without doing that, you can not prevent people from hiding their history. Of course, if you do that and don't tell them, well there are other issues. The better approach is if you don't trust your users, don't allow them on the system. – mah Dec 18 '12 at 1:10
  • Can't you prevent the export of HISTSIZE=0? – user1166981 Dec 18 '12 at 1:11
  • You cannot prevent the user from changing an environment variable. You can set the initial value but the user can change it with no effort. – mah Dec 18 '12 at 2:41
  • 1
    Bash history is a security hole. As a user, I'd question the administrator's intentions and the sweet deal where he leaves the system open to compromise because passwords are not removable from the history. – Fiasco Labs Dec 30 '12 at 4:41
  • 1
    kill -9 $$ will always prevent .bash_history from being written, and you can't stop a user from executing it. So, you can't do it 100%. – Michael Hampton Dec 30 '12 at 4:42
-2

make it readonly HISTSIZE in your /etc/profile

  • 1
    You cannot prevent the user from changing an environment variable. – mah Dec 18 '12 at 2:40
  • you can't prevent some users from changing environment variables... – X.Jacobs Dec 18 '12 at 9:46
  • Isn't some enough to be going through a fruitless exercise on this subject though? It's like inventing copy protection that only some people are able to subvert. – mah Dec 18 '12 at 10:46
  • $ bash --noprofile? (note: space before the command) – jfs Dec 29 '12 at 20:54
  • 1
    -1. There are a variety of ways for anyone who can read the bash man page to get around this. – Michael Hampton Dec 30 '12 at 4:39
4

Use the Append-Only Attribute

You could use root to modify the attributes of the .bash_history file, but this will cause problems when Bash tries to truncate the file to HISTSIZE or otherwise overwrite the file. For example:

sudo chattr +a ~username/.bash_history

With this flag in place, even root can't delete or truncate the file without first remove the append-only flag.

1

A user can always do "HISTFILE=/some/innocuous/place" which will leave the default history file intact. Thus append-only on the default file will only prevent users from reducing the file, but it does not force users to save their history to the default.

0

I use chattr +a .bash_history, which prevents users from deleting the history file.

Of course, users will still be able to change the HIST... variables, but this will show up in the .bash_history. You will be able to check if they were doing things like using a different HISTFILE to cover their tracks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy