3

I believe that there are a large number of ways to prevent your bash history being recorded e.g. export HISTSIZE=0, how can I prevent users from hiding their bash history?

Improve this question
6
  • 4
    Replace bash with your own changes. Without doing that, you can not prevent people from hiding their history. Of course, if you do that and don't tell them, well there are other issues. The better approach is if you don't trust your users, don't allow them on the system.
    – mah
    Dec 18, 2012 at 1:10
  • Can't you prevent the export of HISTSIZE=0?
    – user1166981
    Dec 18, 2012 at 1:11
  • You cannot prevent the user from changing an environment variable. You can set the initial value but the user can change it with no effort.
    – mah
    Dec 18, 2012 at 2:41
  • 1
    Bash history is a security hole. As a user, I'd question the administrator's intentions and the sweet deal where he leaves the system open to compromise because passwords are not removable from the history.
    – Fiasco Labs
    Dec 30, 2012 at 4:41
  • 1
    kill -9 $$ will always prevent .bash_history from being written, and you can't stop a user from executing it. So, you can't do it 100%.
    – Michael Hampton
    Dec 30, 2012 at 4:42

4 Answers 4

Reset to default
-2

make it readonly HISTSIZE in your /etc/profile

Improve this answer
6
  • 1
    You cannot prevent the user from changing an environment variable.
    – mah
    Dec 18, 2012 at 2:40
  • you can't prevent some users from changing environment variables...
    – X.Jacobs
    Dec 18, 2012 at 9:46
  • Isn't some enough to be going through a fruitless exercise on this subject though? It's like inventing copy protection that only some people are able to subvert.
    – mah
    Dec 18, 2012 at 10:46
  • $ bash --noprofile? (note: space before the command)
    – jfs
    Dec 29, 2012 at 20:54
  • 1
    -1. There are a variety of ways for anyone who can read the bash man page to get around this.
    – Michael Hampton
    Dec 30, 2012 at 4:39
4

Use the Append-Only Attribute

You could use root to modify the attributes of the .bash_history file, but this will cause problems when Bash tries to truncate the file to HISTSIZE or otherwise overwrite the file. For example:

sudo chattr +a ~username/.bash_history

With this flag in place, even root can't delete or truncate the file without first remove the append-only flag.

Improve this answer
1

A user can always do "HISTFILE=/some/innocuous/place" which will leave the default history file intact. Thus append-only on the default file will only prevent users from reducing the file, but it does not force users to save their history to the default.

Improve this answer
1

I use chattr +a .bash_history, which prevents users from deleting the history file.

Of course, users will still be able to change the HIST... variables, but this will show up in the .bash_history. You will be able to check if they were doing things like using a different HISTFILE to cover their tracks.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy