I accidentally typed my password into bash command line, mistaking the Last login: ... line for Wrong password (I was in a hurry). What do I do to cover my trace?
What I did was editing .bash_history and deleting the offending line (had to relogin once to see the password appear in the file so I could delete it, and relogin again to see it disappear from the history available under UPARROW key).
Is there any other place where the command history could be saved? The system is CentOS 6.5.
bash stores the history in a file ~/.bash_history which is, by default, written to at the end of the session
the history that is kept in memory
To be safe, you need to clear it from the session:
and truncate the history file as needed:
If your session in which you typed the password is still open, then another way to cover your trace is to set the HISTFILE variable to the null device so that the history would not be written to ~/.bash_history when the session exits:
Since bash (at least all historic and current versions I'm aware of) does not automatically save history until you exit, a generally applicable strategy when you have typed a command that you want to ensure never gets saved is to immediately type:
kill -9 $$
This kills the shell with SIGKILL, which can't be caught, so the shell has no way to save anything on exit.
Most other approaches involve scrubbing after the fact (i.e. after the data has already hit the disk), which has a lot more chance for error (missing a copy), especially if the system might be using btrfs or similar.
My favorite trick for this is to hit the up arrow, backspace over the command, type something (might not be necessary), hit the down arrow, type "ls", and hit enter. Feels really hokey, but it actually works. Found this out when I got annoyed after editing the wrong command in my history and then ruining it by not hitting ctrl-c to abort the edit. I guess bash supports revisionist history. ;-)
Additional to the other answers, it may be relevant that the password is also found in the terminal scroll buffer - the history of displayed text - now, and, more of a problem, possibly on the hard disk, if the terminal emulator did save the history to the disk.
This happens in KDE konsole it the history size is set to "unlimited scrollback", to never discard any output.
Many of the answers here attempt to remove the command in question from the curren't bash session's history before it is written to $HISTFILE (~/.bash_history by default). However, if you've set PROMPT_COMMAND=history -a
the command with your password is immediately written to your $HISTFILE when the prompt is displayed after the command terminates. You'll have to edit your $HISTFILE to remove it.
ssh-keygen -f id_rsa -p.