206

I accidentally typed my password into bash command line, mistaking the Last login: ... line for Wrong password (I was in a hurry). What do I do to cover my trace?

What I did was editing .bash_history and deleting the offending line (had to relogin once to see the password appear in the file so I could delete it, and relogin again to see it disappear from the history available under UPARROW key).

Is there any other place where the command history could be saved? The system is CentOS 6.5.

12
  • 61
    Just change the password :)
    – gronostaj
    Apr 2, 2014 at 7:18
  • 100
    Changing the password is not so simple... I'd need to ask the admin to reinstall my new public key on 15 different servers - and the guy is like /dev/null.
    – MaDa
    Apr 2, 2014 at 8:39
  • 75
    If you can't change your password easily at any time, then you may have a serious security loophole. What will you do when someone actually gets your password? Do you have any means to immediately revoke system access?
    – gronostaj
    Apr 2, 2014 at 13:57
  • 42
    You can change the passphrase of an ssh key without changing the key: ssh-keygen -f id_rsa -p.
    – jwg
    Apr 2, 2014 at 14:21
  • 6
    Just dropping in to mention that, at least under networked Windows logins, you're hosed. The admin (in some lofty server tower) default is to record all login attempts, and of course the usernames are cleartext. All some enterprising person has to do is search for non-username-ish strings and correlate them with the next valid username (or next login attempt on the same machine). And there's no simple way to delete that admin log file. So ya really gotta change your password. Apr 3, 2014 at 14:31

11 Answers 11

209

You can remove just the offending line from bash's history, instead of clearing the entire history. Simply remove the line with the -d flag, then save (write) the new history with the -w flag:

$ history
351 ssh [email protected]
352 my_password
$ history -d 352
$ history -w
3
  • 3
    Be aware that this doesn't work if you've set "PROMPT_COMMAND=history -a". With this in place the command with your password is immediately written to your .bash_history when the prompt is displayed after the command terminates. You'll have to edit your .bash_history to remove it.
    – benrifkah
    Aug 31, 2017 at 17:20
  • 1
    Also note that if the line was writen in the hostory file, and later multiple shells (terminal windows) had been opened, ALL those shells will have it in there history! You will need to either remove it from all of those shells, OR at least from the history LAST shell you close! Better to get it before the shell that used it exists. History when dealing with multiple shells can become a nightmare.
    – anthony
    Jul 2, 2019 at 1:41
  • @benrifkah you saved my day. I knew this answer should work and it did not, I had no idea why. after unsetting PROMPT_COMMAND it worked as it should. Apr 9, 2020 at 14:52
122

There are two parts to this:

  • bash stores the history in a file ~/.bash_history which is, by default, written to at the end of the session
  • the history that is kept in memory

To be safe, you need to clear it from the session:

history -c

and truncate the history file as needed:

> ~/.bash_history

If your session in which you typed the password is still open, then another way to cover your trace is to set the HISTFILE variable to the null device so that the history would not be written to ~/.bash_history when the session exits:

export HISTFILE=/dev/null
12
  • 208
    Hey look, it's the admin! Apr 2, 2014 at 14:19
  • 5
    Pun not intended, sorry :) I wasn't looking at your nick when I was writing my comment.
    – MaDa
    Apr 2, 2014 at 23:43
  • 7
    To be paranoid (and yet for some reason still not change your password) shouldn't you shred the file or otherwise overwrite it many times?
    – kojiro
    Apr 3, 2014 at 2:02
  • 1
    @MaDa No problem. I even added another way in the answer to bring my nick into the picture.
    – devnull
    Apr 3, 2014 at 4:14
  • 6
    Setting HISTFILE= is enough. From bash(1): If unset, the command history is not saved when a shell exits.
    – Lekensteyn
    Apr 3, 2014 at 9:16
23

Since bash (at least all historic and current versions I'm aware of) does not automatically save history until you exit, a generally applicable strategy when you have typed a command that you want to ensure never gets saved is to immediately type:

kill -9 $$

This kills the shell with SIGKILL, which can't be caught, so the shell has no way to save anything on exit.

Most other approaches involve scrubbing after the fact (i.e. after the data has already hit the disk), which has a lot more chance for error (missing a copy), especially if the system might be using btrfs or similar.

7
  • 2
    +1, not just more chance of error, it may even be recoverable depending on if/how many commands were executed after it
    – Cruncher
    Apr 2, 2014 at 17:01
  • Missing the word "automatically"? Because dotancohen has shown a way to save the history without exiting the shell.
    – Ben Voigt
    Apr 2, 2014 at 18:00
  • 3
    The shell can be configured to save history after each command is executed, instead of at exit. Apr 3, 2014 at 3:17
  • 1
    +1 This is exactly what I wanted to recommend! Besides rm ~/.bash_history~ to remove the backup file in the OP's case when it has been already saved
    – Tomas
    Apr 8, 2014 at 7:23
  • Be aware that this doesn't work if you've set "PROMPT_COMMAND=history -a". With this in place the command with your password is immediately written to your .bash_history when the prompt is displayed after the command terminates. You'll have to edit your .bash_history to remove it.
    – benrifkah
    Aug 31, 2017 at 17:19
11

After you accidentally typed something that you didn't want stored in the history, you can type: unset HISTFILE

Bash will not know where to store the history when you're logging off, so effectively this will disable history logging for the entire session.

1
  • Be aware that this doesn't work if you've set "PROMPT_COMMAND=history -a". With this in place the command with your password is immediately written to your .bash_history when the prompt is displayed after the command terminates. You'll have to edit your .bash_history to remove it.
    – benrifkah
    Aug 31, 2017 at 17:18
11

My favorite trick for this is to hit the up arrow, backspace over the command, type something (might not be necessary), hit the down arrow, type "ls", and hit enter. Feels really hokey, but it actually works. Found this out when I got annoyed after editing the wrong command in my history and then ruining it by not hitting ctrl-c to abort the edit. I guess bash supports revisionist history. ;-)

$ passw0rd
$ <up arrow><backspace x8>cd<down arrow>echo hi
$ history|tail -3

Looks like:

$ passw0rd
passw0rd: command not found
$ echo hi
hi
$ history|tail -3
 2445* cd
 2446  echo hi
 2447  history|tail -3
$ 
3
  • That's weird. One disadvantage is that it seems to know you edited history, so there might be some way to restore the old version?
    – MadTux
    Apr 6, 2014 at 8:21
  • @MadTux - Totally, but the .bash_history is just a plain text file. So you can do the example above, exit, and reconnect. When you view the full contents of the .bash_history file, there's nothing there that differentiates it from if you had just run "cd", so the trail is clean.
    – Mark Jerde
    Apr 7, 2014 at 18:36
  • Be aware that this doesn't work if you've set "PROMPT_COMMAND=history -a". With this in place the command with your password is immediately written to your .bash_history when the prompt is displayed after the command terminates. You'll have to edit your .bash_history to remove it.
    – benrifkah
    Aug 31, 2017 at 17:17
10

Additional to the other answers, it may be relevant that the password is also found in the terminal scroll buffer - the history of displayed text - now, and, more of a problem, possibly on the hard disk, if the terminal emulator did save the history to the disk. This happens in KDE konsole it the history size is set to "unlimited scrollback", to never discard any output.

0
7

With $<space> command, a command is not added to the history, sometimes usefull

$  history | grep mywierdgrep
$ history | grep mywierdgrep
 2005  history | grep mywierdgrep
7
  • 2
    While interesting, it's not clear how this is useful in the scenario described. Are you suggesting that every password should start with a space?
    – Ben Voigt
    Apr 2, 2014 at 17:59
  • 1
    No, what he's suggesting is that with this in place, any line you type that you don't want committed to the history, should be typed out with a leading space. eg: "ls" becomes " ls" and that line never shows in the history or in your sessions up-arrow list.
    – Bryan C.
    Apr 2, 2014 at 18:05
  • 4
    Note that this leading-space trick works only if $HISTCONTROL contains ignorespace. Apr 3, 2014 at 1:35
  • 2
    @jris198944 Providing a password via a command-line argument could potentially expose it to anybody on the system who runs ps.
    – jamesdlin
    Apr 7, 2014 at 3:58
  • 2
    And anyway, while this trick is useful if you're planning ahead, this doesn't help the original scenario where someone accidentally entered a password on a command-line.
    – jamesdlin
    Apr 7, 2014 at 4:00
4

Yet another alternative to avoid saving to the history file (before you log out) is simply to

chmod 400 ~/.bash_history 

and then logout. Stop history being written to file (since the file is read-only) so that whole bash session is discarded and the previous history retained.

Login again and reset the permissions to 600 (or not, depending on how paranoid you are!).

1

I see repeatedly mentioned

Be aware that this doesn't work if you've set "PROMPT_COMMAND=history -a" [..] You'll have to edit your .bash_history to remove it.

The first part is definitely true, but you don't have to resort to manually editing .bash_history to fix it. If you combine the two commands on one line it works perfectly fine:

$ history
351 ssh [email protected]
352 my_password
$ history -d 352 ; history -w
2
  • Could you explain what exactly makes this method work? Dec 7, 2017 at 14:49
  • The PROMPT_COMMAND is only executed before displaying the next command-prompt. The problem with entering the -d and -w commands on seperate lines is that the PROMPT_COMMAND will execute the history -a command in between. If you execute both the -d and -w on one commandline, it only executes afterwards Dec 8, 2017 at 10:42
0

Many of the answers here attempt to remove the command in question from the curren't bash session's history before it is written to $HISTFILE (~/.bash_history by default). However, if you've set PROMPT_COMMAND=history -a the command with your password is immediately written to your $HISTFILE when the prompt is displayed after the command terminates. You'll have to edit your $HISTFILE to remove it.

This setting is commonly used to interleave commands from multiple open bash sessions.

-3

You will want to check the syslog logs also. Invalid logins will generally be logged to syslog.

/var/log/messages or the equivalent for your OS.

1
  • 1
    The issue isn't that he entered a password in wrong, he was already logged in and entered his password into the prompt and hit enter. This will not show up in the messages file.
    – MaQleod
    Apr 5, 2014 at 19:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .