Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Related Question, less specific: Automatic cleanup of Bash history

This question focuses on a single problem.

Over time, a user will eventually enter a password on the command line by accident, and may even press enter, which will place the password in history. The user probably was expecting a password prompt, but something was typed wrong, causing that prompt to not show.

This user may not know how to clean up the history with history and history -d, or may be too busy to think about it.

I suggest removing all history items that are not found in which, or other white-list. An added benefit is you will not make the same mistake twice on a mis-typed command, not found in which

Do you know of

  • a way to tell bash to run my cleanup script before, or right after writing history,
  • an option that includes this particular which based cleanup already, or
  • an alternative way to prevent passwords from being stored in history?
share|improve this question
The approach of using which is very limited, since built-in commands like cd are not found and there tons of other possibilities for right commands that can not be found/resolved by which. – jofel Feb 21 '12 at 18:05
I thought that might be the case. Sounds like additional logic will be needed. – George Bailey Feb 21 '12 at 21:52
Don't use which (never use which), use type. See How to use which on an aliased command? (and more) – Gilles Feb 22 '12 at 0:47
I'm pretty sure there's no such thing. Even in zsh, you can prevent typos from entering the history (setopt correct) but passwords are likely to be too far from any existing command and so will enter the history anyway. Your method would only handle passwords typed as the first thing on a command line anyway. – Gilles Feb 22 '12 at 0:57
  • Request: "a way to tell bash to run my cleanup script before, or right after writing history"

You could use incrontab to trigger a script on IN_CLOSE_WRITE for each user's bash_history. This Howtoforge article covers a lot of ground on Incrontab.

Do note that ulimit typically boxes inotify in at 128 watches. You can modify that with simple sysctl entries.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.