3

I know there is the $HISTFILE variable where i can find the currently logged in users history-file, but how can i be sure to get every history file on the server

I was thinking of the following:

sudo find /home/ -name '*_history*'

With output:

root@anders:~# sudo find /home/ -name '*_history*'
/home/seb/.bash_history
/home/adionditsak/.bash_history
/home/jakob/.bash_history
...

Would this do the trick - or do you have a better way?

  • You're assuming that everyone is a) recording history, b) using the same shell and c) not changing the location of their own history. You'll need to either accept a 70% success rate on your approach, or you'll need to scan config files in every user's home directory, work out where (if) they are storing history and look there. Good luck. – EightBitTony Jul 16 '14 at 14:06
  • But this scans for all files ending on _history in all home directories? Means all history files for all CLI's? Both Bash, Zsh, Sh, Redis, MySQL etc., and it scans in all directories under /home/. Of course they can disable history logging, but then there is no meaning in this. Need further explanation. – Adionditsak Jul 16 '14 at 14:15
  • So if I change $HISTFILE in my session to ~/whateveh.out, then how will your find find it? – EightBitTony Jul 16 '14 at 14:20
  • You are missing the point - I can choose to name my history file anything I like, so if you don't check the $HISTFILE value on a per user basis you can't find them. – EightBitTony Jul 16 '14 at 14:23
  • This is getting into discussion territory so last one from me - my point isn't whether it's common, it's whether you need to include all cases. That's why I said 70% (random guess). What you're asking is actually much more complicated than it looks at first glance, because you're not in control of the source data in any way. – EightBitTony Jul 16 '14 at 16:23
1

You could create a single directory for all history files and set HISTFILE in /etc/profile accordingly. For example HISTFILE=/var/somedir/history/${USER}_history Then you have a single location with all history files. A user can however override HISTFILE, for example in her .bashrc.

  • Exactly, basically, you're (the sysadmin) not in control of how and where users record their command history, and as such 'locating all of it' is going to be very difficult. There are probably solutions which record command history outside of the shell functions, auditing tools and the like. – EightBitTony Jul 16 '14 at 14:22
  • 1
    AFAIK you can compile bash with the option SYSLOG_HISTORY to log directly to syslog. That would solve the "don't trust the user" problem. – tlo Jul 16 '14 at 14:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.