Hide ones command history from other users on a Linux server

Question

When I log in via ssh on a Linux(Ubuntu) server, I notice that all the bash commands executed by other users on the server are saved in the command history. Is there a way that could allow me to hide the commands that I have typed in the command line from other users on the server?

Answer 1

There are many ways to hide your command history, but it's a bad idea to turn off history altogether as it is very useful. Here are three good ways to turn it off temporarily.

1. Quickest solution: Type unset HISTFILE

   That will prevent all commands run in the current login session from getting saved to the .bash_history file when you logout. Note that HISTFILE will get reset the next time you login, so history will be saved as usual. Also, note that this removes all commands from the session, including ones run before you typed unset HISTFILE, which may not be what you want. Another downside is that you cannot be sure you did it right until you logout as bash will still let you use the up arrow to see previous commands.

2. Best solution: type a space before a command

   Try it and then hit up arrow to see if it got added to your history. Some sites have it already set up so that such commands are not saved. If it does not work, add the line export HISTCONTROL=ignoreboth to your .bashrc file. When you login in the future, commands that start with a space will be forgotten immediately.

3. Easiest to remember: Type sh

   That will start a subshell with the original Bourne shell. Any commands written in it (until you exit) will not be saved in your history. Anybody looking at your history file will be able to see that you ran sh (which is suspicious), but not see what you ran after that.

There are many other ways of doing this. You can even tell bash which commands to never remember (HISTIGNORE). See the man page for bash(1) and search for HIST to see lots of possibilities.

Answer 2

The command line history for bash shell sessions are stored in the ~/.bash_history file. If this file does not exist, it is created with no read permissions for other users.

You may change the number of commands that bash saves into this file by setting the HISTFILESIZE environment variable. Setting it to zero will truncate the history file to zero size. The default is 500. Unsetting the HISTFILE (unset HISTFILE) variable will also prevent storing commands in the history file.

However, the current setup of the server you're describing (in the comments) is simply wrong.

There should be no reason to allow multiple users to log in and use an interactive shell on the root account. Do consider using sudo instead, with multiple private user accounts!

The command history for root, whether for interactive sessions or when using sudo, is extremely precious, especially if you have multiple users with root access on the system.

Your team will want to know exactly what the root user has been up to since any misconfigurations or other mishaps performed by this user must best be investigated and fixed. With a command line history, it makes it much easier to find why something went wrong. The sudo utility additionally logs every invocation to the syslog facility for this reason, with timestamps and with full command line, and with the username of the user executing sudo.

EDIT: We recently started having issues with a fiber network on a cluster of Linux machines at work. It turned out that some drivers or other were replaced with the wrong version when a silly user with sudo access made an careless package upgrade. We were able to find this through looking at the system logs and the sudo timestamps therein. The "silly user" turned out to be nobody else other than myself!

Answer 3

Issue the following command after logging in:

HISTFILE=

This will block any subsequent commands from being logged to the history file.