3

Related Question, less specific: Automatic cleanup of Bash history

This question focuses on a single problem.

Over time, a user will eventually enter a password on the command line by accident, and may even press enter, which will place the password in history. The user probably was expecting a password prompt, but something was typed wrong, causing that prompt to not show.

This user may not know how to clean up the history with history and history -d, or may be too busy to think about it.

I suggest removing all history items that are not found in which, or other white-list. An added benefit is you will not make the same mistake twice on a mis-typed command, not found in which

Do you know of

  • a way to tell bash to run my cleanup script before, or right after writing history,
  • an option that includes this particular which based cleanup already, or
  • an alternative way to prevent passwords from being stored in history?
Improve this question
4
  • 2
    The approach of using which is very limited, since built-in commands like cd are not found and there tons of other possibilities for right commands that can not be found/resolved by which. – jofel Feb 21 '12 at 18:05
  • I thought that might be the case. Sounds like additional logic will be needed. – 700 Software Feb 21 '12 at 21:52
  • Don't use which (never use which), use type. See How to use which on an aliased command? (and more) – Gilles 'SO- stop being evil' Feb 22 '12 at 0:47
  • I'm pretty sure there's no such thing. Even in zsh, you can prevent typos from entering the history (setopt correct) but passwords are likely to be too far from any existing command and so will enter the history anyway. Your method would only handle passwords typed as the first thing on a command line anyway. – Gilles 'SO- stop being evil' Feb 22 '12 at 0:57
2
  • Request: "a way to tell bash to run my cleanup script before, or right after writing history"

You could use incrontab to trigger a script on IN_CLOSE_WRITE for each user's bash_history. This Howtoforge article covers a lot of ground on Incrontab.

Do note that ulimit typically boxes inotify in at 128 watches. You can modify that with simple sysctl entries.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.