My modified search history lines have an asterisk next to them.
I've searched unix.stackexchange.com and stackoverflow.com, but I yearn for a full explanation for the asterisks in my history (other than what the man page says).
Lines listed with a * have been modified.
$ history | tail 11850* 11851 ./block_ip.sh '188.8.131.52' 'evil probe' 11852 ./block_ip.sh DROP '184.108.40.206' 'evil probe $
In this example, a shell script had a third argument, but there was no error, and i ran it twice without specifying (DROP/ACCEPT).
The modification was an attempt to blank out this history so that history-expansion would not lead me to the wrong command (again).
I want to know more about this (but I don't know what I don't know).
Please consider both angles of this:
- how can i use this (for instance can i get that original command if i need it)?
- how can a bad guy use this (can someone hide their command history this way)?
If a generic answer is too verbose, please note some of my settings:
EDITOR=/usr/bin/vim HISTFILE=/home/jim/.bash_history SHELLOPTS=braceexpand:hashall:histexpand:history:interactive-comments:monitor:vi
And this OS info (It is RedHat...but Debian/Fedora/Ubuntu shouldn't vary much...should they?):
Linux qwerutyhgfjkd 3.10.0-693.11.1.el7.x86_64 #1 SMP Mon Dec 4 23:52:40 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
I am using bash as my shell.