0

I have this line which keeps appearing in my shell history even when I am not internet connected :

cd some_directory && tput cuu1 && tput el

Does anyone knows what it does and where does it come from ? Because my first thought is that I have been hacked, no ?

Thanks

4
  • 1
    Any cron jobs??
    – Jeff Schaller
    Jul 7, 2018 at 12:47
  • 1
    cd some_directory is self-explanatory whereas the tput command is used to initialize or reset the terminal. tput cuu1 is used to move up one line and tput el is used to clear to the end of the line. You can find more info in the man page or via Google. As far as whether or not you've been hacked, do you have any cron jobs. Have you examined the logs such as /var/log/secure and the logs in /var/log/audit. To be sure, you can do a tcpdump to look at any traffic that's coming in. Jul 7, 2018 at 12:49
  • Sorry for the misguided info : it was no "not logged" but "not internet connected" : anyway your cron hint gave me to think (crons are clean) and I think now that I am just a bit paranoid : it was nemo plugin which trace every move I do when browsing my files
    – John Doe
    Jul 7, 2018 at 13:15
  • I don't think non-interactive shells (like in cron jobs) should add to history..
    – ilkkachu
    Jul 7, 2018 at 13:45

1 Answer 1

1

That tput cuu1 and tput el is used to go up one line and to clear the beginning of the line. So what basically happens is, the terminal will clear the current line only. You "cd" into the directory and that's it. You probably knew that already. So it's nothing serious. You should check your log files. If you can, reinstall OS just to have peace of mind. It could be like Jeff Schaller's comment. So try disconnecting from the network (if possible) couple of times and check the history. If it still runs then it could be cron job script. tput command man page

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .