4

Something that's bothered me for many years is that if I want to search my shell history for commands which were run as root, I have to check two different locations:

  1. I have to check /root/.bash_history.
  2. I have to check /brian/.bash_history for sudo commands.

Is there a solution for bash (or, indeed, any shell - I'm willing to switch) which will deposit sudo commands into the shell history of the target user?

  • You could configure root's .bashrc or .bash_profile so that if $SUDO_USER is non-empty, it sets HISTFILE to point to the user's .bash_history. It would also need to set histappend so it appends rather than overwrites. This will result in all of root's history being appended to the user's history file (unless root's history was also cleared when changing HISTFILE and setting histappend. clearing it will, of course, make root's history unavailable in that sudo shell) – cas Oct 5 '19 at 6:45
  • e.g. if [ -n "$SUDO_USER" ] ; then history -c ; set histappend ; HISTFILE="$(getent passwd "$SUDO_USER" | cut -d: -f6)/.bash_history" ; fi – cas Oct 5 '19 at 6:51
  • @cas Correct me if I'm wrong, but if you run sudo cat /etc/passwd for example, your solution wouldn't help. Sudo runs the command directly; it doesn't spawn a brand new bash shell just to run cat, right? – Brian Gordon Oct 5 '19 at 6:58
  • The simple solution is to run with elevated permissions with the sudo prefix: sudo command .... Then they will be saved in your userID's history. The problem will only appear, when you run as root (for example via sudo -i). – sudodus Oct 5 '19 at 7:02
  • 1
    you could write a wrapper script that grepped for X in both /root/.bash_history and sudo X in user history files. or grep 'sudo.*COMMAND' /var/log/auth.log (or wherever sudo is logged on your system) – cas Oct 5 '19 at 7:07
0

I assume you are operating in that private unix I-am-root-and-only-user mode, like me. And exactly to avoid a splitting of my personality I log in as root. For the moment - I know it's a kind of security problem.

I am so busy installing, testing etc. as a sysadmin, that I cannot present a satisfying login for a user.

And still the bash history can confuse me when I am using several consoles and/or xterms. Only organization I have so far is a small file hist-keep with a couple of commands I often use.

if I want to search my shell history for commands which were run as root

Do you want to just search, or do you want to "load" the history file, so you can history-search?

I just looked up sudo yesterday, because of this obscure sudo vs. pseudo question. I suddenly realised that "sudo" and "pseudo" are pronounced identically in english, and when you consider "pseudonym" (or "alias") there really is a semantic connection.

Sudo is actually meant to produce a separate tracking of commands. That would be how "root" checks what "brian" (and others) did under pseudonym "root".

But you rather want to merge separate histories.

I feel the solution is more a history -r of a processed file, and not injecting sudo lines into root's history file.

A first aid solution would of course be a simple function/script that searches in these two files, something like

grep $1 $root-hist
grep "sudo.*$1" $user-hist

Then you can sudoroot-combigrep "mount" to get all relevant lines containing "mount". (choose your own easily tab-completeable name)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.