There are certain products like vulnerability scanners that log into Linux hosts as a specified user and end up "polluting" the bash history of the account in question. Here is an example of a command-line created by Tenable's Nessus scanner:
LANG=C; printf "priv_escl_start_%s" "4Xoo3InT"; sudo -u root -p Password: sh -c 'printf "command_start_%s" "ljsL6ec8"; lspci -v 2>/dev/null; printf "command_done_%s" "e0bC8nmu"'; printf "priv_escl_end_%s" "NpM6tFCP"
Is there a way to prevent such multi-command lines from being recorded in the history?
I have experimented with the
HISTIGNORE variable but it's not expressive enough to capture this, even with extglob enabled. Also I believe these commands are executed non-interactively from a script that uses
set -o history. Therefore I don't think I can use a function in
$PROMPT_COMMAND. Maybe the only option is to scan .bash_history upon interactive login, elide these types of lines, write the history back out, and reload it?
Any help is much appreciated.