1

There are certain products like vulnerability scanners that log into Linux hosts as a specified user and end up "polluting" the bash history of the account in question. Here is an example of a command-line created by Tenable's Nessus scanner:

LANG=C; printf "priv_escl_start_%s" "4Xoo3InT"; sudo -u root -p Password: sh -c 'printf "command_start_%s" "ljsL6ec8"; lspci -v 2>/dev/null; printf "command_done_%s" "e0bC8nmu"'; printf "priv_escl_end_%s" "NpM6tFCP"

Is there a way to prevent such multi-command lines from being recorded in the history?

I have experimented with the HISTIGNORE variable but it's not expressive enough to capture this, even with extglob enabled. Also I believe these commands are executed non-interactively from a script that uses set -o history. Therefore I don't think I can use a function in $PROMPT_COMMAND. Maybe the only option is to scan .bash_history upon interactive login, elide these types of lines, write the history back out, and reload it?

Any help is much appreciated.

Improve this question

1 Answer 1

Reset to default
2

The best way to deal with this is to create an account dedicated to the scanner, perhaps an account called nessus. This has the added benefit of fine grain permissions control on the scanner, and the ability to audit when the scanner accessed the system.

If you are truly dedicated to the history not being recorded, rather than it just being mixed with your history, you can adjust the shell init files of the nessus account to not record any history at all.

Improve this answer
3
  • Thanks for this suggestion. Unfortunately I am not able to modify anything about the scanner or process as they are controlled by my IT organization.
    – Marc C
    Aug 21 at 6:53
  • So the scanner insists as logging into the system as you? or are you using a single shared account on the system rather than an account per person?
    – user10489
    Aug 21 at 11:16
  • It's a single shared account, which we all know very well is against best practices but there you have it. The account facilitates a whole lot of legacy workflow and I don't think it will change anytime soon.
    – Marc C
    Aug 24 at 17:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .