For a while, when I access my ubuntu 18.04 server on vultr, by clicking the up arrow, I no longer see the bash history. It is always empty, even if I write some commands, then I exit the server and re-enter, the bash history is empty again.

I immediately thought it was the fault of some updates.

But the other day I noticed new hidden folders in my /www directory


and a new file: .bash_history Inside the file is this:

sudo cat ssh_host_rsa_key
ssh localhost
ssh localhost -p 65262
ssh localhost -p 65262 -u root
ssh root@localhost:65262
ssh root@
ssh root@localhost -p 65262
ssh root@localhost -p 65262 -i /etc/ssh/ssh_host_rsa_key
ssh root@localhost -p 65262 -i "/etc/ssh/ssh_host_rsa_key"
su root
su myuser

65262 is my old ssh port, I changed it, just for sure.

What's happening to my server? Is there anyone playing with it without my knowing it?

On my server I disabled the ssh login with password, disabled the root user, installed fail2ban with filter on ssh, changed the ssh port.

And so far I haven't seen any changes to my sites or my files.

I can't understand if it's just an update and a normal server behavior or if it's something more dangerous. Can you help me understand?


I pasted the echo in a terminal, this is the result, but I have no idea if it is correct, wrong or if there is something strange.

PS1=[\e]0;\u@\h: \w\a]${debian_chroot:+($debian_chroot)}\[\033[01;32m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$

if I write this:

sudo nano ~/.bash_logout

I see this:

# ~/.bash_logout: executed by bash(1) when login shell exits.

# when leaving the console clear the screen to increase privacy

if [ "$SHLVL" = 1 ]; then
    [ -x /usr/bin/clear_console ] && /usr/bin/clear_console -q

It's normal???

And .profile comments say this, and seem to use the new dir I saw on my www:

# ~/.profile: executed by the command interpreter for login shells.
# This file is not read by bash(1), if ~/.bash_profile or ~/.bash_login
# exists.
# see /usr/share/doc/bash/examples/startup-files for examples.
# the files are located in the bash-doc package.

# the default umask is set in /etc/profile; for setting the umask
# for ssh logins, install and configure the libpam-umask package.
#umask 022

# if running bash
if [ -n "$BASH_VERSION" ]; then
    # include .bashrc if it exists
    if [ -f "$HOME/.bashrc" ]; then
        . "$HOME/.bashrc"

# set PATH so it includes user's private bin if it exists
if [ -d "$HOME/bin" ] ; then

# set PATH so it includes user's private bin if it exists
if [ -d "$HOME/.local/bin" ] ; then
  • Review access times in "last" command. It sounds like someone has accessed your server and wiped history file – Sergiy Kolodyazhnyy Jun 5 '19 at 23:51
  • I have a snapshot of my server about a month ago on vultr. I could restore it, but it is the same server... How do I put it to safety? If someone entered once, will not have problems to enter again on the same server... What can I do? – alebal Jun 6 '19 at 19:55
  • Assuming login credentials are the same on backup, I would assume restoring it is not safe. Contact vultr, maybe they can take it offline and examine the server that way. You can of course change passwords but if the attacker left a backdoor method to access it, that wont help much – Sergiy Kolodyazhnyy Jun 6 '19 at 21:37
  • vultr does nothing on your server. Better to develop a new server? :( – alebal Jun 6 '19 at 23:42
  • Yes, just to be safe – Sergiy Kolodyazhnyy Jun 6 '19 at 23:56

NOT normal behaviour! Read man bash, the 'INVOCATION' section. Carefully inspect /etc/profile, /etc/bash.bashrc, ~/.bash_profile, ~/.bash_login, ~/.bash_logout, and ~/.profile. Additionally, look at all files source'd (or .ed) in those files.

In a running shell, look at

echo "PATH=$PATH"
echo "PS1=$PS1"
  • You talk to me, but I don't understand what you're saying... I'm not a Linux expert, I'm a PHP programmer... Can you explain everything as if you were talking to someone who knows almost nothing about Linux? Thank you. – alebal Jun 6 '19 at 19:38
  • Your attempts to add information via comments, shows why we ask you to Edit ( askubuntu.com/posts/1148919/edit ) your Question to add info, and use the {} formatting tool. The first thing I think I see is HISTFILE=, when it should be the name of the history file. I won't decode the rest of the comments. Please edit and format. – waltinator Jun 6 '19 at 20:33
  • Good now? It's ok? – alebal Jun 6 '19 at 20:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.