3

The Bash history can get deleted just by deleting the file which contains. How can I protect the history from being cleared / deleted?

  • 2
    There is no way on that system itself, as the answers show. If you truly need a non-deletable means of logging history, consider external hardware and a modified bash executable (e.g. one that automatically logs all commands to an external storage device that cannot be deleted without physical access, such as an external datalogger, properly-configured Arduino as serial port (writing to SD card), networked server that you trust, or even paper tape being printed. – hexafraction Sep 4 '16 at 17:44
  • Not an answer to the question, but a forced script command might help with your overall problem. ibm.com/developerworks/community/blogs/nix/entry/… – Carl Sep 4 '16 at 22:13
  • just to make locating the history file harder, you may rename it to a name starting in . and set its permissions to 000. – boardrider Sep 4 '16 at 23:04
  • 1
    @boardrider Then bash won't be able to write any history. – Duncan X Simpson Sep 5 '16 at 3:27
  • 2
    This is an XY problem. Whatever you hope to accomplish, there's probably a way to do it. But it won't have anything to do with bash history. – David Schwartz Sep 5 '16 at 5:33
14

What you ask can be done with ...

sudo chattr +a ~$USER/.bash_history
sudo chattr +i ~$USER/.profile

This will set the "append only" for .bash_history and "immutable bit" for .profile and even root can not delete or truncate the file unless that bit is removed. The 2nd command prevents the user from editing the settings for .profile.

Next put this in /etc/bash.bashrc or /etc/.profile:

# #Prevent unset of histfile, /etc/profile
HISTFILE=~/.bash_history
HISTSIZE=10000
HISTFILESIZE=999999
# Don't let the users enter commands that are ignored# in the history file
HISTIGNORE=""
HISTCONTROL=""
readonly HISTFILE
readonly HISTSIZE
readonly HISTFILESIZE
readonly HISTIGNORE
readonly HISTCONTROL
export HISTFILE HISTSIZE HISTFILESIZE HISTIGNORE HISTCONTROL

That will lock down most simple actions a user could make to mess this up. But it wont stop the more experienced users ...

  • a user can simply switch to another shell and you wont see anything register.
  • anyone with the admin password or any process with CAP_LINUX_IMMUTABLE capability can remove the immutable bit
  • commands that start with a space by default are not stored in history.
  • you can not stop a kill -9 $$. That command will prevent writing to history.

So what you ask is rather pointless. If you do not trust your users do not let them on your system.

If this question was created to tract actions by hackers... you can totally forget about this; they are not likely to use bash when they are on your system and this history only works with bash.

A far superior option would be to use grsecurity or to install acct (The GNU Accounting Utilities).

  • 2
    Not in the least. You prevent rootkits by not letting someone install them. Stick to software you get from Ubuntu software center and do not download randomly software from the web. If the source you download software from is trusted you will never ever get a rootkit. – Rinzwind Sep 4 '16 at 16:30
  • 1
    @Tomas Keep in mind that we don't have "topics" here. We're not a forum; there are "Questions" (questions), "Answers" (answers to those questions) and "Comments" (small additional questions, corrections or related information). You did the right thing by asking the linked question as a question, but try not to use forum terms on Stack Exchange sites. (It annoys some people.) – wizzwizz4 Sep 4 '16 at 19:41
  • Wouldn't that make Bash fail to write to the log? Another question says: "You cannot protect from getting delete. If you make the permission bit as read-only, bash will fail to write in it." – haykam Sep 5 '16 at 1:50
  • @Peanut I changed it to "+a". – Rinzwind Sep 5 '16 at 8:08
  • +i = immutable, prevents all changes, +a = append only. Both are filesystem-specific. – ilkkachu Sep 5 '16 at 8:09
8

This is not the answer you were looking for, but what you really want is linux's audit system, not bash. The audit system is designed expressly for things like this, whereas shell history is a convenience feature and there are many ways to modify it or simply not use it, as stated in many answers above.

4

You cannot protect the .bash_history file from getting deleted. If you make its permission bits read-only, bash will fail to write in it.

However, you can create an alias for rm in your ~/.bashrc so that, every time you want to delete something, it will ask you (y/n) questions

Put this line in your ~/.bashrc file.

alias rm="rm -i"

Also make sure it is only you who can read/write from/to that file.

chmod 600 ~/.bashrc

should do the job.

0

Not a protection against the deletion itself, but a way to keep a backup is to keep the ~/.bash_history in Dropbox and symlink to it.

I guess there are other backup software to continuously back up as well in different ways.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.