A Complete Guide to Linux Bash History

What is bash shell history?

Bash shell history is a log of all commands that were entered into a bash shell session. These are stored in memory until shell session is closed and then are saved into disk file. History makes it possible to recall most recently entered command using up arrow key or display all commands in sequence using the history command.

The history of bash commands on a machine goes further than just being helpful – it acts as an approximation of an audit trail of events and times when these events happened. Hence, it becomes important for troubleshooting as well as for security reasons as explained later in this guide.

Where is the bash history file located?

By default bash keeps the log of commands in ~/.bash_history file, which is a text file in the user's home folder. Specific file name depends on the HISTFILE environment variable. According to the GNU Bash manual, file gets updated only when the shell session terminates, unless histappend shell option is enabled or history -a command is executed.

There is a separate bash history file per user account, located at appropriate paths: /root/.bash_history is bash history for the root user and /home/deploy/.bash_history belongs to user deploy. In case of a multi-user server environment, this allows identifying who entered specific command during the corresponding session.

How do you see bash command history?

Just execute the bash history command (history) in standalone mode in order to print out the list of commands in current session numerated by ID. If you want to examine the on-disk history of commands, run cat ~/.bash_history for whole file or tail -n 50 ~/.bash_history for last 50 entries.

These views might differ from each other since on-disk file gets updated only after shell session closes (unless history -a is explicitly run), hence looking at ~/.bash_history file in another terminal while session in question is still alive won't show you commands that have been typed there.

Which environment variables define bash history?

There are six environment variables defining how long commands are kept in memory, where are they stored and what kind of filtering is applied before saving:

These parameters can be configured during the current session through prompt or made permanent by adding export statements to ~/.bashrc file, creating typical bashrc history configuration seen in most of the guides:

shell

export HISTSIZE=5000
export HISTFILESIZE=5000
export HISTCONTROL=ignoreboth

ignoreboth parameter is worth noting separately – it does not keep the history of duplicate commands run consecutively and excludes any command starting with a space character, which is often used in order not to save sensitive commands in history.

How do you search bash history?

Use Ctrl+R to start reverse incremental search and start typing. Bash will jump to the most recent match and next presses of Ctrl+R will bring previous matches. Also you can use the following command in order to view all matches: history | grep <term>.

Ctrl+R is very helpful when you need to re-run a partial command that you remember, while history | grep command will allow you to scan all occurrences of similar commands (for example, in order to find all systemctl restart commands issued during some period of time).

How do you delete or remove bash history?

history -c will clear history for the current session in memory, but on-disk file will remain until the shell writes into it again. Use history -c && history -w in order to overwrite on-disk file immediately or just use rm ~/.bash_history to delete history file.

Other useful options are as follows:

• remove one entry: history -d <line number>;

• stop saving in current session: unset HISTFILE;

• stop saving permanently: either add unset HISTFILE into ~/.bashrc or set HISTFILE=/dev/null;

• overwrite the content of file (not just delete an entry): shred -u ~/.bash_history.

Note: shred command gives higher guarantee of deletion because of overwriting the content of file before deleting it, but this guarantee can be reduced on SSD drives or when filesystem uses journaling or copy-on-write, since there might be underlying copies of data somewhere else. Therefore, consider this measure as providing increased guarantee of deletion, but not as absolutely reliable one.

Why does bash history matter for server security?

Bash history can be useful and dangerous at the same time. On one hand, it is useful for tracking the changes that were made on the server and on the other hand, it is dangerous because of storing commands with passwords or plaintext API keys on the disk. Therefore, it is commonly erased by hackers with shell access to hide their tracks.

Actually, this is not just theory. MITRE ATT&CK documents "Clear Command History" as its own defense-evasion technique with examples of real intrusions where history -c command was used in order to cover the tracks on Linux compromised machines (TeamTNT, Hildegard malware, APT41).

So there are two implications that can be derived from the above mentioned facts. First, avoid entering any secrets in command line as much as possible and use environment files, secrets manager or pre-pend space character along with HISTCONTROL=ignorespace parameter to prevent recording credentials in history. Second, local history file acts as an audit trail only when it is accessible, therefore, redirecting command logging to a remote destination (for example, using auditd rules redirected to remote syslog destination) mitigates the risk of possible erasure of local history file.

OrbitServers bare-metal servers come with full root access and the ability to configure remote-forwarded logging according to your security policy requirements.