Red Hat

Um..I just noticed something in regards to Bash on RHEL5

What I wanted to accomplish, was to delete the bash history function for security reasons (like someone slipping under the covers on MS domain controlled PC with xp pro sp3) and being able to see or access my xterm windows I have open to my server, then mystiquely looking at my .bash_history file or up-cursoring and look at what i have typed and passwords set.

By default, /etc/profile has a history size set to 1000 lines (or there about). If you delete /root/.bash_history, without logging out of the current shell you are running in, one can still see the commands you have previsouly typed and potentially passwords.

It seems bash does not always use on disk copy of .bash_history, rather some sort of memory cached copy.

So I set the /etc/profile HISTSIZE=20. logged out of the xterm shell, i was in...re-logged into the server and did a history, and thankfully I only got the last 20 commands.

Changed the HISTSIZE back to default, logged out/in, and still saw the last 20 commands typed in last time.

So, my question is, 1) can history be turned off completely or is that hard coded into bash or is it MORE Prudent to set history down to 10 or 20, then be sure to check before you logout your history file/commands to make sure no passwords are present (if you remember to do so). See the quick reply.

---------- Post updated at 02:31 PM ---------- Previous update was at 02:28 PM ----------

[root@zabbix-slc ~]# history
1 history
2 clear
3 ls
4 ls -al | more
5 history
6 vi /etc/profile <---Changed HISTSIZE from 1000 back to 20
7 rm .bash_history <---Removed the history file
8 exit <----Exit the Shell/xterm
9 history <---Bash for some reason/somewhere retained the history, even after the .bash_histroy was removed.

Try to unset the HISTFILE variable:

Code:

unset HISTFILE

For more info try:

Code:

info --index-search HISTFILE bash