capture credentials from bash history | .bash_history | ~/.bash_history | clear history or clear bash history in linux

https://attack.mitre.org/techniques/T1552/003/

 

attacker may search bash command history on compromised systems because sometimes users tend to pass username and password over command line to the program. 

when user logs out then all the commands are flushed out to .bash_history file. for each user the file resides in the same location. ~/.bash_history 

attacker can abuse this by looking through the file for potential credentials. 

 

Mitigation:

there are multiple methods of preventing a users command history from being flushed to their .bash_history file, including use of the following commands:

off logging:

set +o history

and set -o history to start logging again. 

 

another way:

clean command history:

history -c

to make sure changes are written to disk, use:

history -w 

to make more sure the history is cleared when existing a session, the following command comes in handy:

cat /dev/null > ~/.bash_history && history -c && exit

 

 

 

 

 

permanently disable bash history:

echo 'set +o history' >> ~/.bashrc

next time when user login to the shell it will not store any commands to a history file .bash_history

to apply this settings immediately for the current shell session execute the .bashrc file:

. ~/.bashrc

 

disable a command history system wide:

echo 'set +o history' >> /etc/profile

it will be effective for the new users created after this.

 

 

if you dont have write permission on .bash_profile file then run the below command:

commands are written to the HISTFILE environment variable, which is usually .bash_history. we can echo it to see the location:

echo $HISTFILE

/root/.bash_history (this is the location)

we can use the unset command to remove the variable:

unset HISTFILE

now if we echo it then nothing will shows up. 

 

we can also make sure the command history is not stored by sending it to /dev/null

or export HISTFILE=/dev/null 

or HISTFILE=/dev/null

and now history will now be sent to /dev/null

echo $HISTFILE

/dev/null

then all commands afterwards wont be logged within that session. 

or if you have write permission, and want this behavior in each login then:

echo 'unset HISTFILE' >> ~/.bash_profile

echo 'unset HISTFILE' >> ~/.bashrc

 

ln -s /dev/null ~/.bash_history