On large project teams, multiple members may often use the same hosts simultaneously. Alternatively, you might prefer to maintain multiple SSH sessions open on the same host—one for monitoring logs and another for executing commands. While a Linux host using the Bash shell records command-line history, the default settings can pose challenges. Specifically, they may result in the loss of prior history when multiple sessions access the same host.
To address this, you can make some enhancements to your configuration. On the Symantec IGA Virtual Appliance, we typically add these improvements to the .bashrc files of the config, dsa, and imps service IDs. These adjustments ensure the preservation of command history for all work performed. Naturally, it is also important to clean up or remove any sensitive data, such as passwords, from the history.
Below, we explore an optimized .bashrc configuration that focuses on improving command history management. Key features include appending history across sessions, adding timestamps to commands, ignoring specific commands, and safeguarding sensitive inputs.
Optimized .bashrc Configuration
Here’s the full configuration we’ll be exploring:
# Added to improve history of all commands
shopt -s histappend
export HISTTIMEFORMAT='%F %T '
export HISTSIZE=10000
export HISTFILESIZE=100000
export HISTIGNORE='ls:history'
export HISTCONTROL=ignorespace
export PROMPT_COMMAND='history -a; history -c; history -r'Detailed Explanation of the Configuration
shopt -s histappendEnsures that new commands from the current session are appended to your history file instead of overwriting it. This prevents accidental history loss across sessions.
export HISTTIMEFORMAT='%F %T 'Adds a timestamp to each command in your history, formatted as YYYY-MM-DD HH:MM:SS.
export HISTSIZE=10000Limits the number of commands retained in memory during the current session to 10,000.
export HISTFILESIZE=100000Configures the maximum number of commands saved in the history file to 100,000.
export HISTIGNORE='ls:history'Excludes frequently used or less important commands like ls and history from being saved, reducing clutter.
export HISTCONTROL=ignorespacePrevents commands that start with a space from being saved to history. This is particularly useful for sensitive commands like those containing passwords or API keys. When we copy-n-paste from Notepad++ or similar, remember to put a space character in front of the command.
export PROMPT_COMMAND='history -a; history -c; history -r'Keeps history synchronized across multiple shell sessions: history -a appends new commands to the history file, history -c clears the in-memory history for the current session, and history -r reloads history from the history file.
Symantec IGA Virtual Appliance Service IDs
with the .profile or .bash_profile and .bashrc file(s).
We can see that the default .bash_profile for ‘config’ service already has a redirect reference for .bashrc
config@vapp1453 VAPP-14.5.0 (192.168.2.45):~ > cat .bash_profile
# .bash_profile
# Get the aliases and functions
if [ -f ~/.bashrc ]; then
. ~/.bashrc
fi
# User specific environment and startup programs
config@vapp1453 VAPP-14.5.0 (192.168.2.45):~ > cat .bashrc
# .bashrc
# Source global definitions
if [ -f /etc/bashrc ]; then
. /etc/bashrc
fi
# User specific environment
if ! [[ "$PATH" =~ "$HOME/.local/bin:$HOME/bin:" ]]
then
PATH="$HOME/.local/bin:$HOME/bin:$PATH"
fi
export PATH
# Uncomment the following line if you don't like systemctl's auto-paging feature:
# export SYSTEMD_PAGER=
# User specific aliases and functions
if [ -d ~/.bashrc.d ]; then
for rc in ~/.bashrc.d/*; do
if [ -f "$rc" ]; then
. "$rc"
fi
done
fi
unset rc
# Added to improve history of all commands
shopt -s histappend
export HISTTIMEFORMAT='%F %T '
export HISTSIZE=10000
export HISTFILESIZE=100000
export HISTIGNORE='ls:history'
export HISTCONTROL=ignorespace
export PROMPT_COMMAND='history -a; history -c; history -r'A view the ‘dsa’ service ID files with some modifications. The default .profile only has the one line that sources the file /opt/CA/Directory/dxserver/install/.dxprofile. To assist with monitoring history, instead of other direct updates, we still will use .bashrc reference to this file.
[dsa@vapp1453 ~]$ cat .profile
. /opt/CA/Directory/dxserver/install/.dxprofile
# Get the aliases and functions
if [ -f ~/.bashrc ]; then
. ~/.bashrc
fiBelow is the view of the new file .bashrc to be source by DSA .profile file.
[dsa@vapp1453 ~]$ cat .bashrc
# Added to improve history of all commands
shopt -s histappend
export HISTTIMEFORMAT='%F %T '
export HISTSIZE=10000
export HISTFILESIZE=100000
export HISTIGNORE='ls:history'
export HISTCONTROL=ignorespace
export PROMPT_COMMAND='history -a; history -c; history -r'A view the ‘imps’ service ID files with some modifications. The default .profile only has the one line that sources the file /etc/.profile_imps. To assist with monitoring history, instead of other direct updates, we still will use .bashrc reference to this file
imps@vapp1453 VAPP-14.5.0 (192.168.2.45):~ > cat .profile
# Source IM Provisioning Profile script
. /etc/.profile_imps
# Get the aliases and functions
if [ -f ~/.bashrc ]; then
. ~/.bashrc
fiBelow is the view of the new file .bashrc to be source by IMPS .profile file.
imps@vapp1453 VAPP-14.5.0 (192.168.2.45):~ > cat .bashrc
# Added to improve history of all commands
shopt -s histappend
export HISTTIMEFORMAT='%F %T '
export HISTSIZE=10000
export HISTFILESIZE=100000
export HISTIGNORE='ls:history'
export HISTCONTROL=ignorespace
export PROMPT_COMMAND='history -a; history -c; history -r'Delete Sensitive Information from History
If sensitive information has already been recorded in your history, you should clean it up. While you could wipe the entire history, a better approach is to retain as much as possible and remove only the sensitive entries.
The Challenge of Deleting Sensitive History
When deleting specific entries from Bash history, there’s a complication: line numbers change dynamically. The Bash history is a sequential list, so removing an entry causes all subsequent commands to shift up, altering their line numbers.
To address this, the cleanup process should iterate backward through the history. Starting with the last match ensures that earlier line numbers remain unaffected by changes further down the list.
Cleanup Script
Save the following script as history_cleanup.sh and modify the PATTERN variable to match the sensitive commands you want to delete:
#!/bin/bash
##################################################################
# Name: history_cleanup.sh
# Goal: Provide a means to clean up prior bash history of any
# sensitive data by a known pattern, e.g. password or token
#
# ANA 11/2024
##################################################################
# Prompt the user to enter the pattern to search for
read -p "Enter the pattern to search for in history: " PATTERN
# Validate input
if [ -z "$PATTERN" ]; then
echo "No pattern entered. Exiting."
exit 1
fi
# Use grep to find matching history entries and delete them in reverse order
history | grep "$PATTERN" | sort -r | while read -r line; do
# Extract the history line number (first column in the output)
LINE_NUMBER=$(echo "$line" | awk '{print $1}')
# Delete the history entry by its line number
history -d "$LINE_NUMBER"
done
# Save the updated history to the .bash_history file
history -w
echo "History cleanup complete. Entries matching '$PATTERN' have been removed."
Final Thoughts
Applying this .bashrc configuration across all service IDs offers several advantages. It streamlines workflows, secures sensitive inputs, and ensures a more organized command history. These enhancements are particularly valuable for developers, administrators, or anyone operating in multi-terminal environments.
Key Benefits:
- History Persistence: Ensures commands are appended to the history file without overwriting existing entries, preserving a complete record of activity.
- Enhanced Auditability: Adds timestamps to history, making it easier to track when specific commands were executed.
- Reduced Noise: Excludes less critical commands, such as
ls, to keep the history clean and focused on meaningful actions. - Improved Privacy: Commands starting with a space are omitted from the history, protecting sensitive inputs like passwords or API keys.
- Real-Time Synchronization: Maintains consistent history across multiple terminal sessions, enabling seamless transitions and collaboration.
By adopting these configurations, you can enhance productivity, improve security, and achieve better management of command history in your environment.
