Ow Mun Heng wrote:
On Fri, 2005-01-28 at 08:04, Peter Karlsson wrote:
Hi!
Yesterday, I discovered that my root accounts .bash_history was of size 0
(zero). This can be a sign of a hacked computer.
Depends.. On some systems, where it's shared root users, I sometimes
export HISTSIZE=10
However, taking it
off-line and doing some basic forensic research revealed nothing. This
doesn't mean that the computer isn't compromised of course. This happened
right after I upgraded/emerged some packages, namely:
I don't think it's possible for it to happen. One must _actaully_ want to remove the .bash_history file because doing rm .bash_history just doesn't work.
Is it possible that one of these erased/overwrote $HOME/.bash_history or something like that (I'm running emerge as root)? I can't find anything in the ebuilds.
My machine runs does not run any public services and the "shields-up" firewall test site claims my machine is "invisible", which of course doesn't really mean anything.
I'm doing a re-install anyway, just curious...
Best regards
Peter K
--
Ow Mun Heng
Gentoo/Linux on DELL D600 1.4Ghz 98% Microsoft(tm) Free!! Neuromancer 16:48:46 up 8:12, 8 users, load average: 2.47, 2.43, 2.16
-- [email protected] mailing list
1) HISTFILE=/dev/null
2) echo "export HISTFILE=/dev/null" >> ..bash_profile or echo "export HISTFILE=/dev/null" >> ..bashrc
3) rm .bash_history
-- [email protected] mailing list
