On Wed, Jun 26, 2013 at 6:27 AM, S. Dale Morrey <[email protected]> wrote: > Just curious but my bash history shows no commands where I've prefixed the > command with a space. > Is that a security hole, a design decision or is my version of bash screwed > up? > Seems like that would be sort of vital problem to overcome if you were > tracking a breakin.
It's a design decision, which can be toggled: http://www.linuxjournal.com/content/using-bash-history-more-efficiently-histcontrol But if I were an attacker, the bash history would be one of the first things I disabled and deleted. If you're trying to analyze a break-in, you'll have to rely on other tools. -- "In order to create, you have to have the willingness, the desire to be challenged, to be learning." -- Ferran Adria (speaking at Harvard, 2011) /* PLUG: http://plug.org, #utah on irc.freenode.net Unsubscribe: http://plug.org/mailman/options/plug Don't fear the penguin. */
