Any way to delete entree from .sh_history?

[Jorge Fabregas]

Hello everyone,

Is there a safe way to delete a line from the .sh_history? Don't worry guys, I'm not planning to wipe-out evidence of evil attemps >:)

The situation is this: Some Oracle consultants are working on my server. Sometimes I log in with their oracle account, do some stuff, for example I connect to my personal system etc, and after I log out I don't want to leave this info available in the user .sh_history.

I edited the .sh_history file with vi...deleted the two lines in question...and then I saved it. I log out..went back in again, and I had no HISTORY. It got corrupted. I created a copy of the file first though. I had to put it again.

Thanks in advance,
Jorge

[sinhass]

Hi Jorge,

I could try with changing the default shell to bourn shell just typing #sh and doing all. But I think that all those are stored in pacct file. Can anyone pls tell what the file if I am wrong.

-sinhass

[Robert-Jan Goossens]

Hi Jorge,

After you login re export the HISTFILE

# touch $HOME/.sh_history_root

# export HISTFILE=$HOME/.sh_history_root

Hope this helps,
Robert-Jan

[Jorge Fabregas]

Hello Sinhass,

I don't want to change the shell from POSIX..

Thanks.

Hi Robert-Jan,

Thanks for your comments. Your answer doesn't work. The HISTFILE declaration is in the user .profile so I don't see any reason to specify it again. About touch...why touch? Touch will only modify the "mtime" of the file.

I know it is corrupted because (when I log back in) because when I use the "k" letter to scroll up on the history..it won't work (I also have "set o vi" by default).

Jorge

[Jeff Schussele · Accepted solution]

Hi Jorge,

Yep - *any* edits of the .sh_history file will cause a corruption. It's a security "feature". This is deliberate & is caused because it's not a "pure" ascii text file even though the file command reports it as so. If you more out the file you'll see ^B, ^A, ^K & even ^Y scattered throughout the file in a specific pattern. Any edits will alter that pattern & essentially make the history file useles & *that's* the clue that it's been modified. I'm afreaid you're out of luck as I know no way around this.

Rgds,
Jeff

[Robert-Jan Goossens]

Hi Jorge,

What I tryed to say was, create a seperate history file for each admin. :-)

Geoff Wild answer from last year.

----

Here's a cool thing to do if you have multiple admins who su to root.

In root's .profile, add:

# Set up logging
HISTFILE=${HOME}/.sh_history_`who am i|awk '{ print $1}'`
date >>$HISTFILE
export HISTFILE
HISTSIZE=500
export HISTSIZE

This creates a seperate .sh_history file for each admin - for example, mine is:

.sh_history_gwild

Rgds...Geoff

----

You should be able to edit the old .sh_history file and remove the commands you would like to dissapear with vi.

Hope I did explain myself a bit better.

Kind regards,
Robert-Jan

[Jorge Fabregas]

Hello Jeff,

Thanks! That's what I was looking for!

Yes, I knew that the .sh_history wasn't completely ASCII and I never figured out the reason for having special characters there. Now I know.

It bothers me the fact that this never crossed my mine (file corruption on purpose) for security issues :)

Thanks a million!
Jorge