Re: bash: clean history on logout?

[matthew sporleder <msporleder%gmail.com@localhost>]

On Thu, Sep 1, 2011 at 10:43 AM, feralert <feralert%gmail.com@localhost> wrote:
> Hi all,
>
> I have a NetBSD 4.0 machine (a few actually) I have taken over from
> someone lately that doesn't keep bash history from one session to
> another. Everytime I logout it seems to delete the contents of the
> .bash_history file. When I login and check the last time modified date
> (with 'ls -l .bash_history') it is the same as my last logout time so
> I seems obvious that its clearing it somehow at logout.
>
> As this is not regular behaviour I would like to ask you how and why
> if possible (security?) you think he set this up to try to revert it.
>
> What i have tried so far is:
>
> - Check .bash_history is a regular file (not a link)
>    # ls -l .bash_history
>    -rw------- 1 root wheel 10282 Sep  1 12:26 .bash_history
>
> - And that the HISTFILE var points to the right file
>     # echo $HISTFILE
>     /root/.bash_history
>
> - looked for .bash_logout, but it doesnt exits.
>
> - checked in crontab but there is nothing there.
>
>
> I don't know where else to look so any help would be appreciated.

You can ktruss/ktrace (ktrace is more accurate) the shell in a
different tty and see what's happening.

When I logged out of a shell I got this in ktruss:

 1717      1 bash     open("/home/mememe/.bash_history", 0x9, 0x180) = 3
  1717      1 bash     write(0x3, 0x5eb408, 0xbc)  = 188
       "cd /usr/src/pkgsrc/www/\nls\ncd w3m\nls\nless Makefile\ncd
../\nls\ncd ../editors/joe/\nls\nless Makefile \ntop\nps au"
  1717      1 bash     close(0x3)                  = 0

You can see bash open my .bash_history and write some commands I typed into it.

Matt

p.s.

set|grep -i hist
BASHOPTS=cmdhist:expand_aliases:extquote:force_fignore:hostcomplete:interactive_comments:progcomp:promptvars:sourcepath

Also do you have any aliases?