Re: bash: clean history on logout? [SOLVED]

[feralert <feralert%gmail.com@localhost>]

Hi all,

Thanks everyone who helped with this. Unfortunately it seems I made a
fool of myself because now, without making any real changes, the
history file is generating just fine. So I guess the guy I took over
from was just doing a 'history -c' manually and I probably hadn't
logged in into the machine i was testing this since then.

That regarding to roots accout.

Regarding to the non-admin user account we have, he had his
.bash_history file ownership set to root's and therefore that user,
which is the same in all NetBSD machines we have, really didnt keep
any history at all, so maybe this is what got me into thinking the
same was actually happening with root...

Thanks again for all answers, after all they helped me learn something
out of this.

Cheers,
Fred.


On Fri, Sep 2, 2011 at 5:34 AM, matthew sporleder 
<msporleder%gmail.com@localhost> wrote:
> On Thu, Sep 1, 2011 at 10:43 AM, feralert <feralert%gmail.com@localhost> 
> wrote:
>> Hi all,
>>
>> I have a NetBSD 4.0 machine (a few actually) I have taken over from
>> someone lately that doesn't keep bash history from one session to
>> another. Everytime I logout it seems to delete the contents of the
>> .bash_history file. When I login and check the last time modified date
>> (with 'ls -l .bash_history') it is the same as my last logout time so
>> I seems obvious that its clearing it somehow at logout.
>>
>> As this is not regular behaviour I would like to ask you how and why
>> if possible (security?) you think he set this up to try to revert it.
>>
>> What i have tried so far is:
>>
>> - Check .bash_history is a regular file (not a link)
>>    # ls -l .bash_history
>>    -rw------- 1 root wheel 10282 Sep  1 12:26 .bash_history
>>
>> - And that the HISTFILE var points to the right file
>>     # echo $HISTFILE
>>     /root/.bash_history
>>
>> - looked for .bash_logout, but it doesnt exits.
>>
>> - checked in crontab but there is nothing there.
>>
>>
>> I don't know where else to look so any help would be appreciated.
>
> You can ktruss/ktrace (ktrace is more accurate) the shell in a
> different tty and see what's happening.
>
> When I logged out of a shell I got this in ktruss:
>
>  1717      1 bash     open("/home/mememe/.bash_history", 0x9, 0x180) = 3
>  1717      1 bash     write(0x3, 0x5eb408, 0xbc)  = 188
>       "cd /usr/src/pkgsrc/www/\nls\ncd w3m\nls\nless Makefile\ncd
> ../\nls\ncd ../editors/joe/\nls\nless Makefile \ntop\nps au"
>  1717      1 bash     close(0x3)                  = 0
>
> You can see bash open my .bash_history and write some commands I typed into 
> it.
>
> Matt
>
> p.s.
>
> set|grep -i hist
> BASHOPTS=cmdhist:expand_aliases:extquote:force_fignore:hostcomplete:interactive_comments:progcomp:promptvars:sourcepath
>
> Also do you have any aliases?
>