3

My modified search history lines have an asterisk next to them.

I've searched unix.stackexchange.com and stackoverflow.com, but I yearn for a full explanation for the asterisks in my history (other than what the man page says).

Lines listed with a * have been modified.

Example:

$ history | tail
11850*
11851  ./block_ip.sh '23.228.114.203' 'evil probe'
11852  ./block_ip.sh DROP '23.228.114.203' 'evil probe
$

In this example, a shell script had a third argument, but there was no error, and i ran it twice without specifying (DROP/ACCEPT).

The modification was an attempt to blank out this history so that history-expansion would not lead me to the wrong command (again).

I want to know more about this (but I don't know what I don't know).

Please consider both angles of this:

  • how can i use this (for instance can i get that original command if i need it)?
  • how can a bad guy use this (can someone hide their command history this way)?

If a generic answer is too verbose, please note some of my settings:

EDITOR=/usr/bin/vim
HISTFILE=/home/jim/.bash_history
SHELLOPTS=braceexpand:hashall:histexpand:history:interactive-comments:monitor:vi

And this OS info (It is RedHat...but Debian/Fedora/Ubuntu shouldn't vary much...should they?):

Linux qwerutyhgfjkd 3.10.0-693.11.1.el7.x86_64 #1 SMP Mon Dec 4 23:52:40 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

I am using bash as my shell.

WEBjuju
  • 506
  • 1
    The history command is not part of the standard and since your described behavior does not look like a usual behavior, you would need to explain which shell you are using and under which circumstances you observe the behavior. – schily Jun 07 '18 at 09:46
  • 1
    The HISTFILE and SHELLOPTS variables there are fairly good clues as to the shell, although the question really should be edited to make this explicit. – JdeBP Jun 07 '18 at 14:41
  • I am using bash. – WEBjuju Jun 07 '18 at 15:13

1 Answers1

5

This similar question has two related answers.

Specifically:

As explained in the Bash manual, history lines prefixed with a * have been modified. This happens when you navigate to a command (e.g. by using the Up key), edit it and then navigate away from it without hitting Enter. ... BTW, you can revert modified commands to their unedited state by navigating to them and hitting Ctrl + _ repeatedly.

Answered here by Eugene Yarmash

This answer shows how to disable it by disabling mark-modified-lines with:

set mark-modified-lines Off

As for your question regarding whether someone could hide their command history in this way, you can see that it's possible to set mark-modified-lines as well as revert to the original command line. So it is both possible to hide or change the history and to revert it. That being said, what is the threat model for a user hiding their history? Who is the user? In an administered environment, a user should only have access and permissions for the functions and files that are related to their role. Otherwise, if an unauthorized user has gained access, then finding modified command lines may be the least of an admin's worries.

Joey Dodson
  • 66
  • 1
    Thanks, I can never remember this command or how to find it :)

    WRT the threat model... Advanced Persistent Threats and insider abuse are two cases in which history modification and deletion have been found and can be used to provide some cover.

     – Rondo Feb 13 '23 at 04:23