Working With Bash's History Feature
The popular de-facto standard GNU/Linux shell Bash has a handy history feature which stores the commands typed into a terminal. It is enabled by default; all the incriminating commands you type into a shell are stored in it's history file. This is useful if you need to repeat a command you typed earlier.
The File Full Of Incriminating Evidence
Bash's history file is defined by the variable
HISTFILE= which defaults to
It is possible to define a blank setting to this variable in
This will, in effect, turn Bash's history function off.
Using Bash's History
Simply pressing the ↑ key will fill the command-prompt with the previous command. Pressing it again will go to the next previous command. The ↓ key will move the history forward if you went too far back.
|ctrl+r||will trigger a "reverse-i-search of the history. You can type in parts of a previously typed command and it will show up.|
The "history" Command
Bash's history log and the $HOME/.bash_history file (or another file HISTFILE= points to if it is defined) can be manipulated by a built-in bash command called
history. This can be used to clear the history, read the global history file and add it's contents to the current shell (if you have two terminals open you can get the history from one in the other) and a few other things.
The arguments for
history, as laid out in the bash_builtins manual page, are:
||Clear the history list by deleting all the entries.|
||Delete the history entry at position offset. If offset is negative, it is interpreted as relative to one greater than the last history position, so negative indices count back from the end of the history, and an index of -1 refers to the current history -d command.|
||Delete the history entries between positions start and end, inclusive. Positive and negative values for start and end are interpreted as described above.|
||Append the ``new history lines to the history file. These are history lines entered since the beginning of the current bash session, but not already appended to the history file.|
||Read the history lines not already read from the history file into the current history list. These are lines appended to the history file since the beginning of the current bash session.|
||Read the contents of the history file and append them to the current history list.|
||Write the current history list to the history file, overwriting the history file's contents.|
||Perform history substitution on the following args and display the result on the standard output. Does not store the results in the history list. Each arg must be quoted to disable normal history expansion.|
||Store the args in the history list as a single entry. The last command in the history list is removed before the args are added.|
history with no arguments will list the current shell history with a number, date and the command which was typed into the shell.
The line numbers in the first row of
history's output (when ran with no arguments) can be used to remove history with the
-d argument. Using one line as an argument will only remove that particular line while
history -d 100-200 will remove history entries numbered between 100 and 200.
Clearing the history with
history -c will only remove the history from the current shell. It is NOT possible to combine
-w to clear the history and write it to the history-file; it is necessary to type
history -c ; history -w to clear it. You can, of course,
echo > $HISTFILE to clear the history file without clearing the shell's active history.
Bash will automatically read the history file when you open a new shell. Using
history -r is only required if you changed the history file in another shell and you want to append those commands to the current bash session. Logging in and typing
history -r will give you a long list of commands where all the commands in bash's history file are listed twice since it appends the commands in the history file to the current history list.
Bash will automatically append the current shell's history to it's history file when you log out of a currently active shell. This is the same as typing
history -a to append new history to the history file. The
-w option will not append the history to the history file. It will, instead, overwrite the history file with the current shell's history - removing any command typed in another shell.
Getting the history from one shell into another can be done by first either appending (
history -a) or over-writing (
history -w the history file with the current shell's history. The newly written history file can then be imported into other active shells with
history -r. You may want to clear the history list with
history -c before reading the history file with
Having all commands you typed stored in a file has some privacy-implications. Many computer-related forensic reports out of Sweden contain excerpts from
$HOME/.bash_history files - most of which are totally irrelevant to the case the clueless blundering idiots in that country's Police force are supposed to investigate.
export HISTFILE="" setting to prevent a permanent history to be written in
$HOME/.bashrc removes any privacy-related issues. Bash will still have a history in the currently active shell; accessing previous commands with the ↑ and ↓ arrow keys will work and a reverse history search with ctrl+r will also still work - but you will only get results from the commands typed into the currencly active shell.
What level of privacy you prefer is a very personal choice which is worth some consideration - specially if you are not using full disk encryption and you plan to bring a laptop through airport security or similar.