Ubuntu Server 18.04 – Understanding Bash history

Install PHP on CentOS 8

Speaking of history, let’s dive right into that concept. Bash keeps track of all the commands you enter, so that if you need to recall a previously entered command, you can definitely do so. History also serves another purpose, and that is seeing what other users have been up to. However, since users can edit their own history to cover their tracks, it’s not always useful for that purpose unless you have a spiteful user that is also sloppy.

You may have already seen Bash’s history feature in some form, if you’ve ever pressed the up and down arrows on the shell to recall a previously-used command. If you didn’t already know you can do that, you know now. Go ahead and give it a try, you should see that by pressing the up and down arrows you can cycle through commands that you’ve used previously.

Another trick is you can also simply type history in the shell and see a list:

Output from the hostname command

At this point, you can copy and paste a command used previously from this list. Actually, there’s an even easier way. Do you notice the number on the left of each command? We can utilize that number to quickly recall a previously used command. In my screenshot, item 100 is where I checked the status of the apache2 service. If I wanted to check that again, I can simply enter the following command:


In this case, I typed just four characters, and I was able to recall the previously used command, which was the exact same as typing this:

systemctl status apache2

That saves a lot of typing, which is great because we administrators want to type as little as possible (unless we’re writing a tutorial).

Let’s look at a few additional history commands we can use. First, if we want to delete something from the history, we can simply do this:

history -d 100

In this case, we can replace 100 with whatever the number is for the item we would want to delete. You may be wondering, “why delete something from the history?” and the answer to that is simple: sometimes we make mistakes. Perhaps we mistyped something, and we don’t want a junior administrator to look at the history and rerun an invalid command. Worse, if we accidentally saved a password to the history, it will be there for all to see. We would definitely want to remove that item so that the password isn’t saved in plain text in the history file. One very common example of this is with MySQL/MariaDB. When you enter the MySQL or MariaDB shell, you can use the -p option and type the password in one line. It would look something like this:

mariadb -u root -pSuperSecretPassword

That command may appear useful, because in one command you’d be logged in to your database server as root. However, this is one of my pet peeves—I really don’t like it when people do this. Having the root password in your shell’s history is a HUGE security risk. This is just one example of something you won’t want in our Bash history, though. My main goal here is to demonstrate that you should think about security when entering commands. If you have a potentially sensitive item in your command history, you should remove it. In fact, you can actually enter a command and not have it saved in the history at all. Simply prefix the command with a space. If you do, it will not be recorded in the history file. Go ahead, give it a try and see for yourself.

Having commands prefixed with a space ignored in Bash is actually a custom option enabled by default in Ubuntu Server. Not all distributions include this feature. If you’re using a distribution that doesn’t have this feature, add the following to your .bashrc file (we will talk about this file in greater detail later).

This configuration line also causes duplicate commands to not be entered into the history file as well, which can condense the history file.

So, you might be wondering, where is this history information actually stored? Check out the .bash_history file, which is found in your home directory (or /root for the root user). When you exit your shell, your history is copied to that file. If you remove that file, you’re effectively clearing your history. I don’t recommend you make a habit of that, though. Having a history of commands is very useful, especially when you may not remember how you solved a problem last time. History in Bash can save you from looking up a command again. To find out more about what the history command can do, check out its man page.

Comments are closed.