0

I'm asking because mine is strangely short and I definitely didn't clear them. However I tried changing my username (because I got some errors which I thought were due to my hostname; tried to view the history to see how I did that to change it back) and I'm not sure if that could have caused the history to be cleared?

I'm running Debian 9.1 with KDE and $HISTSIZE variable is set to its default value.

(In the root history there are also 2 commands which I can't remember having executed: filemanager /var/mail/root and texteditor /etc/nsswitch.conf for which I'd like to view diffs using etckeeper.)

mYnDstrEAm
  • 4,008
  • 13
  • 49
  • 108
  • 1
    You could check the timestamp on file `/etc/nsswitch.conf` to try determine *when* the mysterious editing took place. Someone having cleared the root bash history suggests the server may have been compromised. – steve Aug 06 '17 at 18:13
  • @steve I don't know whether it was edited. I probably just forgot about opening it. The modification date says 3 August. Well if the history is kind of lost when changing one's hostname it wouldn't require cleaning. I'm just pretty sure that I executed more commands as root than shown after running `sudo -i` and `history` (if that really shows all the root history). It's not a server. – mYnDstrEAm Aug 06 '17 at 18:18
  • do you normally use the `filemanager` and `texteditor` commands? that's fairly uncommon IME - most people have a preferred file manager and/or text editor and run them directly rather than via a symlink or alias, or use a short alias to reduce the amount of typing. – cas Aug 07 '17 at 04:56
  • @cas Sorry for not making that clear enough: it's the filemanager and texteditor that I use. I probably opened them and forgot about it (and about how the contents of that nsswitch file looked like). I had plenty of problems with name resolution earlier so I would be interested in any changes to nsswitch. – mYnDstrEAm Aug 07 '17 at 11:30

0 Answers0