11 ms·
Bashhub – Bash History in the Cloud
- bahador 11y agoI like the idea a lot, but the security implications of this are scary. May as well just do a cloud based key stroke recorder.
- rcaloras 11y agoIn defense, you're not recording keystrokes. Simply taking bash history which is already recorded locally and moving it to the cloud.
- nullrouted 11y agoYou are giving all your bash history to a third party, that is incredibly scary and if you can't see the security implications then you need to rethink your product.
- rcaloras 11y agoAgree privacy is a concern. You can configure what you do and don't send as well.
- lathiat 11y agothe problem is, theres a pretty good chance people will still send all sorts of passwords and access credentials. that's a big liability if you get exploited. should you do this? no.. but people do, all the time.. take for example this MySQL bug report with many complaints that the command now issues a warning when you specify a password on the command line: https://bugs.mysql.com/bug.php?id=66546 https://bugs.mysql.com/bug.php?id=66546
- nullrouted 11y agoSeriously I don't think you really understand the implications here or you aren't taking them seriously, if you did you sure wouldn't be talking about this so nonchalantly. You should seriously shut this down before you get some young programmers/admins fired or worse. Also from your FAQ what the hell is "strong level encryption", can you not name it? Can you go into the extreme technical details of what encryption you are using, how data is protected in memory and at rest?
- Terretta 11y agoThe FAQ says 'storage level encryption' which presumably means volume encryption, but in any case is unlikely to protect against anyone gaining access to the box, only against someone making off with the physical storage.
- heyrhett 11y agochattr +a ~/.bash_history
- voltagex_ 11y agoWhat does this do?
- fabulist 11y agoAfter some experimentation, it makes a file impossible to delete. Very clever, +1.
- voltagex_ 11y agoI wonder if this solves the issue of multiple bash instances clobbering history.
- dllthomas 11y agoFrom the bash manpage: If the histappend shell option is enabled (see the description of shopt under SHELL BUILTIN COMMANDS below), the lines are appended to the history file, otherwise the history file is overwritten. histappend If set, the history list is appended to the file named by the value of the HISTFILE variable when the shell exits, rather than overwriting the file.
- voltagex_ 11y agoI always seem to get this wrong or forget to set it up in my bashrc. I'll add it to my dotfiles repo, thanks.
- voltagex_ 11y agohttp://askubuntu.com/a/80380/288724 http://askubuntu.com/a/80380/288724 looks like it might be my issue, specifically > The bash session that is saved is the one for the terminal that is closed the latest.
- rcaloras 11y agoCreator here! Wow, didn't think this would get posted on HN all of a sudden. Would love to hear your feedback or ideas, I'm very actively developing the project. ryan@bashhub.com
- voltagex_ 11y agoThe security implications are terrifying.
- dllthomas 11y agoI'd hope not. What winds up in your bash history? [In case it wasn't clear, above was mildly tongue-in-cheek; secrets should not be in your bash history, but of course things approaching (and including) PII may well be]
- voltagex_ 11y agoIf I accidentally hit enter too soon on a sudo command - parts of my password. Also accidental pastes from other windows occasionally.
- dllthomas 11y agoI expect I might take more care about maintaining a tidy history (see my other comment about splitting out separate histories by context), and reflexively clear bits of my history when I don't want them hanging around in the way of a ctrl-r - which would certainly include bits of passwords and anything pasted. That said, this seems to use PROMPT_COMMAND to log off history, which would not give the opportunity for such tidying. Worrisome.
- voltagex_ 11y agoI can't see your comment about splitting history - this sounds like something I'd use, though.
- voltagex_ 11y ago>#ignore added to any command will omit it from being saved. Simply add it to the end of any command and it won't be recorded in Bashhub. A space at the start of the command will do the same in Bash itself - with this work for bashhub?
- rcaloras 11y agoYes, if you configure your history to ignore space. It won't be put in Bashhub. Actually just added a filter command as well. You can export BH_FILTER="some-regex" and it'll ignore all those commands. Just released in 0.0.14!
- rcaloras 11y agohttps://github.com/rcaloras/bashhub-client#filtering-commands https://github.com/rcaloras/bashhub-client#filtering-command...
- dllthomas 11y agoThis is very interesting. Somewhat related, by far my biggest history-related usability/efficiency win has been to separate out different history files for different contexts.
- 0fx 11y agoThere are people who use bash enough--and in such a way--that they'd benefit from this kind of .bash_history backup and analysis. There are people who would not be wary of sending this kind of information remotely to be stored by someone else. But I think the intersection of these types would be small.
- shaan7 11y agoWell, the people in the first category will usually be smart enough to setup a sync without using an external "cloud service".
- porker 11y ago> Well, the people in the first category will usually be smart enough to setup a sync without using an external "cloud service". Apart from some, like myself. How would you go about it, given the need for 2-way sync? I've ruled out rsync, could see Git working but not particularly performant to run every 20 seconds to keep the history in sync between machines.
- deadbunny 11y agoI use git to sync my dotfiles (pulled in by SaltStack because I'm crazy enough to put my workstations under config management) I just have a script that does a git commit -am "automated push on $(date)" that triggers when I lock my screen. It's not perfect but it works well enough for my needs, though I don't sync my bash history.
- mynewtb 11y agoSyncthing
- gruez 11y agoI might be okay with this if the data was encrypted client side prior to upload.
- bariumbitmap 11y agoHow does it compare to shellsink? https://github.com/joshuacronemeyer/shellsink https://github.com/joshuacronemeyer/shellsink (Besides being actively developed.)
- saurik 11y agoI have routinely kept my history "best effort" for many many years now by exporting HISTSIZE=10000 and HISTFILESIZE=1000000, and then occasionally doing a cp -a ~/.bash_history{,-$(date +%s)}. I actually use this history archive, and wish it was higher fidelity. (In practice, I am thinking I should just run all my sessions through script... ;P.) http://man7.org/linux/man-pages/man1/script.1.html http://man7.org/linux/man-pages/man1/script.1.html I have thereby had it on my todo list for a month or so, ever since I learned of the bash DEBUG trap, to instead store my history into an sqlite3 database and have it separated by host. Seeing this reminded me "oh yeah, I really should do that" (as no: there's no way in hell I'm going to just send all of the commands I type to some random guy with a website ;P). This is "the simplest thing that could possibly work" and might very well break if you set some crazy history configuration variables I don't use. Note that it works for pipes specifically and only because it can overwrite the same entry to the database multiple times using "insert or replace" (prevention of which is what normally makes these scripts so complex). histsql=~/.bash_sqlite3 sqlite3 "${histsql}" ' create table if not exists "session" ( "id" integer not null primary key autoincrement, "address" text not null, "process" integer not null, "tty" text not null, "user" text not null, "start" timestamp not null default current_timestamp, "end" timestamp null ); create table if not exists "command" ( "session" integer not null, "line" integer not null, "time" timestamp not null default current_timestamp, "pwd" text not null, "text" text not null, primary key ("session", "line") ); ' histmac=$(ifconfig | sed -e 's/ *$//; /\(ether\|HWaddr\) / { s/.* //; q; }; d;') histtty=$(tty) histssn=$(sqlite3 "${histsql}" " insert into \"session\" ( \"address\", \"process\", \"tty\", \"user\" ) values ( '${histmac//\'/''}', '${$//\'/''}', '${histtty//\'/''}', '${USER//\'/''}' ); select last_insert_rowid(); ") function histend { sqlite3 "${histsql}" " update \"session\" set \"end\" = current_timestamp where \"id\" = '${histssn//\'/''}'; " } trap histend EXIT function histadd { local data="$(HISTTIMEFORMAT= history 1)" if [[ -z $data ]]; then return; fi data="${data#"${data%%[![:space:]]*}"}" local line="${data%%' '*}" data="${data#*' '}" data="${data#"${data%%[![:space:]]*}"}" sqlite3 "${histsql}" " insert or replace into \"command\" ( \"session\", \"line\", \"pwd\", \"text\" ) values ( '${histssn//\'/''}', '${line//\'/''}', '${PWD//\'/''}', '${data//\'/''}' ); " } trap histadd DEBUG
- TurboHaskal 11y agoWeird that one would agree to that. I don't even store my shell history on private computers.
- dllthomas 11y ago"I don't even store my shell history on private computers." Any particular reason for that? It seems devastating to usability, for unclear benefit...
- TurboHaskal 11y agoIt was the default behavior on OpenBSD's pdksh and my paranoid self grew to like it. I view abusing your shell history as a symptom of lack of automation and functions/aliases. Results May Vary, but in a way it made me more organized.
- _alex_ 11y agoIf you rely on your shell history to the level that you need synchronization via a cloud-based service, it should be a signal that your automation needs work.