.bash_history in /

[vickey_20]

Hey there
I open this file .bash_history in /. It showed some command but don understand who executed it as every user has it own .bash_history in there respective home directory.

[devils casper]

Thats a history file of root user. Which distro are you using?
Execute commands after gaining root privileges using su - and check if it updates /.bash_history file.

su -
fdisk -l
exit

[i92guboj]

I am not that sure about that.

At least according to the bash man page, the default value for HISTFILE is "~/.bash_history", which for root would translate into "/root/.bash_history" on most linux systems.

I also have that file in there, but sincerely I don't know where it comes from. If I issue commands as root they are not added inside that file. And I've even tried to set a watch on the file, and it doesn't report any program using it no matter what do I do as root.

inotifywait /.bash_history -m

fuser and lsof don't report anything about it, either. Though that was expected.

The only thing I can think of is that it's some kind of leftover from when I installed my Gentoo. Maybe $HOME is set to / when you do chroot, I don't really know and it's hard to google for that because you only get manuals, howtos and questions about how to use chroot to confine users to their home dirs.

[vickey_20]

I issued the command pointed out by DC but it doesn't seem to update the file. I logged out and logged in again opened the file but it was intact, nothing changed.But some command in the file which were present from before seems to be executed by me. I m confused now???

[Jonathan183]

The only thing I can think of is that it's some kind of leftover from when I installed my Gentoo. Maybe $HOME is set to / when you do chroot, I don't really know and it's hard to google for that because you only get manuals, howtos and questions about how to use chroot to confine users to their home dirs.

On my gentoo install I think it contains commands used when I first chrooted during the install. I have chrooted on several occassions since then and the contents have not been updated.

[i92guboj]

On my gentoo install I think it contains commands used when I first chrooted during the install. I have chrooted on several occassions since then and the contents have not been updated.

That doesn't make much sense to me. Chroot to /?

If you chroot into another place the the history file would be created wherever you are chrooting, not in your real / (if my theory is correct).

[Jonathan183]

Last time I built Gentoo on my desktop system I did it using my existing Arch install.
I started at the beginning of January 09 (first entry in /var/log/emerge.log). I have lots of entries in /var/log/emerge.log throughout January for building X, kde, openoffice etc.
The /.bash_history file is dated 01 February 09 and only has a couple of entries ...

env-update
source /etc/profile
export PS1="chroot (gentoo) $PS1"
emerge dhcpd
nano /etc/conf.d/net
rcupdate add net,eth0 default
rc-update add net,eth0 default
emerge dhcpcd
rc-update add net.eth0 default
lspci
cd /usr/src/linux
make menuconfig
make && make modules_install
cp arch/i386/boot/bzImage /boot/kernel-install
exit

because of the mis-typing I'm sure its stuff I typed

Anyway it looks as though these entries have been generated before booting from Gentoo. One of the first things I do after booting is create a normal user (and I have dates around 3 Feb 09 for .fluxbox .bash_logout .bash_profile etc).

Ed: root of Arch does not have a .bash_history file, neither does CentOS, or Crux ... interesting as you chroot during Crux install