Hide single argument from bash history

Question

Is there a way to hide a single argument passed into the terminal, but still pass the argument to the command?

This question addresses the problem of passing a plain-text password through the shell.

But, even if not a password, there is a use for selective arguments to be hidden from CLI history, including personal information as might be used in LDAP (other than passwords).

So, is there anything like this:

command :

program argument1 argument2 {{argument3}} argument4

history :

program argument1 argument2 {{}} argument4

...as such, argument3 would pass to the program, but appear as {{}} in BASH history?

Rephrased, can we flag a specific argument for in-line redaction?

If this is not possible, is there an RFC on why it should not be?

Answer 1

I don't think Bash has a feature for hiding a single command line argument. It seems a rather narrow case, and considering how almost every special character has some use already (either in the shell, or in tools run from the shell), it'd also be hard to choose a syntax for it.

But, Bash does have the feature of excluding whole commands starting with a space from history entirely. That's not exactly what you're asking, but at least the space is easier to type. You can enable that by setting HISTCONTROL=ignorespace, or HISTCONTROL=ignoreboth. (I seem to have ignoreboth enabled on most systems I use, but I'm not sure if it's on by default generally.)

Or, you could use the more general exclusion mechanism and set HISTIGNORE=" *" to emulate ignorespace, or come up with some pattern that matches the particular command you use to exclude it regardless of the space.

---

That said, if you tend to pass sensitive data in command line args, it might be a good idea to just not store the command history in a file at all (unset HISTFILE). Otherwise, you run the risk of forgetting to mark the command/arg for exclusion. Also, the command line of a running process is usually visible to all users on the system, which should be equally an issue for any other sensitive data than just passwords, though of course there are other ways to limit that problem.

Answer 2

In bash you would set

HISTIGNORE="*commandhere*"

For example, the following will exclude fortune from the history, but will store fortune -l:

HISTIGNORE="*secret.server.com*:ytalk*:fortune"

source