Disable bash History on Debian 12 for a Single User

Use coupon code: "antiforensics" for 20% off!

The Simplest single-user Method

While .bash_history is the default filename for storing command history in Bash, users can configure a different filename or location by setting the HISTFILE environment variable..bash_history can contain sensitive information such as passwords, API keys, and other confidential data if users inadvertently execute commands containing such information.

.bash_history can be a valuable source of forensic evidence in investigations involving system compromise or unauthorized access. Forensic analysts can analyze .bash_history to reconstruct the sequence of events leading to a security incident.

1. Spawn another shell ($ bash)
2. Use the command $ unset HISTFILE
3. Perform your operations
4. $ exit

user@debian:~$ bash
user@debian:~$ unset HISTFILE
user@debian:~$ ping google.com
user@debian:~$ exit

After choosing to exit the bash session, notice that the .bash_history file has not been updated.

The same operations can be performed for zsh.

Another Technique

user@debian:~$ bash
user@debian:~$ export HISTFILE=/dev/null
user@debian:~$ ping google.com
user@debian:~$ exit

The above ping operation is not saved to the .bash_history file upon exit of the bash shell as expected.

To make the changes permanent add unset HISTFILE or export HISTFILE=/dev/null to the end of the user .bashrc configuration file.