Command History

Command History

The shell remembers every command you type. This is one of your most powerful productivity tools — and one of the first things a security analyst checks on a compromised system.

Quick Reference

The History File

When you log in, bash loads your saved history from ~/.bash_history. As you type commands, they’re added to an in-memory list. When you log out, the in-memory list is appended to the file.

$ cat ~/.bash_history
ls -la
cd /etc
cat hostname
pwd
cd ~

Using !! and !n

The ! character is called “bang” by programmers (because it looks like an exclamation point). So !! is called “bang-bang.” It repeats your most recent command. The most common use:

$ apt update
E: Could not open lock file (Permission denied)
$ sudo !!
sudo apt update
[sudo] password for student:

!n repeats command number n from your history:

$ history
  ...
  47  ls -la /var/log
  48  cd /etc
  49  cat hostname
$ !47
ls -la /var/log

Reverse Search with Ctrl+R

Press Ctrl+R, then start typing part of a command. The shell finds the most recent match:

(reverse-i-search)`grep': grep -r "error" /var/log/syslog

• Press Ctrl+R again to find the next older match
• Press Enter to run the found command
• Press Ctrl+C to cancel and return to a blank prompt
• Press Right arrow to edit the found command before running

Security Implications

Your command history is stored in plain text. On shared servers:

• Never type passwords directly in commands
• API keys in commands get saved to history
• Attackers check ~/.bash_history early in reconnaissance
• On some systems, typing a space before a command prevents it from being saved to history

Key Takeaways

1. Use history to avoid retyping. !!, !n, and Ctrl+R save time.
2. History proves you did the work. The autograder checks your history.
3. History is a security surface. Never put secrets in commands.