glowbase/nix_dfir

Fix Bash History

Closed this issue · 5 comments

Bash history doesn't correctly list for some users.
image

@solix414, still doesn't work in some cases. Wondering if you wanted to have a try at fixing this.

i'll give it a look yea

issue appears to be just because history hasnt been generated yet, just logged in as the postgres user to populate the history file and upon exiting a history file was generated and the script could pick it up, the administrator,,, user is the strange one because it appears to be misreporting postgres as 2 accounts?

I fixed this issue with the following amendment on line 541

if [ "$shell" == "zsh" ]; then

The shell of each user needs to be pulled and the history file taken based on this value. Instead of checking purely if the file exists or not.