I'd like to catch events when bash history is cleaned or some lines are deleted. Are there any best practices or auditing tools with this capability?
Monitoring the Bash history is easily done with a shell script, but just checking it for unexpected changes might not be an effective security measure but rather clutter your logs with false-positives.
One obvious way to monitor file system events associated with your
.bash_history file would be by using the inotify API. E.g., this triggers on file modification events:
$ inotifywait -m -e modify ~/.bash_history
You could then compare the contents each time to determine changes, or just compare the number of lines to detect if entries have been deleted with a smaller overhead. (Just checking the file size won't work if the history has reached its maximum length and old entries are dropped.)
But note that it's trivial for an attacker to work around that. You have to expect that any reasonably skilled intruder immediately disables the history, rather than removing suspicious entries afterwards. Also, there are many cheap ways to bypass Bash entirely without provoking log entries (change to Bourne shell, execute from within vi, etc.).
Generally, I'd consider monitoring the Bash history for possible tampering too unreliable and error-prone to be a useful security measure. Instead, I'd first make sure to cover the logs where it's easier to identify security-relevant incidents (
I'm assuming that you want to detect when people have entered some kind of private information into their shell and are now trying to remove it from the bash history.
From an attacker point of view it would be easy to simply constantly create copies of the .bash_history file and check for entries being removed.
If you are doing this to prevent accidental data leakage I suggest that you solve this by policy and make users report such errors and invalidate the information. So if a password was entered accidentally the password should be changed.
If you really want to go ahead with this there are non-security related tools to monitor changes to files.
Edit: I think for detecting attackers wiping their tracks this is a pretty weak method as it is pretty easy to disable or avoid the bash history.