Hello, everyone. When I booted into my linux desktop at home today,and logged on a root, I realized that almost all the history on my bash shell were not available. I checked .bash_history in the root directory and it only contains only the most recent commands I used from last night. All the other commands are gone. I am pretty sure I haven't deleted any of them and got suspicious b/c my computer was connected online allday yesterday downloading stuff. Now, my question is should I take this as an indication that my linux desktop box was rooted by some hacker? Or, am I being extremly paranoid? For the moment, I am not taking anything for granted and am back at my windows box.

Could you disconnect the Linux box and take a look at the logs?

try this topic for forensics and tools; I haven't had a chance to look thru them thoroughly yet.

-t.

Do "env | grep HIST": first thing I would look was at the HISTFILESIZE, HISTSIZE and HISTIGNORE environment variables, for the Bash shell they're set from /etc/profile. If you want to have root log everything make sure you unset those variables for root, make sure the permissions on the history file are restricted to user root only, chattr +a for append only and rotate the log at some convenient size/time to maintain record.