LinuxQuestions.org - Erasing logs/Clearing Cache

Page 1 of 2

Show 50 post(s) from this thread on one page

- Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)

- - Erasing logs/Clearing Cache (https://www.linuxquestions.org/questions/linux-security-4/erasing-logs-clearing-cache-686204/)

SaraiKhan

11-26-2008 12:28 AM

Erasing logs/Clearing Cache

How can I delete my own information from my computer of a day's work.
For example, I reckon, bash stores some "history" of commands, firefox cookies and many other programs other stuff. I want to clean it all, after ending each session, including logs. Is this even possible?

Disillusionist

11-26-2008 01:58 AM

Firefox is easy.

From within Firefox:

Select Options from the Tools drop down menu
Click the Privacy icon (top of the options page)
Set the options you want and click OK

Bash history can be erased with:

Code:

history -c

SaraiKhan

11-26-2008 02:58 AM

Thanks, what other logs can there be stored on a linux system?

wit_273

11-26-2008 03:07 AM

You can remove logs from /var/log/ or edit /etc/logrotate.conf to rotate your logs daily and not keep any old logs. I would advise against either option though. If you have a problem the logs can be very helpful in resolving the problem.

unSpawn

11-26-2008 12:22 PM

There's more logging at the network, system and user level. Like wit_273 already said you should not want to remove logging at the system level: not only can it hamper solving problems but for instance cleaning out wtmp (which certain crackers would do) skews your auditing. (And while you may be able to control LAN logging you certainly won't be able to control WAN logging if any.) As for the user part the Firefox approach only works with some apps. Others may store configuration and previously opened files history in one or more files and they don't necessarily need to be plaintext. Luckily the user part can easily be solved by yourself: just create a new profile then checksum it before using. After you used the account and logged out again, checksum everything again. That'll display all alterations but it's up to you to mark them as (not) suspicious.

Once paranoia sets in you might wonder why you aren't running a distro or at least the account strictly from RAM...

SaraiKhan

11-26-2008 09:45 PM

Quote:

Originally Posted by unSpawn (Post 3355591)

Can you be more specific about the "profile" stuff? Pofile for what?
I was also considering removing the writing head of a HDD ...

Disillusionist

11-27-2008 01:51 AM

Why not remove the HDD altogether and run from a Live CD?

That way no information would be modified.

SaraiKhan

11-27-2008 07:08 AM

Quote:

Originally Posted by Disillusionist (Post 3356379)

Why not remove the HDD altogether and run from a Live CD?

That way no information would be modified.

Well, it's slower ... I could use a HDD as a USB DISK, but it is more slower in day to day work.

unSpawn

11-27-2008 12:13 PM

Quote:

Originally Posted by SaraiKhan (Post 3356174)

Can you be more specific about the "profile" stuff? Pofile for what?

For profile read user account?

Quote:

Originally Posted by SaraiKhan (Post 3356174)

I was also considering removing the writing head of a HDD ...

You gotta be kidding me...

s0ldat

11-27-2008 02:51 PM

Modify this script by adding to OBJECT variable any files or directories you want to remove. Run any time you want to clean private data.

Code:

# Remove files/directories



cd  ${HOME}

for OBJECT in .bash_history .lesshst .viminfo .cache

do

if [ -e ${OBJECT} ]

then rm -rf ${OBJECT}

fi

done

tredegar

11-27-2008 04:01 PM

@SaraiKhan
Why are you so paranoid?
You can delete cookies and histories and logs from your computer, but your ISP will be logging everything you read, post or email, and there is nothing you can do about that.

win32sux

11-27-2008 04:40 PM

Quote:

Originally Posted by tredegar (Post 3357100)

your ISP will be logging everything you read, post or email, and there is nothing you can do about that.

You could use Tor for that.

But yeah, I'm with unSpawn's comment in post #5. At this level of paranoia, you shouldn't be using the HDD at all. If you don't like live CDs cuz the speed sucks, then use a ramdisk-based distro. Or like unSpawn hinted at, at least use a ramdisk for the account you are paranoid about. I'd suggest running the whole thing from RAM without swap. But if you need swap, you should definitely encrypt it with a random key each time.

tredegar

11-27-2008 05:18 PM

Quote:

You could use Tor for that.

I expect you could.
I am all for freedom, privacy and non-intrusion from governments.

But SaraiKhan has a linux login & password that gives him / her some reasonable security.
Why isn't that sufficient?

win32sux

11-27-2008 06:08 PM

Quote:

Originally Posted by tredegar (Post 3357152)

I expect you could.
I am all for freedom, privacy and non-intrusion from governments.

Well, your "there is nothing you can do about that" made it sound like you weren't aware of the options available to prevent ISP snooping.

Quote:

But SaraiKhan has a linux login & password that gives him / her some reasonable security.
Why isn't that sufficient?

Only SaraiKhan could say what's sufficient for him. I would imagine that he's concerned that someone who gets their hands on the hard drive might also gain access to personal information stored on it. This is something which encryption and/or working from RAM (ie, not writing personal information to disk in the first place) can help with. The GNU/Linux username/password scheme wouldn't provide any protection at all in such a case.

SaraiKhan

11-28-2008 10:03 AM

win32sux is right. I do not want people gaining access to my hdd. The user/password scheme might not be sufficient for that. I considered encrypting my entire hdd, or at least the partition that root runs on. Also ... how safe is TOR?

P.S. How do I checksum the entire user profile as unSpawn mentioned?

All times are GMT -5. The time now is 04:36 AM.

Page 1 of 2

Show 50 post(s) from this thread on one page