anchor@anchor-cyber:~$ cat cli-security-hygiene.md
Anchor Cyber Security
Anchor Cyber Security LLC

Linux CLI Security Hygiene

Command-line habits that prevent self-inflicted leaks — history, process visibility, and the shortcuts that make this easy to actually keep up.

$ cli-hygiene --history

Shell History Hygiene

Your shell history file is a plaintext log of everything you've typed — including anything sensitive you typed directly instead of piping in.

# dedupe history, and never log commands that start with a space
export HISTCONTROL=ignorespace:ignoredups

# now a leading space keeps a command out of history entirely
  curl -u admin:S3cr3tP@ss https://internal.example.com

# clear history for the current session
history -c

# confirm your history file isn't readable by other local users
chmod 600 ~/.bash_history
Worth knowing: HISTCONTROL=ignorespace only works if you remember the leading space every time. For anything genuinely sensitive, prefer a credentials file with restricted permissions or an environment variable over typing a secret directly on the command line at all — see below.
$ cli-hygiene --process-list

Don't Leak Secrets Through the Process List

Command-line arguments aren't private — any other local user can see them.

# anyone on this box can read the password you just typed
mysql -u admin -pS3cr3tP@ss

# while that process runs, this reveals it to any other user
ps aux | grep mysql
Instead:
prompt for the password interactively, read it from a restricted-permission file, or pass it via an environment variable set in a way that doesn't appear in ps output
$ cli-hygiene --reverse-search

Reverse Search & Shortcuts

The one that doesn't get covered enough: reverse-i-search. If you're retyping commands you've already run, you're wasting real time every day.

Reverse search
  • Ctrl+R — start reverse search, type any substring of a past command
  • Ctrl+R again — cycle to the next older match
  • Enter — run the matched command
  • Ctrl+G or Esc — cancel and return to an empty prompt
Worth knowing alongside it
  • !! — re-run the last command
  • !$ — reuse the last argument of the previous command
  • Ctrl+A / Ctrl+E — jump to start / end of the line
  • Ctrl+U — clear the line before the cursor
$ cli-hygiene --screen

Safe File Viewing & Screen Hygiene

Small habits that keep sensitive output from lingering where it shouldn't.