Is command history secure?

You have encountered a problem using Far Manager? Here you can get help.
Post Reply
ph0enix
Posts: 3
Joined: Mon 06 Nov, 2017 11:30
Has thanked: 2 times

Is command history secure?

Post by ph0enix » Mon 06 Nov, 2017 11:36

Hello,

I have multiple user accounts on my PC. Under one of these accounts I have issued commands, containing sensitive information (passwords). I tried logging in under different account and Far does not display sensitive commands.

But I wonder how Far stores command history? Is it possible that someone can acquire command history from hard drive itself? Or by logging in as a different user and analyzing Far directory on the drive?

Thanks!

User avatar
DrKnS
Posts: 5064
Joined: Thu 04 Aug, 2005 06:44
Location: Kyiv
Has thanked: 5 times
Been thanked: 178 times

Is command history secure?

Post by DrKnS » Mon 06 Nov, 2017 11:50

It is stored in your local profile directory unencrypted, i.e. it is as safe as your whole profile and could be retrieved by any other user with administrative privileges or directly from the hard drive under another operating system.
You would need some external encryption to truly protect your data.

User avatar
HaRT
Moderator
Posts: 8536
Joined: Tue 30 Aug, 2005 17:21
Location: Санкт-Петербург
Has thanked: 75 times
Been thanked: 138 times

Is command history secure?

Post by HaRT » Mon 06 Nov, 2017 12:07

ph0enix, FAR stores all its own histories in the history.db SQLite database in its local profile directory. To protect the stored commands, you may wish to set the Encrypted attribute of the file (caveat: you'll lose the data if you forget your password).
Фар есть инструмент, а не нянька. © 2009 DrKnS

ph0enix
Posts: 3
Joined: Mon 06 Nov, 2017 11:30
Has thanked: 2 times

Is command history secure?

Post by ph0enix » Mon 06 Nov, 2017 12:29

Hm, that's bad. I wonder if I encrypt this file, how Far will be able to access it? Additionally, there are a couple more files history.db-shm and history.db-wal. I wonder if these need to be encrypted too, it might be cache or backup of history.

I wonder if there is a guide or best practice about securing Far command history?

User avatar
HaRT
Moderator
Posts: 8536
Joined: Tue 30 Aug, 2005 17:21
Location: Санкт-Петербург
Has thanked: 75 times
Been thanked: 138 times

Is command history secure?

Post by HaRT » Mon 06 Nov, 2017 14:49

ph0enix wrote:
Mon 06 Nov, 2017 12:29
if I encrypt this file, how Far will be able to access it?
If you do it via the Encrypted attribute, the access will be transparent to any application running with your user account (and no other user accounts). I don't know about the system accounts though. You might wish to read Microsoft documentation or some tutorials on NTFS encryption.
Фар есть инструмент, а не нянька. © 2009 DrKnS

ph0enix
Posts: 3
Joined: Mon 06 Nov, 2017 11:30
Has thanked: 2 times

Is command history secure?

Post by ph0enix » Mon 06 Nov, 2017 15:26

Ah, cool, then I will encrypt whole folder, to make sure no bits of history outside of history.db are exposed.

Post Reply

Return to “Support and Troubleshooting”