About a month ago, I awoke and turned on power to the monitor on my fastest machine, everything looked normal, checked unRAID web page, again all OK, then checked a telnet box I had left open.  At first glance, it looked just as I had left it, with a 'tail -f --lines=30 /var/log/syslog' filling the screen, and no apparent change.  I wanted to check something on the unRAID box (I forget what), and I thought I remembered already typing the command, so I Ctl-C out of the tail, and then start pressing the Up arrow key to find the previously typed command in the command history.  I had not gone very far before finding commands I definitely had not typed!  After progressing back maybe a hundred commands, I was stunned.  It clearly looked like a Linux expert had been exploring my unRAID system, with around 25 'rm -r' commands typed, and one 'rm *'.  I thought I had been hacked for sure.

 

I shut down my TightVnc host, realized I hadn't changed the password in a long time.  I shut down Remote Assistance access, just in case.  I shut down (from beginner ignorance) my uTorrent client, used only to provide copies of AutoPatcher, RyanVM files, Knoppix CD, and OpenOffice distros.  uTorrent is supposed to be safe, but sure provides a scary TCPview list, of people around the world connecting to your computer.  I then rebooted my computer, and ran various security scans, unsuccessfully.

 

I planned to write this up, when I had time, and request additional Telnet security, and a way to remotely record all telnet sessions and responses.  I would also remind myself never to leave a Telnet box open again.

 

Today I discovered quite by accident on the unRAID console the very same command history, by continuously pressing the Up arrow on the unRAID keyboard!  So I opened another Telnet session, and found it there too, before I had typed anything but the password.  The command history seems to be saved in the unRAID image, a standard feature now, perhaps undiscovered before now!  You should be able to confirm this for yourself.  I suppose I have just found Tom's last minute setup of the 4.0 image.  No harm done after all, which makes me feel better, especially for a very security-conscious guy like myself.

 

Being a Windows and DOS guy, there are numerous commands I had never seen before, like v, vim, jed.  v turns out to be a synonym for 'ls -l', a handy shortcut to know.  vim is probably a Linux editor.  There were several reboot's and an exit, which mystify me.  I would think that would kill the session, and therefore never show in a command history, but they apparently were not successful.

 

I keep forgetting to delete that pesky bash_history file