topic Re: How to delete a specific entry from Gaia's Clish history? in API / CLI Discussion

How to delete a specific entry from Gaia's Clish history?

Danny — Fri, 27 May 2022 10:22:07 GMT

I'd like a delete a specific entry from Gaia's Clish history (it's a password) without deleting the other entries.
What's the correct procedure for this? Gaia command history didn't provide a solution.

Re: How to delete a specific entry from Gaia's Clish history?

Alex- — Fri, 27 May 2022 15:26:54 GMT

The clish history is recorded in ~/.clish_history that you can access from Expert mode.

From there, edit the file or script something to your liking.

Re: How to delete a specific entry from Gaia's Clish history?

Danny — Thu, 30 Mar 2023 08:43:27 GMT

Even after deleting the entry from ~/.clish_history, then logging out and in again to the system then the unwanted clish entry is still there and also appears back again in ~/.clish_history

What is the reason Check Point stores failed non-command entries into clish history?
Most of us use password systems these days, so it happens sometimes that we copy&paste a password into the clish and hit enter to realize only afterwards that there was no expert prompt waiting for password entry.

I figured out that when I login with another admin account and delete the entry from the unwanted clish history entry of the first admin account it finally works. Looks like Gaia caches the clish history of a logged in admin and stores it into ~/.clish_history on logout. So editing ~/.clish_history with the same admin account is not working (or probably working only by temp. changing the CLI to /bin/bash to login without loading the Clish environment, thus make the edit of the Clish history effective).

Re: How to delete a specific entry from Gaia's Clish history?

Alex- — Thu, 30 Mar 2023 09:52:51 GMT

Yes, history is written on logout. I made a simple tool a while ago to check all histories to see now and then if people didn't put sensitive stuff in environments with a lot of users. Clish commands are also logged in /var/log/messages so could benefit from a syslog export and analysis tool.