​
Event Information

​
Meaning

  • The Delete or rename shell history event in a Kubernetes cluster refers to an action where a user or process attempts to delete or rename the shell history file.
  • This event can indicate potential attempts to cover up unauthorized activities or hide sensitive information by removing or modifying the shell history.
  • To investigate this event, you can use the kubectl exec command to access the container where the event occurred and check for any suspicious activities or modifications to the shell history file. For example: kubectl exec -it <pod-name> -- /bin/bash.

​
Remediation

To remediate the event “Delete or rename shell history using python Kubernetes API”, you can follow these steps:

  1. Identify the affected Pod:

    • Use the kubectl get pods command to list all the Pods in the cluster.
    • Look for the Pod that triggered the event based on the Pod name or other relevant information.

  2. Investigate the Container :

    • Access the container to review recent activities: 
      kubectl exec -it <pod-name> -n <namespace> -- /bin/bash
    • Check the shell history file (~/.bash_history or equivalent) for any suspicious entries: 
      cat ~/.bash_history
    • Look for any attempts to delete or rename the history file: 
      ls -la ~/
    • Look at the container logs for any indication of commands executed around the time of the event: 
      kubectl logs <pod-name> -n <namespace>

  3. Update Security Policies :

    • Consider limiting shell access to containers by setting appropriate security contexts and using container security best practices.

  4. Remove or Rename the History File (if necessary):

    • If you need to remove or rename the history file as part of your cleanup, do so carefully: 
      kubectl exec <pod-name> -n <namespace> -- rm ~/.bash_history
      or 
      kubectl exec <pod-name> -n <namespace> -- mv ~/.bash_history ~/.bash_history_old

Note: Make sure you have the necessary permissions to execute these commands on the cluster.