[jrcii]

You can remove ignorespace from HISTCONTROL for the latter, and for the former, can't you just remove chattr's execute permission for that user?

[jlgaddis]

The user can point $HISTFILE elsewhere (e.g., /dev/null), `unset` it, use another shell, ...

[jrcii]

It looks like you could lock down the environment variables with rbash http://unix.stackexchange.com/questions/66627/is-there-anywa...

But that's getting into no-man's land I guess