NAME¶
ttysnoop —
snoop on a user's tty
DESCRIPTION¶
The ttysnoop / ttysnoops
client-server combo can be used to snoop (watch) on a user's login tty. The
server (ttysnoops) is usually started by getty(8) or
telnetd(8) and reads the file /etc/snooptab to find
out which tty's should be cloned and which programs to run on them (usually
/bin/login). A tty may be snooped through a pre-determined (ie. fixed) device,
or through a dynamically allocated pseudo-tty (pty). This is also specified in
the /etc/snooptab file. To connect to the pty, the
client ttysnoop should be used. The available pseudo
terminals pty are present as sockets in the directory
/var/spool/ttysnoop/.
The /etc/snooptab file may contain comment lines
(starting with a '#'), empty lines, or entries for tty's that should be
snooped upon. The format of such an entry is as follows:
tty snoop-device type program
where tty is the leaf-name of the tty that
should be snooped upon (eg. ttyS2, not /dev/ttyS2) OR the wildcard '*',
which matches ANY tty. snoop-device is the device
through which tty should be snooped (eg. /dev/tty8)
OR the literal constant "socket". The latter is used to tell
ttysnoops that the snoop-device will be a
dynamically allocated pty. type specifies the type
of program that should be run, currently recognized types are
"init", "user" and "login" although the former
two aren't really needed. Finally, program is the
full pathname to the program to run when ttysnoops
has cloned tty onto
snoop-device.
EXAMPLE¶
The following example /etc/snooptab file should
illustrate the typical use of ttysnoop /
ttysnoops:
#
# example /etc/snooptab
#
ttyS0 /dev/tty7 login /bin/login
ttyS1 /dev/tty8 login /bin/login
#
# the wildcard tty should always be the last one in the file
#
* socket login /bin/login
#
# example end
#
With the above example, whenever a user logs in on /dev/ttyS0 or
/dev/ttyS1, either tty will be snooped through /dev/tty7 or /dev/tty8
respectively. Any other tty's will be snooped through a pty that will be
allocated at the time of login. The system-administrator can then run
ttysnoop pty to snoop through
the pty. Note that it is up to the system-administrator to setup getty
and/or telnetd so that they execute ttysnoops
instead of /bin/login.
BUGS¶
The program is unable to do any terminal control-code translations for the
original tty and the snoop-device. I doubt it will ever do this.
AUTHOR¶
Carl Declerck, carl@miskatonic.inbe.net
