pedram@smash:~/blog$ cat terminal-snooping.md

# Terminal Snooping · 2005-03-31

When running a shell server, at some point you may find the need to monitor or interact with another user's terminal. A number of kernel-based solutions exist such as Sebek from The Honeynet Project. I wanted something simpler and more elegant and was suggested by a contact to look into ttysnoop. ttysnoop is great- it allows you to selectively "attach" to a target user's terminal, view/interact as you please and detach when you are done. There is no need for a separate data store, any kernel modules or recompiling of any sort. Here is how I set it up to work with SSH on my Gentoo system:

First, I commented out the block of code responsible for the annoying startup sound and the line that prints "bye bye" when users close their session from ttysnoops.c: 

    509: /*if (InitSound())
    510: {
    511:     DoSound(466, SLEN);     // A#4
    512:     DoSound(622, SLEN);     // D#5
    513:     DoSound(784, SLEN);     // G5
    514:     DoSound(932, SLEN*2);   // A#5
    515:     DoSound(784, SLEN);     // G5
    516:     DoSound(932, SLEN*3);   // A#5
    517: }*/

    ...

    661: if ((n = read(ptyfd, buff, BUFF_SIZE)) < 1)
    662: {
    663:     //errorf ("bye bye\n");
    664:     exit (0);
    665: }

I then compiled and installed the binaries (ttysnoop and ttysnoops) to /sbin. Next I created the /etc/snooptab file with the following single entry: 

    * socket login /bin/login.orig

I then moved /bin/login to /bin/login.orig and created a symbolic link from /bin/login to /sbin/ttysnoops: 

    # mv /bin/login /bin/login.orig
    # ln -s /sbin/ttysnoops /bin/login

Next, I modified the command line arguments to agetty in /etc/inittab to reference the original login binary: 

    agetty -l /bin/login.orig

I then enabled the UseLogin option in sshd_config and restarted both sshd and init. I also created the ttysnoop spool directory as that is not done automatically: 

    # echo "UseLogin yes" >> /etc/ssh/sshd_config
    # /etc/init.d/sshd restart
    # init q
    # mkdir /var/spool/ttysnoop/
    # chmod 700 /var/spool/ttysnoop/

At this point ttysnoop is up and running. I did come across one quirk with the control keys. While Ctrl + '\' was working for suspends, Ctrl + '-' was not detaching from the snoop device. I was about to change the TERM_CHAR define when I realized that Ctrl + '/' sends the appropriate key-code for me, so you may want to try that key combination if Ctrl + '-' is not working for you.

pedram@smash:~$