TTYSNOOP(8) BSD System Manager's Manual TTYSNOOP(8)NAME
ttysnoop -- snoop on a user's tty
SYNOPSIS
ttysnoop [pty]
ttysnoops
DESCRIPTION
The ttysnoop / ttysnoops client-server combo can be used to snoop (watch) on a user's login tty. The server (ttysnoops) is usually started
by getty(8) or telnetd(8) and reads the file /etc/snooptab to find out which tty's should be cloned and which programs to run on them (usu-
ally /bin/login). A tty may be snooped through a pre-determined (ie. fixed) device, or through a dynamically allocated pseudo-tty (pty).
This is also specified in the /etc/snooptab file. To connect to the pty, the client ttysnoop should be used. The available pseudo terminals
pty are present as sockets in the directory /var/spool/ttysnoop/.
Format of /etc/snooptab
The /etc/snooptab file may contain comment lines (starting with a '#'), empty lines, or entries for tty's that should be snooped upon. The
format of such an entry is as follows:
tty snoop-device type program
where tty is the leaf-name of the tty that should be snooped upon (eg. ttyS2, not /dev/ttyS2) OR the wildcard '*', which matches ANY tty.
snoop-device is the device through which tty should be snooped (eg. /dev/tty8) OR the literal constant "socket". The latter is used to tell
ttysnoops that the snoop-device will be a dynamically allocated pty. type specifies the type of program that should be run, currently recog-
nized types are "init", "user" and "login" although the former two aren't really needed. Finally, program is the full pathname to the program
to run when ttysnoops has cloned tty onto snoop-device.
EXAMPLE
The following example /etc/snooptab file should illustrate the typical use of ttysnoop / ttysnoops:
#
# example /etc/snooptab
#
ttyS0 /dev/tty7 login /bin/login
ttyS1 /dev/tty8 login /bin/login
#
# the wildcard tty should always be the last one in the file
#
* socket login /bin/login
#
# example end
#
With the above example, whenever a user logs in on /dev/ttyS0 or /dev/ttyS1, either tty will be snooped through /dev/tty7 or /dev/tty8
respectively. Any other tty's will be snooped through a pty that will be allocated at the time of login. The system-administrator can then
run ttysnoop pty to snoop through the pty. Note that it is up to the system-administrator to setup getty and/or telnetd so that they execute
ttysnoops instead of /bin/login.
SEE ALSO getty(8), telnetd(8)FILES
/etc/snooptab
BUGS
The program is unable to do any terminal control-code translations for the original tty and the snoop-device. I doubt it will ever do this.
AUTHOR
Carl Declerck, carl@miskatonic.inbe.net
BSD August 8 1994 BSD
Check Out this Related Man Page
GETTY(8) BSD System Manager's Manual GETTY(8)NAME
getty, uugetty -- set terminal modes for system access
SYNOPSIS
getty [type [tty]]
uugetty [type [tty]]
DESCRIPTION
The getty program is called by init(8) to open and initialize the tty line, read a login name, and invoke login(1). The devices on which to
run getty are normally determined by ttys(5).
The getty program can also recognize a Point to Point Protocol (PPP) negotiation, and, if the pp attribute in gettytab(5) is set, invoke the
program given by that string, e.g., pppd(8), instead of login(1). This makes it possible to use a single serial port for either a "shell"
account with command line interface, or a PPP network link.
The argument tty is the special device file in /dev to open for the terminal (for example, "ttyh0"). If there is no argument or the argument
is '-', the tty line is assumed to be open as file descriptor 0.
The type argument can be used to make getty treat the terminal line specially. This argument is used as an index into the gettytab(5) data-
base, to determine the characteristics of the line. If there is no argument, or there is no such table, the default table is used. If there
is no /etc/gettytab a set of system defaults is used. If indicated by the table located, getty will clear the terminal screen, print a ban-
ner heading, and prompt for a login name. Usually either the banner or the login prompt will include the system hostname.
getty uses the ttyaction(3) facility with an action of "getty" and user "root" to execute site-specific commands when it starts.
Most of the default actions of getty can be circumvented, or modified, by a suitable gettytab(5) table.
The getty program can be set to timeout after some interval, which will cause dial up lines to hang up if the login name is not entered rea-
sonably quickly.
The uugetty program is the same, except that it uses pidlock(3) to respect the locks in /var/spool/lock of processes that dial out on that
tty.
FILES
/etc/gettytab
/etc/ttys
/var/spool/lock/LCK..ttyXX
DIAGNOSTICS
ttyxx: No such device or address.
ttyxx: No such file or address. A terminal which is turned on in the ttys(5) file cannot be opened, likely because the requisite lines are
either not configured into the system, the associated device was not attached during boot-time system configuration, or the special file in
/dev does not exist.
SEE ALSO login(1), ioctl(2), pidlock(3), ttyaction(3), tty(4), gettytab(5), ttys(5), init(8), pppd(8)HISTORY
A getty program appeared in Version 6 AT&T UNIX.
BSD December 12, 1998 BSD