ttysnoop(8) [linux man page]
TTYSNOOP(8) BSD System Manager's Manual TTYSNOOP(8) NAME
ttysnoop -- snoop on a user's tty SYNOPSIS
ttysnoop [pty] ttysnoops DESCRIPTION
The ttysnoop / ttysnoops client-server combo can be used to snoop (watch) on a user's login tty. The server (ttysnoops) is usually started by getty(8) or telnetd(8) and reads the file /etc/snooptab to find out which tty's should be cloned and which programs to run on them (usu- ally /bin/login). A tty may be snooped through a pre-determined (ie. fixed) device, or through a dynamically allocated pseudo-tty (pty). This is also specified in the /etc/snooptab file. To connect to the pty, the client ttysnoop should be used. The available pseudo terminals pty are present as sockets in the directory /var/spool/ttysnoop/. Format of /etc/snooptab The /etc/snooptab file may contain comment lines (starting with a '#'), empty lines, or entries for tty's that should be snooped upon. The format of such an entry is as follows: tty snoop-device type program where tty is the leaf-name of the tty that should be snooped upon (eg. ttyS2, not /dev/ttyS2) OR the wildcard '*', which matches ANY tty. snoop-device is the device through which tty should be snooped (eg. /dev/tty8) OR the literal constant "socket". The latter is used to tell ttysnoops that the snoop-device will be a dynamically allocated pty. type specifies the type of program that should be run, currently recog- nized types are "init", "user" and "login" although the former two aren't really needed. Finally, program is the full pathname to the program to run when ttysnoops has cloned tty onto snoop-device. EXAMPLE
The following example /etc/snooptab file should illustrate the typical use of ttysnoop / ttysnoops: # # example /etc/snooptab # ttyS0 /dev/tty7 login /bin/login ttyS1 /dev/tty8 login /bin/login # # the wildcard tty should always be the last one in the file # * socket login /bin/login # # example end # With the above example, whenever a user logs in on /dev/ttyS0 or /dev/ttyS1, either tty will be snooped through /dev/tty7 or /dev/tty8 respectively. Any other tty's will be snooped through a pty that will be allocated at the time of login. The system-administrator can then run ttysnoop pty to snoop through the pty. Note that it is up to the system-administrator to setup getty and/or telnetd so that they execute ttysnoops instead of /bin/login. SEE ALSO
getty(8), telnetd(8) FILES
/etc/snooptab BUGS
The program is unable to do any terminal control-code translations for the original tty and the snoop-device. I doubt it will ever do this. AUTHOR
Carl Declerck, carl@miskatonic.inbe.net BSD August 8 1994 BSD
Check Out this Related Man Page
GETTY(8) System Manager's Manual GETTY(8) NAME
getty - set terminal mode SYNOPSIS
getty [ type [ tty ] ] DESCRIPTION
Getty is usually invoked by init(8) to open and initialize the tty line, read a login name, and invoke login(1). getty attempts to adapt the system to the speed and type of terminal being used. The argument tty is the special device file in /dev to open for the terminal (e.g., ``ttyh0''). If there is no argument or the argument is ``-'', the tty line is assumed to be open as file descriptor 0. The type argument can be used to make getty treat the terminal line specially. This argument is used as an index into the gettytab(5) database, to determine the characteristics of the line. If there is no argument, or there is no such table, the default table is used. If there is no /etc/gettytab a set of system defaults is used. If indicated by the table located, getty will clear the terminal screen, print a banner heading, and prompt for a login name. Usually either the banner of the login prompt will include the system hostname. Then the user's name is read, a character at a time. If a null character is received, it is assumed to be the result of the user pushing the `break' (`interrupt') key. The speed is usually then changed and the `login:' is typed again; a second `break' changes the speed again and the `login:' is typed once more. Successive `break' characters cycle through the same standard set of speeds. The user's name is terminated by a new-line or carriage-return character. The latter results in the system being set to treat carriage returns appropriately (see tty(4)). The user's name is scanned to see if it contains any lower-case alphabetic characters; if not, and if the name is nonempty, the system is told to map any future upper-case characters into the corresponding lower-case characters. Finally, login is called with the user's name as an argument. Most of the default actions of getty can be circumvented, or modified, by a suitable gettytab table. Getty can be set to timeout after some interval, which will cause dial up lines to hang up if the login name is not entered reasonably quickly. DIAGNOSTICS
ttyxx: No such device or address. ttyxx: No such file or address. A terminal which is turned on in the ttys file cannot be opened, likely because the requisite lines are either not configured into the system, the associated device was not attached during boot-time system con- figuration, or the special file in /dev does not exist. FILES
/etc/gettytab SEE ALSO
gettytab(5), init(8), login(1), ioctl(2), tty(4), ttys(5) 4th Berkeley Distribution November 17, 1996 GETTY(8)