ssh spying

On Thu, 10 Feb 2005 10:45:22 -0600, John Hasler staggered into the Black Sun and said:

Nope. With ps, I can see that user bob on pts-1 is running "something.pl", but I can't use ps to see what "something.pl" is currently printing to pts-1's stdout-stderr. That requires more fiddling--you'll have to find the PID of whatever you're interested in, then probably go toproc-$PID-fdand open() and read() the file descriptors. This will require root priviliges, and so forth. It's easier to use ttysnoop or something like it, but I don't know if that will work for ssh sessions. A quick try on my laptop says that the bonehead approach of just catting every fd that an ssh session has open won't work, as expected.

For the ttys, it's a lot easier. The kernel maintainsdev-vcs1 ..dev-vcsN , which contain the contents ofdev-tty1 ..dev-ttyN. This can be useful, but most people use X these days or are ssh'ed in from somewhere else.

-- Matt GThere is no Darkness in Eternity-But only Light too dim for us to see Brainbench MVP for Linux Admin mail: TRAP + SPAN don't belong