Can we spy a tty session?

UNIX Solaris
1

First of all, in no way I want to use this to hack / cheat / steal etc ...

I am an admin of a couple of hundred users which are 99,8% > 500miles away from me and to facilitate some administration part I would like to be able to "spy" what they are doing in there sessions, live.

ex:

 11:53am  up 83 day(s), 21:25,  X users,  load average: 0.45, 0.46, 0.45
User     tty           login@  idle   JCPU   PCPU  what
RandomUserOne  pts/1         3:26am  8:26                bash

Can I "spy" 'RandomUserOne' on pts/1?

Google was useless btw ... I might just not be using the right terms ...

2

There have been programs in the past like ttysnoop... and I've used them (at the request of clients). They basically replace login. But with Solaris changes, not sure if any of that is applicable anymore.

3

That is wat I was expecting ... I was looking for something more "native". I will have to stick with de damn screenshots I guess.

Thanks cjcox for your time.

4

you can snoop EVERYTHING inside solaris (10) with "dtrace".

DTrace Tools
BigAdmin: DTrace

5

You can use screen utility, It's available on sunfreeware.
User has to run:

$ screen

then you have to switch to that user and run:

$ screen -x

This way you can see everything that happens on his/her terminal. It's not very secure as you have to temporarily chmod on /dev/pts/X but it does the job.

6

you can "ptree" on the user PID as well :

#ps -ef |grep ssh
#ptree <pid>

Can Do a loop (bash):

for (( ; ; ));do ptree <pid>; sleep 10; done

Fabien

1 Like
7

Thanks unclefab, that is not exactly what I was looking for but it is totally awesome!

8

Dtrace, is your answer. Download the Dtrace toolkit, it has a script,... I don't know the exact name, but it ends with snoop.

Note: This is assuming that you have Solaris 10 on your system