TTYSNOOP(8)

📦
version 0.12d · 2 versions
, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 TTYSNOOP — the manual, but make it cute 💖

okay bestie, so you know how sometimes you just need to see what's happening on someone's terminal? yeah. that's this. it's TTYSNOOP(8) from the System Manager's Manual section, and it's lowkey iconic 🫶

✨ NAME ✨

ttysnoop — snoop on a user's tty 👀

🌸 SYNOPSIS 🌸

ttysnoop [pty]
ttysnoops

🦋 DESCRIPTION 🦋

so the ttysnoop / ttysnoops client-server combo? it's giving surveillance but make it polite. it lets you snoop (watch 👀) on a user's login tty.

the server, ttysnoops, is usually started by getty(8) or telnetd(8), and it reads the file /etc/snooptab to find out which tty's should be cloned and which programs to run on them (usually /bin/login, obviously).

a tty may be snooped through a pre-determined (ie. fixed) device, or through a dynamically allocated pseudo-tty (pty). which one you get is also specified in the /etc/snooptab file. to connect to the pty, the client ttysnoop should be used — that's literally its whole job, periodt.

the available pseudo terminals pty are present as sockets in the directory /var/spool/ttysnoop/. slay. 💅

🎀 Format of /etc/snooptab 🎀

the /etc/snooptab file may contain:

  • comment lines (starting with a #)
  • empty lines
  • or entries for tty's that should be snooped upon

the format of such an entry is as follows:

tty   snoop-device   type   program

where:

  • tty is the leaf-name of the tty that should be snooped upon (eg. ttyS2, not /dev/ttyS2) OR the wildcard '*', which matches ANY tty.
  • snoop-device is the device through which tty should be snooped (eg. /dev/tty8) OR the literal constant "socket". the latter is used to tell ttysnoops that the snoop-device will be a dynamically allocated pty.
  • type specifies the type of program that should be run. currently recognized types are "init", "user" and "login" — although the former two aren't really needed ngl 🙈
  • program is the full pathname to the program to run when ttysnoops has cloned tty onto snoop-device.

🌈 EXAMPLE 🌈

the following example /etc/snooptab file should illustrate the typical use of ttysnoop / ttysnoops:

#
# example /etc/snooptab
#
ttyS0    /dev/tty7    login    /bin/login
ttyS1    /dev/tty8    login    /bin/login
#
# the wildcard tty should always be the last one in the file
#
*        socket       login    /bin/login
#
# example end
#

with the above example, whenever a user logs in on /dev/ttyS0 or /dev/ttyS1, either tty will be snooped through /dev/tty7 or /dev/tty8 respectively. any other tty's will be snooped through a pty that will be allocated at the time of login. 🫶

the system-administrator can then run ttysnoop pty to snoop through the pty. note that it is up to the system-administrator to setup getty and/or telnetd so that they execute ttysnoops instead of /bin/login. yes, that part is on you bestie, the program is not gonna hold your hand 💅

👑 SEE ALSO 👑

🍓 FILES 🍓

  • /etc/snooptab

💀 BUGS 💀

the program is unable to do any terminal control-code translations for the original tty and the snoop-device. and honestly? the author doubts it will ever do this. 😭 iconic level of giving up fr fr

💜 AUTHOR 💜

Carl Declerck, carl@miskatonic.inbe.net

and that's the whole thing, bestie ✨ this one shipped on Debian, dated August 8 1994 — old enough to be your cool aunt who still knows every Unix trick in the book. no cap. 🎀

📦 where this page comes from