Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Posting-Version: version B 2.10.1 6/24/83; site CS-Mordred
Path: utzoo!watmath!clyde!burl!ulysses!mhuxr!mhuxn!ihnp4!inuxc!pur-ee!CS-Mordred!avr
From: avr@CS-Mordred (Andrew V Royappa)
Newsgroups: net.unix,net.unix-wizards
Subject: Watching someone's terminal
Message-ID: <275@CS-Mordred>
Date: Sat, 20-Jul-85 05:41:13 EDT
Article-I.D.: CS-Mordr.275
Posted: Sat Jul 20 05:41:13 1985
Date-Received: Mon, 22-Jul-85 06:29:14 EDT
Organization: Department of Computer Science, Purdue University
Lines: 41
Xref: watmath net.unix:5092 net.unix-wizards:13931


	A while back someone asked about a program which
would allow one user to watch exactly what happens on another
user's terminal. I don't remember if the request was to net.unix
or to -wizards, so I'm posting to both. Here's a quick and dirty
way to do it:

	add the line 

		fflush(fscript);

	after the fwrite() line in the dooutput() routine of script.c,
and do "cc -o watch script.c". Then, suppose user A is on ttyA and user B
is on ttyB. User A should now do

	% watch /dev/ttyB
	Script started at ..
	% 				<-- script shell starts here

	Now anything user A does will appear simultaneously (well ..)
on user B's terminal (ttyB), allowing user B to watch everything that
happens on user A's terminal. Of course, nothing else should be producing
output on ttyB at the same time or garbage will result. This is totally 
inflexible - e.g, this doesn't allow for intervention by user B 
into what A is doing, and the limitations are endless, but it worked 
very nicely for me (on a 4.2BSD 11/780, mind).  As I said, quick 
and dirty.

	I suppose it'd be useful for watching a good rogueist.

	Interesting .. if you suspect someone of security-break
attempts, you could change their shell surreptiously to a version
of script which doesn't print the header messages etc. but just
silently appends stuff to some system administrators file ..
of course, you'd have to find a way to hide the script processes
which will be revealed if the breaker does a ps.

	Comments ?

				Andrew Royappa
		{ihnp4, pur-ee, decvax, ucbvax}!purdue!avr