Sniff stdin

[ThePsyjo]

Hi,

I'm need build a shell-wrapper for logging any input on a shell.

The only problem I have is that i cant read stdin twice.
My wrapper creates a pthread executing the given shell and waits until the thread is terminated.
In this period of waiting I need to know what is going on on stdin.

I'm searching now for more than 2 days to solve this. With first attemp with python I got in the same problem.

Has anyone an Idea or even better a solution to get this working ?

[ne555]

$ tee --append log | program.bin

[ThePsyjo]

Don't know how I have not seen this before :/ Anyway this one works but not as intended. First one: the shell prompt is not forwarded. Second one: striking ctrl+c terminates the wrapper.

[ne555]

>> First one: the shell prompt is not forwarded
I don't understand what you mean.

>> Second one: striking ctrl+c terminates the wrapper.
¿Isn't that expected?
You could code a parent-child with all the signals forwarded. (fork() exec*() sigaction() pipe() popen()

[ThePsyjo]

>>>> Second one: striking ctrl+c terminates the wrapper.
>>¿Isn't that expected?
If I would cancel a process in the shell, it would kill the wrapper not the process I started. In general the wrapper should behave exactly like the shell started inside it. Except for the logging.

>>>> First one: the shell prompt is not forwarded
>>I don't understand what you mean.
As i wrote obove - the wrapper should behave like the shell.

I already tried to pass stdin as a pipe, but thats the same effect as piping with tee.
For both, C and Python it does work but not as intended :(

[Moschops]

Whilst it's blocked from where I am right now, so I can't double-check, but I seem to recall the delectable Joanna Rutkowski talking about watching input from other windows under X11; http://theinvisiblethings.blogspot.com/2011/04/linux-security-circus-on-gui-isolation.html

[ThePsyjo]

This wrapper should run on servers without gui so this is not an option :(

[kev82]

man script

Depending on your system it may or may not be able to log all input.

[ThePsyjo]

I got it working now. It was a bit tricky because I needed to modify script from util-linux first. My version now has a new Switch to log input only. In conjunction with my already existing wrapper in python I'm able to log the input to a file or to a Graylog2-Server.

Does anyone know where I can send the patch for script.c ?

Thanks for any help :)

[orrious]

Were you able to post your modifications to script.c? Did you put any measures in place to ensure passwords aren't captured? Comparing stdin to stdout and only then recording that character?

Thanks!

[ThePsyjo]

Were you able to post your modifications to script.c?

I don't really know how :/

Did you put any measures in place to ensure passwords aren't captured?

It is still script. It does not check anything but logs it.

Anyway my modifications are kind of quick and dirty but it does its job.