TTY replay daemon
Main page | Installing | Running | Detailed Tech Data | ttyrpld 0.83 |
Description > |
ttyrpld is a kit to log any traffic and actions which go through any of your Kernel's tty devices. In common-term language, this is a Keylogger. It also contains a screen logger, since keyboard and screen are both considered to be one tty device, and thus logging screen updated is just as easy as for keystrokes. |
||||||||||||||||
Technical aspects > |
This kit consists of a Kernel patch, a Kernel module, a user-space logging daemon and a [user-space] player. The Kernel patch adds a few lines to provide the "RPL" (short for replay) extension hook, which (any) module can then get onto. The system was not directly written for black-hats who want to leave as little traces as possible, keep in mind. :-) It supports any tty type (vc, pts, serial, etc.). Being implemented within the Kernel makes it incircumventable for the default user. Another benefit is that it runs with no overhead (ok, I lied: two CPU instructions) if the user-space logging daemon is not active. The Kernel-side module (rpldev) is responsible for grabbing the data off the tty line and providing a character device for the user-space logging daemon. Data grabbed of the tty is directly passed to the overlying daemons, so with the correct terminal settings (environment variable TERM) you can get a 1:1 replay. Having received the captured data, the logging daemon can store them in any format and/or facility, with or without compression, just as it likes, for this happens in user-space and thus you have all the fluffy libraries available. (That would not be the case from Kernel space.) Output from rpld is a packed binary format with timestamps, one to conserve space, because a lot of users generate a lot of mickle, and the latter to allow a real-time 1:1 replay. See the Technical Details page for more info. |
||||||||||||||||
Categorization (SF-style) > |
|
||||||||||||||||
Support > |
If you need any help or assistance, just drop me a line at jengelh@linux01.gwdg.de. |
||||||||||||||||