TTY replay daemon

   
Description >

ttyrpld is a kit to log any traffic and actions which go through any of your Kernel's tty devices. In common-term language, this is a Keylogger. It also contains a screen logger, since keyboard and screen are both considered to be one tty device, and thus logging screen updated is just as easy as for keystrokes.

 
Technical aspects >

This kit consists of a Kernel patch, a Kernel module, a user-space logging daemon and a [user-space] player.

The Kernel patch adds a few lines to provide the "RPL" (short for replay) extension hook, which (any) module can then get onto. The system was not directly written for black-hats who want to leave as little traces as possible, keep in mind. :-)

It supports any tty type (vc, pts, serial, etc.). Being implemented within the Kernel makes it incircumventable for the default user. Another benefit is that it runs with no overhead (ok, I lied: two CPU instructions) if the user-space logging daemon is not active.

The Kernel-side module (rpldev) is responsible for grabbing the data off the tty line and providing a character device for the user-space logging daemon. Data grabbed of the tty is directly passed to the overlying daemons, so with the correct terminal settings (environment variable TERM) you can get a 1:1 replay.

Having received the captured data, the logging daemon can store them in any format and/or facility, with or without compression, just as it likes, for this happens in user-space and thus you have all the fluffy libraries available. (That would not be the case from Kernel space.) Output from rpld is a packed binary format with timestamps, one to conserve space, because a lot of users generate a lot of mickle, and the latter to allow a real-time 1:1 replay.

See the Technical Details page for more info.

 
Categorization
(SF-style) >
Development Status: 5 - Production/Stable
Environment: Console (Text Based), No Input/Output (Daemon)
Intended Audience: System Administrators, Information Technology
License: GNU General Public License version 2 (GPL)
Natural Language: English
Operating System: Linux 2.4 and 2.6
Programming Language: C/GNU99
Topic: Systems Administration, Security
 
Support >

If you need any help or assistance, just drop me a line at jengelh@linux01.gwdg.de.