5 ms·
Okay, you've done the trick, now what's the reveal? How do you readily detect someone who has started their shell without TTY allocation?
by alnayyir 16y ago
Okay, you've done the trick, now what's the reveal? How do you readily detect someone who has started their shell without TTY allocation?
- daten 16y agoThe sshd process for your connection is still present on the server and looks like: "sshd: username@notty". You can find it easily with a grep of running processes. ps aux | grep sshd.*notty
- timtadh 16y agoif you are running sshd on port 22 this will show you all connections going into it sudo lsof -i :22 you can then reverse what people are doing based on the pids lsof gives you. [edit: using ps ax | grep sshd also works but you can't see where they are connecting from. [+1 daten]]