SSH question

[George Toft]

James Mabry wrote:
> 
> Hey all,
> Another user of the PLUG irc server and I were discussing wheter it is
> possible for the root user of a system to snoop on an ssh session that
> is currently in progress on that machine. Can this be done? Thanks.
> 
> --
> Slackware Linux -
> Learn about the 4S rule.
> www.slackware-advocacy.org/whyuse.html
> 
> Then try it out for yourself.
> www.slackware.org
> 
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change  you mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss


Initially, I would have said no, however, in playing around, I was able
to inject my own data into an established SSH session of another user
(the opposite of what I intended).  Intrigued, I searched using google
and found this how-to:
<http://security-archive.merton.ox.ac.uk/archive-199806/0365.html>
which is a mirror of the RedHat list.

Better how-to description:
<http://online.securityfocus.com/archive/119/251428>

So it would appear the answer to your questions is: Yes.

Further reading:
<http://www.google.com/search?q=linux+ttysnoop+ssh&hl=en&lr=&ie=ISO-8859-1>

Cheers,

George