Custom Shell

linuxdev817 · 08-18-2011, 02:02 PM

I have developed a custom shell for Linux. I am trying to find a way to determine a user's IP when they login from a remote machine using something like putty. What is the best way to do this? I know who will provide an IP that I could parse, but that presents a problem when two users login using the same account.

MensaWater · 08-18-2011, 03:01 PM

Different logins for the same user will be on different pty (/dev/pts/*) devices.

who
user1 :0 2011-06-08 12:30
user1 pts/1 2011-06-08 12:31 (:0.0)
user1 pts/3 2011-08-18 08:43 (billybob.example.net)
user1 pts/5 2011-08-17 14:05 (:0.0)
user1 pts/2 2011-08-18 08:42 (billybob.example.net)
user1 pts/4 2011-08-17 14:03 (:0.0)

szboardstretcher · 08-18-2011, 03:15 PM

the 'ss' command might help here.

linuxdev817 · 08-18-2011, 03:34 PM

The problem is that the same user can login from multiple locations. I won't know how to differentiate them from the current active connections using the same username.

Nominal Animal · 08-18-2011, 05:06 PM

Quote:

Originally Posted by linuxdev817

The problem is that the same user can login from multiple locations. I won't know how to differentiate them from the current active connections using the same username.

The tty command will tell you the terminal the user is attached to, so this should do the trick.

Code:

#!/bin/bash
export LANG=C
export LC_ALL=C
tty=$(tty)
who | awk -v "tty=$tty" '
        BEGIN {
                sub(/^\/dev\/+/, "", tty)
        }
        ($2 == tty) {
                remote = $6
                sub(/^\(+/, "", remote)
                sub(/\)+$/, "", remote)
                print remote
        }
'

For remote users, it will display the host name or IP address; for local users, it will output something like :display (X terminal client). I think it will be empty for local console users.

tonyfreeman · 08-18-2011, 10:46 PM

Remember you have log files that you may be able to use. On my debian system the ssh login information is kept in /var/log/auth.log

Code:

Aug 18 23:47:10 monarch sshd[20923]: Accepted password for root from 127.0.0.1 port 33438 ssh2

ta0kira · 08-19-2011, 08:19 AM

Quote:

Originally Posted by linuxdev817

I have developed a custom shell for Linux. I am trying to find a way to determine a user's IP when they login from a remote machine using something like putty. What is the best way to do this? I know who will provide an IP that I could parse, but that presents a problem when two users login using the same account.

What is this shell written in and how is the connection made? sshd sets $SSH_CLIENT and $SSH_CONNECTION when logging in remotely.
Kevin Barry

linuxdev817 · 08-19-2011, 09:03 AM

Quote:

Originally Posted by Nominal Animal

The tty command will tell you the terminal the user is attached to, so this should do the trick.

Code:

#!/bin/bash
export LANG=C
export LC_ALL=C
tty=$(tty)
who | awk -v "tty=$tty" '
        BEGIN {
                sub(/^\/dev\/+/, "", tty)
        }
        ($2 == tty) {
                remote = $6
                sub(/^\(+/, "", remote)
                sub(/\)+$/, "", remote)
                print remote
        }
'

For remote users, it will display the host name or IP address; for local users, it will output something like :display (X terminal client). I think it will be empty for local console users.

This is displaying blank for remote and local users for some reason. However, I see what your point is with using tty. I can always cross-reference the tty output with who to find out the IP.

linuxdev817 · 08-19-2011, 09:09 AM

Quote:

Originally Posted by ta0kira

What is this shell written in and how is the connection made? sshd sets $SSH_CLIENT and $SSH_CONNECTION when logging in remotely.
Kevin Barry

The shell is written in C and the connections are via ssh.

ta0kira · 08-19-2011, 09:16 AM

Quote:

Originally Posted by linuxdev817

The shell is written in C and the connections are via ssh.

So does the shell accept connections or does sshd? In the first case you have connection information via accept, and in the second you can use char *client = strdup(getenv("SSH_CLIENT")); before you get to the interactive stage.
Kevin Barry

linuxdev817 · 08-19-2011, 09:18 AM

Quote:

Originally Posted by ta0kira

So does the shell accept connections or does sshd? In the first case you have connection information via accept, and in the second you can use char *client = strdup(getenv("SSH_CLIENT")); before you get to the interactive stage.
Kevin Barry

sshd accepts the connections.

ta0kira · 08-19-2011, 09:29 AM

Quote:

Originally Posted by linuxdev817

sshd accepts the connections.

If you don't want to depend on $SSH_CLIENT, you could also use getutxline (searching for ctermid), which might be a cleaner solution than who.
Kevin Barry

linuxdev817 · 08-19-2011, 10:33 AM

I am a little confused because:

ctermid() = /dev/tty
system("tty") = /dev/pts/0

Why are these different?

linuxdev817 · 08-19-2011, 10:50 AM

ttyname() also reports the current tty. I can use getutline() and compare ttyname to the utmp->ut_line to find all of the information I will need. Does this seem like the best approach?

linuxdev817 · 08-19-2011, 11:05 AM

Code:

char* my_tty = ttyname(0);
if(strstr(my_tty, "/dev/") != NULL)
{
   my_tty += 5;
}

struct utmp* ut_entry;
while((ut_entry = getutent()) != NULL)
{
    if(strstr(ut_entry->ut_line, my_tty) != NULL)
    {
    	printf("host: %s\n id: %s\n line: %s\n npid: %d\n session: %d\n type: %d\n user: %s\n\n", ut_entry->ut_host, ut_entry->ut_id, ut_entry->ut_line, ut_entry->ut_pid, ut_entry->ut_session, ut_entry->ut_type, ut_entry->ut_user);
    }
}