BackupGGCode / logkeys

a GNU/Linux keylogger that works!
Other
0 stars 0 forks source link

Feature suggestion - user name capture #66

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago
It should be great to add the user name on each line of log file.

Original issue reported on code.google.com by surfz...@gmail.com on 4 Aug 2011 at 11:17

GoogleCodeExporter commented 9 years ago
hm, I like the idea, and capturing the user who started logkeys is trivial, but 
I don't know how to go about it to make it more robust (several users each 
through his own tty accessing (remote) X desktop and running logkeys). this 
way, I would also have to allow more program instances... I don't know. ideas 
welcome.

@me: utmp.h will likely be of some help here.

Original comment by kernc...@gmail.com on 4 Aug 2011 at 4:34

GoogleCodeExporter commented 9 years ago
The idea is more, to log the user session name who are curently use the 
keyboard.
for exemple, we are two people who use the PC, then in the log file, we don't 
if the keyboard came from my session or the other one, i beleve you can folow 
the same way as my linux box, if i sudo an app, let's say firefox, on the 
window title, the sytem add "in name of xxxx"

Original comment by surfz...@gmail.com on 4 Aug 2011 at 9:22

GoogleCodeExporter commented 9 years ago
sorry : "we don't KNOW if the keyboard"

Original comment by surfz...@gmail.com on 4 Aug 2011 at 9:23

GoogleCodeExporter commented 9 years ago
yes, but sudo knows your username because you are the user who runs it.
on a multi-user system, logkeys could know which user initially ran it (either 
you or the other user), but using this naive approach, it wouldn't know what 
user is typing on a certain keyboard at a certain time. 
(there can be several keyboards attached to the system and several users 
running X desktop and using one keyboard — all on a single system. how do you 
know which user is doing what? and that in a single logkeys instance.)

if you need this now, I suggest you and the other user use separate log files, 
e.g. /home/user/users-logkeys-log.
you can put this in llk.sh startup script and then evoke it on desktop session 
startup, or something.

Original comment by kernc...@gmail.com on 4 Aug 2011 at 11:39

GoogleCodeExporter commented 9 years ago
yes, my problem is perhap's here, i run logkey throug system service, so always 
as root, also, i use log file system, so with root privilege.
So the best way, should be to use session startup to run logkeys, but how stop 
it after ?
I beleve, it should be have an pid file or something else who say session is 
opened, this could be a first start to know user in a basicaly and most 
environment, whit one keyboard?
like the "whoami" command, should be the best way, no ?
or google give this :
http://www.unix.com/programming/11755-who-current-user.html
http://www.google.fr/search?q=linux+know+current+user&ie=utf-8&oe=utf-8&aq=t&rls
=com.mandriva:en-US:unofficial&client=firefox-a

Original comment by surfz...@gmail.com on 5 Aug 2011 at 9:30

GoogleCodeExporter commented 9 years ago
hey, this could be good, no :
"/var/run/console"

Original comment by surfz...@gmail.com on 5 Aug 2011 at 9:49

GoogleCodeExporter commented 9 years ago
yes, something like that.
but for now, just start logkeys with desktop session.
use the script (/usr/local/logkeys-start.sh) mentioned here: 
http://code.google.com/p/logkeys/wiki/Documentation#Autorun_at_system_start.

put in the script something like:

logkeys --start --output=/home/$USER/logkeys.log

so it will create separate logkeys.log file in each user's home directory.

then you can start logkeys with desktop session by running 'llk' program (which 
executes that script).
the program will terminate by itself when you logout, but user switching (both 
users logged in at the same time) won't work.
you can also stop logkeys at anytime by running 'llkk' (which executes 
/usr/local/etc/logkeys-kill.sh).

Original comment by kernc...@gmail.com on 5 Aug 2011 at 1:16