Converting text on CLI to images using ImageMagick

In this article I'll demonstrate how we can convert the output of commands we type on the Linux command line to images using ImageMagick software. This software allows users to create and modify images. It's generally meant for use in an X windows environment but we'll be using it purely on the command line for the purposes of this article.

The ImageMagick software is not installed on Linux distributions by default but is available in the base repo so you don't have to search around for it.

Let's begin by installing the package.

[root@walk ~]# yum search ImageMagick
Loaded plugins: fastestmirror, security
Determining fastest mirrors
epel/metalink                                                                                                | 5.7 kB     00:00
 * base: ftp.iitm.ac.in
 * epel: ftp.yz.yamagata-u.ac.jp
 * extras: ftp.iitm.ac.in
 * jpackage-generic: sunsite.informatik.rwth-aachen.de
 * updates: ftp.iitm.ac.in
base                                                                                                         | 3.7 kB     00:00
epel                                                                                                         | 4.3 kB     00:00
epel/primary_db                                                                                              | 5.9 MB     01:15
extras                                                                                                       | 3.4 kB     00:00
jpackage-generic                                                                                             | 1.9 kB     00:00
spacewalk                                                                                                    | 2.1 kB     00:00
updates                                                                                                      | 3.4 kB     00:00
updates/primary_db                                                                                           | 3.1 MB     00:12
===================================================== N/S Matched: ImageMagick =====================================================
ImageMagick-c++.i686 : ImageMagick Magick++ library (C++ bindings)
ImageMagick-c++.x86_64 : ImageMagick Magick++ library (C++ bindings)
ImageMagick-c++-devel.i686 : C++ bindings for the ImageMagick library
ImageMagick-c++-devel.x86_64 : C++ bindings for the ImageMagick library
ImageMagick-devel.i686 : Library links and header files for ImageMagick app development
ImageMagick-devel.x86_64 : Library links and header files for ImageMagick app development
ImageMagick-doc.x86_64 : ImageMagick html documentation
ImageMagick-perl.x86_64 : ImageMagick perl bindings
GraphicsMagick.i686 : An ImageMagick fork, offering faster image generation and better quality
GraphicsMagick.x86_64 : An ImageMagick fork, offering faster image generation and better quality
ImageMagick.i686 : An X application for displaying and manipulating images
ImageMagick.x86_64 : An X application for displaying and manipulating images
php-magickwand.x86_64 : PHP API for ImageMagick
php-pecl-imagick.x86_64 : Provides a wrapper to the ImageMagick library

  Name and summary matches only, use "search all" for everything.

  
[root@walk ~]# yum install ImageMagick -y
Loaded plugins: fastestmirror, security
Setting up Install Process
Loading mirror speeds from cached hostfile
 * base: ftp.iitm.ac.in
 * epel: ftp.yz.yamagata-u.ac.jp
 * extras: ftp.iitm.ac.in
 * jpackage-generic: sunsite.informatik.rwth-aachen.de
 * updates: ftp.iitm.ac.in
Resolving Dependencies
--> Running transaction check
---> Package ImageMagick.x86_64 0:6.7.2.7-6.el6 will be installed
--> Processing Dependency: libwmflite-0.2.so.7()(64bit) for package: ImageMagick-6.7.2.7-6.el6.x86_64
--> Processing Dependency: libwmf-0.2.so.7()(64bit) for package: ImageMagick-6.7.2.7-6.el6.x86_64
--> Processing Dependency: librsvg-2.so.2()(64bit) for package: ImageMagick-6.7.2.7-6.el6.x86_64
--> Processing Dependency: libltdl.so.7()(64bit) for package: ImageMagick-6.7.2.7-6.el6.x86_64
--> Processing Dependency: libImath.so.6()(64bit) for package: ImageMagick-6.7.2.7-6.el6.x86_64
--> Processing Dependency: libIlmThread.so.6()(64bit) for package: ImageMagick-6.7.2.7-6.el6.x86_64
--> Processing Dependency: libIlmImf.so.6()(64bit) for package: ImageMagick-6.7.2.7-6.el6.x86_64
--> Processing Dependency: libIex.so.6()(64bit) for package: ImageMagick-6.7.2.7-6.el6.x86_64
--> Processing Dependency: libHalf.so.6()(64bit) for package: ImageMagick-6.7.2.7-6.el6.x86_64
--> Running transaction check
---> Package OpenEXR-libs.x86_64 0:1.6.1-8.1.el6 will be installed
---> Package ilmbase.x86_64 0:1.0.1-6.1.el6 will be installed
---> Package librsvg2.x86_64 0:2.26.0-14.el6 will be installed
--> Processing Dependency: libgsf >= 1.6.0 for package: librsvg2-2.26.0-14.el6.x86_64
--> Processing Dependency: libgsf-1.so.114()(64bit) for package: librsvg2-2.26.0-14.el6.x86_64
--> Processing Dependency: libcroco-0.6.so.3()(64bit) for package: librsvg2-2.26.0-14.el6.x86_64
---> Package libtool-ltdl.x86_64 0:2.2.6-15.5.el6 will be installed
---> Package libwmf.x86_64 0:0.2.8.4-25.el6_7 will be installed
---> Package libwmf-lite.x86_64 0:0.2.8.4-25.el6_7 will be installed
--> Running transaction check
---> Package libcroco.x86_64 0:0.6.2-5.el6 will be installed
---> Package libgsf.x86_64 0:1.14.15-5.el6 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

====================================================================================================================================
 Package                          Arch                       Version                                 Repository                Size
====================================================================================================================================
Installing:
 ImageMagick                      x86_64                     6.7.2.7-6.el6                           base                     1.9 M
Installing for dependencies:
 OpenEXR-libs                     x86_64                     1.6.1-8.1.el6                           base                     197 k
 ilmbase                          x86_64                     1.0.1-6.1.el6                           base                      72 k
 libcroco                         x86_64                     0.6.2-5.el6                             base                     100 k
 libgsf                           x86_64                     1.14.15-5.el6                           base                     116 k
 librsvg2                         x86_64                     2.26.0-14.el6                           base                     140 k
 libtool-ltdl                     x86_64                     2.2.6-15.5.el6                          base                      44 k
 libwmf                           x86_64                     0.2.8.4-25.el6_7                        base                     132 k
 libwmf-lite                      x86_64                     0.2.8.4-25.el6_7                        base                      51 k

Transaction Summary
====================================================================================================================================
Install       9 Package(s)

Total download size: 2.7 M
Installed size: 9.8 M
Downloading Packages:
(1/9): ImageMagick-6.7.2.7-6.el6.x86_64.rpm                                                                  | 1.9 MB     00:07
(2/9): OpenEXR-libs-1.6.1-8.1.el6.x86_64.rpm                                                                 | 197 kB     00:03
(3/9): ilmbase-1.0.1-6.1.el6.x86_64.rpm                                                                      |  72 kB     00:00
(4/9): libcroco-0.6.2-5.el6.x86_64.rpm                                                                       | 100 kB     00:00
(5/9): libgsf-1.14.15-5.el6.x86_64.rpm                                                                       | 116 kB     00:00
(6/9): librsvg2-2.26.0-14.el6.x86_64.rpm                                                                     | 140 kB     00:01
(7/9): libtool-ltdl-2.2.6-15.5.el6.x86_64.rpm                                                                |  44 kB     00:00
(8/9): libwmf-0.2.8.4-25.el6_7.x86_64.rpm                                                                    | 132 kB     00:00
(9/9): libwmf-lite-0.2.8.4-25.el6_7.x86_64.rpm                                                               |  51 kB     00:00
------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                               111 kB/s | 2.7 MB     00:25
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
Warning: RPMDB altered outside of yum.
  Installing : ilmbase-1.0.1-6.1.el6.x86_64                                                                                     1/9
  Installing : libwmf-lite-0.2.8.4-25.el6_7.x86_64                                                                              2/9
  Installing : libwmf-0.2.8.4-25.el6_7.x86_64                                                                                   3/9
  Installing : OpenEXR-libs-1.6.1-8.1.el6.x86_64                                                                                4/9
  Installing : libtool-ltdl-2.2.6-15.5.el6.x86_64                                                                               5/9
  Installing : libgsf-1.14.15-5.el6.x86_64                                                                                      6/9
  Installing : libcroco-0.6.2-5.el6.x86_64                                                                                      7/9
  Installing : librsvg2-2.26.0-14.el6.x86_64                                                                                    8/9
  Installing : ImageMagick-6.7.2.7-6.el6.x86_64                                                                                 9/9
  Verifying  : libwmf-lite-0.2.8.4-25.el6_7.x86_64                                                                              1/9
  Verifying  : librsvg2-2.26.0-14.el6.x86_64                                                                                    2/9
  Verifying  : ImageMagick-6.7.2.7-6.el6.x86_64                                                                                 3/9
  Verifying  : libwmf-0.2.8.4-25.el6_7.x86_64                                                                                   4/9
  Verifying  : libcroco-0.6.2-5.el6.x86_64                                                                                      5/9
  Verifying  : OpenEXR-libs-1.6.1-8.1.el6.x86_64                                                                                6/9
  Verifying  : libgsf-1.14.15-5.el6.x86_64                                                                                      7/9
  Verifying  : libtool-ltdl-2.2.6-15.5.el6.x86_64                                                                               8/9
  Verifying  : ilmbase-1.0.1-6.1.el6.x86_64                                                                                     9/9

Installed:
  ImageMagick.x86_64 0:6.7.2.7-6.el6

Dependency Installed:
  OpenEXR-libs.x86_64 0:1.6.1-8.1.el6       ilmbase.x86_64 0:1.0.1-6.1.el6              libcroco.x86_64 0:0.6.2-5.el6
  libgsf.x86_64 0:1.14.15-5.el6             librsvg2.x86_64 0:2.26.0-14.el6             libtool-ltdl.x86_64 0:2.2.6-15.5.el6
  libwmf.x86_64 0:0.2.8.4-25.el6_7          libwmf-lite.x86_64 0:0.2.8.4-25.el6_7

Complete!
[root@walk ~]#

With the package and it's dependencies installed let's query the rpm to get some information about the package.

[root@walk ~]# rpm -qa | grep -i Image

genisoimage-1.1.9-12.el6.x86_64

ImageMagick-6.7.2.7-6.el6.x86_64

[root@walk ~]# rpm -qi ImageMagick-6.7.2.7-6.el6.x86_64

Name        : ImageMagick                  Relocations: (not relocatable)

Version     : 6.7.2.7                           Vendor: CentOS

Release     : 6.el6                         Build Date: Wed 22 Mar 2017 04:54:38 PM IST

Install Date: Sat 26 Aug 2017 12:35:53 AM IST      Build Host: c1bm.rdu2.centos.org

Group       : Applications/Multimedia       Source RPM: ImageMagick-6.7.2.7-6.el6.src.rpm

Size        : 7321917                          License: ImageMagick

Signature   : RSA/SHA1, Thu 23 Mar 2017 08:28:57 PM IST, Key ID 0946fca2c105b9de

Packager    : CentOS BuildSystem <http://bugs.centos.org>

URL         : http://www.imagemagick.org/

Summary     : An X application for displaying and manipulating images

Description :

ImageMagick is an image display and manipulation tool for the X

Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF,

and Photo CD image formats. It can resize, rotate, sharpen, color

reduce, or add special effects to an image, and when finished you can

either save the completed work in the original format or a different

one. ImageMagick also includes command line programs for creating

animated or transparent .gifs, creating composite images, creating

thumbnail images, and more.

ImageMagick is one of your choices if you need a program to manipulate

and display images. If you want to develop your own applications

which use ImageMagick code or APIs, you need to install

ImageMagick-devel as well.

The ImageMagick software provides the convert command which I found very diverse because it allows the user to draw, crop and resize images along with many other things. You can get more information about it by going through the man page.

[root@walk ~]# which convert

/usr/bin/convert

[root@walk ~]#

I intended to use the convert command along with the label feature to pipe out the STDOUT of a command run on the shell to draw that text on an image. 

I tried hard to get this to work but I kept getting the below error while testing.

After a lot of frantic searching I came to know that using the labels feature has been deliberately disabled in RedHat Linux/CentOS systems. I cannot comment on the authenticity of this but after reading it I began to look for alternatives to achieve the desired outcome with convert and without using label.

Finally after a lot of searching I came up with this one liner that did the job:

convert -size 1000x600 -gravity Northwest xc:khaki -font Courier-Bold -fill black  -pointsize 18 -draw "text 5,15 '$(cat /etc/passwd)'" passwd.png

This command generated the following passwd.png image in the current working directory of my CenOS system.

Let's deconstruct the above convert command options:

-size option determines the size of the image.

-gravity option determines the position of text on the image.

-xc option decides the image background or the canvas color.

-font option determines the font type of the text being drawn on the image.

-fill option decides the text color.

-pointsize determines the font size of the text being drawn.

-draw option provides the text to be drawn on the image.

For this demonstration I've done a command substitution of the "fdisk -l" command output to serve as the text to be drawn on the image.

The final parameter passwd.png is the name we'd like for the resulting image.

We can use the list flag with the convert keyword to view the available options for the various flag that we use.

For example:

[root@walk ~]# convert -list font | less

[root@walk ~]#

[root@walk ~]# convert -list gravity

None

Center

East

Forget

NorthEast

North

NorthWest

SouthEast

South

SouthWest

West

Static

Let's take another example changing a few of the options. Let's create an image with the output of "cat /etc/passwd" command.

convert -size 1000x600 -gravity Northwest xc:khaki -font Courier-Bold -fill black  -pointsize 18 -draw "text 5,15 '$(cat /etc/passwd)'" passwd.png

This time I modified the image size, canvas color and font size along with the text to be drawn as I anticipated the output to be larger thereby requiring a larger canvas to display the text.

If we could use labels then the label feature would autosize the text for us to fit on the image.

We can easily change the image format by simply changing the extension of the final image to be created.

To validate, let's create a JPEG image of the df -h command output.

[root@walk ~]# convert -size 700x200 -gravity Northwest xc:white -font Courier-Bold -fill blue  -pointsize 18  -draw "text 5,15 '$(df -h)'" df.jpeg

This command generates the below image:

I hope you found this article useful and perhaps ImageMagick gave you some interesting ideas.

Script to convert script command output to animated GIF

While looking around for some nice terminal recording tools for the Linux terminal I came across a neat script on github which could take in the timing information & command output files from the popular script command & convert it to a neat GIF file.

The script has two dependencies:

1. It runs only from within a terminal opened under x-windows direct console GUI.
2. It requires ImageMagick-c++ & ImageMagick to be installed.

Here is the script:


#!/bin/bash

# origin from http://blog.fedora-fr.org/metal3d/post/typescript-to-gif
# modified by tgic to specified output file


# http://www.imagemagick.org/script/command-line-options.php#limit
CONVERTARG="-limit memory 32MiB -limit map 64MiB"

TIMING=$1
SCRIPT=$2
OUTPUT=$3
W=$WINDOWID

if [ ! -f "$TIMING" ] || [ ! -f "$SCRIPT" ] || [ "$OUTPUT" == "" ]
then
    echo "usage: $0 TIMING SCRIPT OUTPUT"
    exit
fi

if [ "$W" == "" ]
then
    echo 'No window found use xvtypescripttogif instead'
    exit
fi

WORKDIR=$(mktemp -d)

t=$(mktemp)
cp $SCRIPT $t

#remove first line
sed -i '1d' $t

#clear screen
clear

#read timing file one by one
curr=0
i=0
while read line
do
    #capture time and chars to read
    cols=($line)
    chars=${cols[1]}

    #read from current char the number of chars to read
    dd if=$t bs=1 skip=$curr count=$chars 2>/dev/null

    #convert to gif frame with a nice frame-number
    n=$(printf "%010d" $i)
    import -window $WINDOWID $WORKDIR/$n.gif

    #and move to next position
    curr=$((curr+chars))
    i=$((i+1))
done <$TIMING
rm -f $t

#now, set gif with delay per frame
i=1
while read line
do
    cols=($line)
    timing=${cols[0]}
    #get next image
    file=$(ls -1 $WORKDIR | head -n $i | tail -n 1)
    timing=$(echo "$timing*100" | bc -l | awk '{print int($0)}')
    command=$command" -delay $timing $WORKDIR/$file"

    i=$((i+1))
done < $TIMING


convert $CONVERTARG $command $WORKDIR/anim-notoptim.gif
convert $CONVERTARG $WORKDIR/anim-notoptim.gif -coalesce -layers Optimize $OUTPUT

rm -rf $WORKDIR


To use it, first run the script command as follows:

[root@cserver ~]# script -t 2> time.txt cmd.txt
Script started, file is cmd.txt
[root@cserver ~]# echo "lets see how this goes"
lets see how this goes
[root@cserver ~]# echo "testing the typescript"
testing the typescript
[root@cserver ~]# exit
exit
Script done, file is cmd.txt

Now supply the time.txt & cmd.txt files as arguments to the conversion script & specify out.gif as the output file.

./typeconv.sh time.txt cmd.txt out.gif

This will replay the commands & create an out.gif file.

Here is the out.gif file created a result of the execution of the script:

Note that the resulting gif does not execute in a infinite loop. It runs only once.

Using TermRecord for recording terminal sessions

I recently used TermRecord & found it to be an awesome lightweight & fast tool for terminal recording.The installation was fairly simple. TermRecord is a program that wraps the script command. It automatically detects your terminal size, records your session, and stores the output as either JSON, embeddable JavaScript, or a static HTML file. The HTML is completely self-contained, embedding all necessary dependencies in one file and can be shipped to anyone that has a modern browser.

You can store these files as your own notes or use them as instructional examples, or whatever you want! 

I downloaded the source code from https://pypi.python.org/pypi/TermRecord.

I extracted the source code:

[root@cserver ~]# cd TermRecord-1.2.4/
[root@cserver TermRecord-1.2.4]# ls
bin  MANIFEST.in  PKG-INFO  setup.cfg  setup.py  termrecord  TermRecord.egg-info

Then I ran setup.py to install the package:

[root@cserver TermRecord-1.2.4]# python setup.py install

running install

running bdist_egg

running egg_info

writing requirements to TermRecord.egg-info/requires.txt

writing TermRecord.egg-info/PKG-INFO

writing top-level names to TermRecord.egg-info/top_level.txt

writing dependency_links to TermRecord.egg-info/dependency_links.txt

reading manifest file 'TermRecord.egg-info/SOURCES.txt'

reading manifest template 'MANIFEST.in'

writing manifest file 'TermRecord.egg-info/SOURCES.txt'

installing library code to build/bdist.linux-x86_64/egg

running install_lib

running build_py

creating build

creating build/lib

creating build/lib/termrecord

copying termrecord/__init__.py -> build/lib/termrecord

creating build/lib/termrecord/templates

copying termrecord/templates/dynamic.jinja2 -> build/lib/termrecord/templates

copying termrecord/templates/base.jinja2 -> build/lib/termrecord/templates

copying termrecord/templates/static.jinja2 -> build/lib/termrecord/templates

creating build/bdist.linux-x86_64

creating build/bdist.linux-x86_64/egg

creating build/bdist.linux-x86_64/egg/termrecord

copying build/lib/termrecord/__init__.py -> build/bdist.linux-x86_64/egg/termrecord

creating build/bdist.linux-x86_64/egg/termrecord/templates

copying build/lib/termrecord/templates/dynamic.jinja2 -> build/bdist.linux-x86_64/egg/termrecord/templates

copying build/lib/termrecord/templates/base.jinja2 -> build/bdist.linux-x86_64/egg/termrecord/templates

copying build/lib/termrecord/templates/static.jinja2 -> build/bdist.linux-x86_64/egg/termrecord/templates

byte-compiling build/bdist.linux-x86_64/egg/termrecord/__init__.py to __init__.pyc

creating build/bdist.linux-x86_64/egg/EGG-INFO

installing scripts to build/bdist.linux-x86_64/egg/EGG-INFO/scripts

running install_scripts

running build_scripts

creating build/scripts-2.7

copying and adjusting bin/TermRecord -> build/scripts-2.7

changing mode of build/scripts-2.7/TermRecord from 644 to 755

creating build/bdist.linux-x86_64/egg/EGG-INFO/scripts

copying build/scripts-2.7/TermRecord -> build/bdist.linux-x86_64/egg/EGG-INFO/scripts

changing mode of build/bdist.linux-x86_64/egg/EGG-INFO/scripts/TermRecord to 755

copying TermRecord.egg-info/PKG-INFO -> build/bdist.linux-x86_64/egg/EGG-INFO

copying TermRecord.egg-info/SOURCES.txt -> build/bdist.linux-x86_64/egg/EGG-INFO

copying TermRecord.egg-info/dependency_links.txt -> build/bdist.linux-x86_64/egg/EGG-INFO

copying TermRecord.egg-info/requires.txt -> build/bdist.linux-x86_64/egg/EGG-INFO

copying TermRecord.egg-info/top_level.txt -> build/bdist.linux-x86_64/egg/EGG-INFO

zip_safe flag not set; analyzing archive contents...

termrecord.__init__: module references __file__

creating dist

creating 'dist/TermRecord-1.2.4-py2.7.egg' and adding 'build/bdist.linux-x86_64/egg' to it

removing 'build/bdist.linux-x86_64/egg' (and everything under it)

Processing TermRecord-1.2.4-py2.7.egg

creating /usr/lib/python2.7/site-packages/TermRecord-1.2.4-py2.7.egg

Extracting TermRecord-1.2.4-py2.7.egg to /usr/lib/python2.7/site-packages

Adding TermRecord 1.2.4 to easy-install.pth file

Installing TermRecord script to /usr/bin

Installed /usr/lib/python2.7/site-packages/TermRecord-1.2.4-py2.7.egg

Processing dependencies for TermRecord==1.2.4

Searching for Jinja2==2.7.2

Best match: Jinja2 2.7.2

Adding Jinja2 2.7.2 to easy-install.pth file

Using /usr/lib/python2.7/site-packages

Searching for MarkupSafe==0.11

Best match: MarkupSafe 0.11

Adding MarkupSafe 0.11 to easy-install.pth file

Using /usr/lib64/python2.7/site-packages

Finished processing dependencies for TermRecord==1.2.4

The TermRecord binary was copied to /usr/bin.

Using TermRecord is fairly simple. Just specify the TermRecord command followed by -o & path to the output html file. Run the commands you'd like to record & type exit.

[root@cserver TermRecord-1.2.4]# TermRecord -o /tmp/test.html

Script started, file is /tmp/tmp4C9Aj3

[root@cserver TermRecord-1.2.4]# echo "This is strictly a test"

This is strictly a test

[root@cserver TermRecord-1.2.4]# echo "testing to see if TermRecord works!!"

echo "testing to see if TermRecord worksecho "This is strictly a test""

testing to see if TermRecord worksecho This is strictly a test

[root@cserver TermRecord-1.2.4]# exit

exit

Script done, file is /tmp/tmp4C9Aj3

Record & Replay superuser sessions with sudoreplay & sudossh

In this article I'll talk about two methods to record & replay terminal activity for commands executed as root user & replay the session at a later time.

• Method 1: Update required entries in sudoers file & replay the session using sudoreplay.
• Method 2: Use sudosh as a shell to record sessions and replay them with sudosh-replay.

Method 1: Using sudo/sudoreplay:

Sudo command logging is not enabled by default. To enable it add the following entries in /etc/sudoers file:

• log_output
• log_input
• iolog_dir

Here is a sample entry for users test & test1 in /etc/sudoers file:

Defaults:test,test1 log_output
Defaults:test,test1 log_input

Defaults iolog_dir=/var/log/sudo-io/%{user}

• log_output : log command output activity
• log_input: log command input activity
• ilog_dir: path to save session output

That's it. The next time the user logs in & executes command with sudo privileges, they will be logged & saved in /var/log/sudo-io/<user name> file.

Method 2: Using sudosh

The source code for sudosh can be obtained from github & is compatible with a wide range of *nix platforms. Sudosh was designed specifically to be used in conjunction with sudo or by itself as a login shell. 

Installation:

Download the source code from githhub. Compile & install the package:

1) ./configure

2) make

3) make install

4) sudosh -i

Usage:

To start logging via sudosh type the following command:

#sudo /usr/local/bin/sudosh

You can also add an entry in /etc/sudoers file as follows (example taken from README file):

-- /etc/sudoers begin --

User_Alias      ADMINS=admin1,admin2,admin3

User_Alias      DBAS=dba1,dba2,dba3

Cmnd_Alias      SUDOSH=/usr/local/bin/sudosh

ADMINS          ALL=SUDOSH

DBAS            ALL=(oracle)/usr/local/bin/sudosh

To start a sudosh logging session type /usr/local/bin/sudosh or sudo /usr/local/bin/sudosh on the command line & it'll start logging your session. To stop logging type exit.

The session logs get saved in /var/log/sudosh:

[root@centdb ttyrec-1.0.8]# ls -l /var/log/sudosh

total 24

-rw------- 1 root  root  714 Sep 21 21:48 root-root-script-1474519688-QGv8iZ9sXKhs830a

-rw------- 1 root  root  371 Sep 21 21:48 root-root-time-1474519688-QGv8iZ9sXKhs830a

-rw------- 1 test1 test1 380 Sep 22 01:24 root-test1-script-1474532682-LmbZCWgpi5xXBrrc

-rw------- 1 test1 test1 338 Sep 22 01:24 root-test1-time-1474532682-LmbZCWgpi5xXBrrc

-rw------- 1 test  test  617 Sep 21 21:53 root-test-script-1474519973-Y9mXUS3t2UY4wzl9

-rw------- 1 test  test  172 Sep 21 21:53 root-test-time-1474519973-Y9mXUS3t2UY4wzl9

To replay a session, first type sudosh-replay on the command line to get a list of available sessions.

[root@centdb ttyrec-1.0.8]# sudosh-replay

Date                Duration From         To           ID

====                ======== ====         ==           ==

09/21/2016 21:48:08 22s      root         root         root-root-1474519688-QGv8iZ9sXKhs830a

09/21/2016 21:52:53 8s       root         test         root-test-1474519973-Y9mXUS3t2UY4wzl9

09/22/2016 01:24:42 10s      root         test1        root-test1-1474532682-LmbZCWgpi5xXBrrc

Usage: sudosh-replay ID [MULTIPLIER] [MAXWAIT]

See 'sudosh-replay -h' for more help.

Example: sudosh-replay root-test1-1474532682-LmbZCWgpi5xXBrrc 1 2

Then from the ID column select the session you want to play & replay the session by typing sudosh followed by ID as in the example below:

[root@centdb ttyrec-1.0.8]# sudosh-replay root-test1-1474532682-LmbZCWgpi5xXBrrc

This will replay the recording of the session.

Demo:

Logging terminal activity with TILT & snoopy

In this article I'll explore usage to TILT & snoopy tools for logging terminal activity.

TILT (terminal interaction logging tool):

tilt logs user activity on the terminal via telnet/ssh to log files provided users login the systems using the telnet/ssh variants provided by tilt during the installation process. tilt provides a dumplog command using which we can view commands executed along with their output in the log as if they were executed on the terminal.

Installation:

tilt source code tilt-0.1.1.tgz can be downloaded from here. Once downloaded extract the source code.

# tar xvf tilt-0.1.1.tgz

Add a new user named tilt & create the directory /var/log/tilt.

#useradd tilt
#mkdir /var/log/tilt
#chmod 777 /var/log/tilt
# ls -ld /var/log/tilt
drwxrwxrwx 3 root root 4096 Sep 21 19:59 /var/log/tilt

To install the package run configure followed by make & make install.

#./configure

#make 

#make install

Usage:

Installing tilt will create the following binaries:

[root@centdb tilt-0.1.1]# ls -l /usr/local/tilt/bin/telnet

---s--x--x 1 tilt root 35472 Sep 21 19:56 /usr/local/tilt/bin/telnet

[root@centdb tilt-0.1.1]# ls -l /usr/local/tilt/bin/ssh

---s--x--x 1 tilt root 35472 Sep 21 19:56 /usr/local/tilt/bin/ssh

[root@centdb tilt-0.1.1]# ls -l /usr/local/tilt/bin/bash

---s--x--x 1 tilt root 35472 Sep 21 19:56 /usr/local/tilt/bin/bash

So, now to log a terminal session started via ssh, the user would need to use /usr/local/tilt/bin/ssh to initiate the ssh session. For example:

[root@centdb ~]# /usr/local/tilt/bin/ssh test@centdb

test@centdb's password:

Last login: Tue Sep 20 00:43:52 from centdb

[test@centdb ~]$ whoami

test

[test@centdb ~]$ date

Wed Sep 21 19:59:54 PDT 2016

[test@centdb ~]$ uptime

 19:59:56 up 6 min,  2 users,  load average: 0.08, 0.32, 0.18

[test@centdb ~]$ exit

logout

Connection to centdb closed.

Once the session is terminated a log of the session will be generated in /var/log/tilt.

[root@centdb ~]# ls -l /var/log/tilt/2016-09-21/

total 4

-r--r----- 1 tilt root 1949 Sep 21 19:59 B-root-2016-09-21-19:59:46--usr-local-tilt-bin-ssh test@centdb

[root@centdb ~]#

To view the contents of the log file use dumplog command provided as part of tilt installation.

[root@centdb ~]# /usr/local/tilt/bin/dumplog /var/log/tilt/2016-09-21/B-root-2016-09-21-19\:59\:46--usr-local-tilt-bin-ssh\ test\@centdb

test@centdb's password:

Last login: Tue Sep 20 00:43:52 from centdb

[test@centdb ~]$ whoami

test

[test@centdb ~]$ date

Wed Sep 21 19:59:54 PDT 2016

[test@centdb ~]$ uptime

 19:59:56 up 6 min,  2 users,  load average: 0.08, 0.32, 0.18

[test@centdb ~]$ exit

logout

Connection to centdb closed.

[root@centdb ~]#

Snoopy to log command line interaction:

Snoopy is designed to increase visibility of user activity being performed on the system by providing a log of commands  executed. Snoopy is completely transparent  to the user and applications it hooks in as a library providing a wrapper around calls to execve() calls. Logging is done via syslogd and written to authpriv allowing secure off site logging of activity. This article serves as a brief introduction towards snoopy usage. A more in depth article can be found here.

Installation:

You can get the snoopy source code from github & the rpm variant is available in the EPEL repository. I went with the rpm way.

[root@centdb /]# rpm -ivh snoopy-1.7.10-1.el6.x86_64.rpm

warning: snoopy-1.7.10-1.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID 0608b895: NOKEY

Preparing...                ########################################### [100%]

   1:snoopy                 ########################################### [100%]

[root@centdb /]#

Snoopy can be enabled in one of two ways:

1) To enable for the whole system with a global preload.

echo "/lib64/snoopy.so" >> /etc/ld.so.preload

2) To enable in user space for a particular user then

   set LD_PRELOAD=/lib64/snoopy.so

Afterwards logs will be made via syslog to  /var/log/secure

Usage:

I updated my systems' /etc/ld.so.preload file to add an entry for snoopy.

[root@centdb sudosh]# cat /etc/ld.so.preload

/lib64/snoopy.so

I started a new session & ran a couple of commands & I could see the commands being logged in /var/log/secure. Here's a log snippet:

Sep 21 20:17:55 centdb snoopy[10094]: [uid:0 sid:10006 tty:/dev/pts/0 cwd:/root filename:/bin/ls]: ls --color=auto

Sep 21 20:18:00 centdb snoopy[10107]: [uid:0 sid:10006 tty:/dev/pts/0 cwd:/root filename:/usr/bin/whoami]: whoami

Sep 21 20:18:02 centdb snoopy[10113]: [uid:0 sid:10006 tty:/dev/pts/0 cwd:/root filename:/usr/bin/uptime]: uptime

Sep 21 20:18:46 centdb snoopy[10203]: [uid:0 sid:10006 tty:/dev/pts/0 cwd:/root filename:/usr/bin/sudo]: sudo su - test

Logging terminal activity with tlog

While researching for ways to record & replay a ssh terminal session, I came across a tool called tlog.
`Tlog` is a terminal I/O recording and playback package & I have come across other different ways to accomplish this. But the way tlog differs from these utilities lies in the fact that log is essentially designed to be used a centralized user activity logging mechanism.
The makers have mentioned in the README file that presently tlog is not a production ready software & should be considered as a development preview only.
Under default settings tlog sends its recorded sessions to a centralized recording facility (syslog). Its recordings can also be re-directed to ElasticSearch. The recordings are in JSON format.

`Tlog` is naturally split into two tools: `tlog-rec` and `tlog-play` - for recording and playback respectively. `Tlog-rec` is intended to be the user's login shell. It puts itself between the actual user's shell and the terminal upon user login, logging everything that passes through. At the moment,
`tlog-play` can playback recordings from ElasticSearch or from a file written by `tlog-rec` with `file` writer selected.

Testing

You can test that session recording and playback work in general by recording
into and playing back from a file.

To record into a file execute tlog-rec on the command line as such:

    tlog-rec --writer=file --file-path=tlog.log

After exiting the recorded session you can play it back with tlog-play:

    tlog-play --reader=file --file-path=tlog.log

Recommended usage:

Change the shell of the user to be recorded to `tlog-rec`:

    sudo chsh -s /usr/bin/tlog-rec <user>

Login as the user on a text terminal. The recorded terminal data will be

delivered to syslog with facility "authpriv" and priority "info", and may

appear in `/var/log/auth.log` on Debian-based systems, or in `/var/log/secure`

on Fedora and derived systems.

Demo:

I first tried with the recommended usage & created a user called test & changed the shell.

[root@centops log]# getent passwd test

test:x:501:501::/home/test:/usr/bin/tlog-rec

I then logged in to the server as test user & ran a couple of commands & exited.

The session output did get saved to /var/log/secure file on my centos 6 server but not in a very readable format:

Sep 21 10:30:40 centops tlog: {"host":"centops","user":"test","session":7,"id":1,"pos":0,"timing":"=120x45+14>45+1642<1+2>1+93<1+1>1+129<1+2>1+64<1+2>1+247<1+3>1+588<1+1>2+5>318+956<1+2>1+186<1+3>1+227<1+2>1+189<1+3>1+153<1+2>1+157<1+3>1+402<1+2>73+1302<1+2>1+187<1+2>1+219<1+4>1+431<1+1>1+157<1+2>1+248<1+2>1+280<1+1>45+1366<1+1>8","in_txt":"df -h\rwhomai\rwhoami\r\u0004","in_bin":[],"out_txt":"\u001b]0;test@centops:~\u0007\u001b[?1034h[test@centops ~]$ df -h\r\nFilesystem            Size  Used Avail Use% Mounted on\r\n/dev/sda2              18G  9.4G  7.2G  57% /\r\ntmpfs                 491M   68K  491M   1% /dev/shm\r\n/dev/sda1             283M   34M  234M  13% /boot\r\n/dev/mapper/vg01-lv00\r\n                      2.0G  352M  1.5G  19% /R_D\r\n\u001b]0;test@centops:~\u0007[test@centops ~]$ whomai\r\n-bash: whomai: command not found\r\n\u001b]0;test@centops:~\u0007[test@centops ~]$ whoami\r\ntest\r\n\u001b]0;test@centops:~\u0007[test@centops ~]$ logout\r\n","out_bin":[]}

Sep 21 10:30:40 centops su: pam_unix(su-l:session): session closed for user test

It seems that the timing & character information along with session output is being re-directed together to a single file.

To replay the session via tlog-play I needed to extract the session log from the /var/log/secure file, remove the time stamp & put it in a new file & then play the recording:

Here's the log extracted & put into a file:

[root@centops ~]# cat t.log

{"host":"centops","user":"test","session":7,"id":1,"pos":0,"timing":"=120x45+14>45+1642<1+2>1+93<1+1>1+129<1+2>1+64<1+2>1+247<1+3>1+588<1+1>2+5>318+956<1+2>1+186<1+3>1+227<1+2>1+189<1+3>1+153<1+2>1+157<1+3>1+402<1+2>73+1302<1+2>1+187<1+2>1+219<1+4>1+431<1+1>1+157<1+2>1+248<1+2>1+280<1+1>45+1366<1+1>8","in_txt":"df -h\rwhomai\rwhoami\r\u0004","in_bin":[],"out_txt":"\u001b]0;test@centops:~\u0007\u001b[?1034h[test@centops ~]$ df -h\r\nFilesystem            Size  Used Avail Use% Mounted on\r\n/dev/sda2              18G  9.4G  7.2G  57% /\r\ntmpfs                 491M   68K  491M   1% /dev/shm\r\n/dev/sda1             283M   34M  234M  13% /boot\r\n/dev/mapper/vg01-lv00\r\n                      2.0G  352M  1.5G  19% /R_D\r\n\u001b]0;test@centops:~\u0007[test@centops ~]$ whomai\r\n-bash: whomai: command not found\r\n\u001b]0;test@centops:~\u0007[test@centops ~]$ whoami\r\ntest\r\n\u001b]0;test@centops:~\u0007[test@centops ~]$ logout\r\n","out_bin":[]}

Here's a quick demo of the playback: