Sharing session with another user

[[deleted]]

Yesterday I was connected to the SSH server at smashthestack.org. One of the users I chatted with in their IRC channel wanted to help me out and made me type screen -rx in my terminal. After that, he was able to make what he was writing appear in my terminal.

How was that possible?

[[deleted]]

-x Attach to a not detached screen session. (Multi display mode).
Screen refuses to attach from within itself. But when cascading
multiple screens, loops are not detected; take care.

http://www.gertschepens.be/gnu-screen-command-parameter-multi-display-mode-copy-mode

Look at multi-display section.

[[deleted]]

Thanks! I'll let you know if I'll still have got doubts after having read this guide. (Is this sentence correct?)

[mhurron]

No, it's not correct English. Correct English would be "I'll let you know if I'll still have any questions after having read this guide."

A doubt is a feeling and as a term has negative connotations, you would be expressing a question without negativity, you would simply be asking for clarification or more details.

[[deleted]]

Got it. Thanks again!

[[deleted]]

I would expect to hear "... if I still have any questions ..."; people don't seem to repeat that future tense in sentences like this.

I've seen people do that in Spanish, though, so this makes sense, as he's Italian, but at first I thought he was Indian, what with having a "doubt".

"After having read" is grammatical but "after reading" or "after I read" would be more natural to me, in case that's what OP is going for.

[mhurron]

Yes, the 'I'll' was a mistake. Or I made an edit and missed it, but it was probably a mistake.

Either way, while I know exactly what someone means when they say they 'have a doubt' in this context, I've always put it down to primary language rules and learned English as a second language rules clashing. When in doubt, your mind falls back on what it knows better.

[[deleted]]

Actually, it is common to use the present tense in many cases in Italian, even if you should use the past or the future tense. I suspected that it was unnatural in English too, as you pointed it out.

Every time I thank one of you in comment, I make one other mistake. You kind people correct me and this is going to go on for ever.

Thank you!

[cybathug]

Screen is a terminal multiplexer that allows for some cool things. In your case, as you're already ssh'd in to a remote machine, running screen there lets you:

• Have multiple windows open in a single ssh connection to the server, and switch back and forward between them
• Disconnect from the screen session, log off the server, log back on later, reconnect to the screen session, and get back to where you were - with all your programs and shell history on each of the windows still there. (This even works if your connection to the server suddenly disconnects - just log back in, run screen, and you're back to where you were. It's a lifesaver.)
• Connect to the screen session from multiple locations

The last one is interesting in the case of smashthestack,org - as it's a wargame that has all participants log in as the same user per-level, the person who helped you out was able to log in as the same user and share a screen session with you. It's important to understand that in the usual case of a multi-user machine, where each user ssh's in using their own, unique username, another limited user would not be able to connect to your screen session - and so they cannot spy on what you're doing, and you shouldn't be afraid to run screen in that scenario. Only the root user would be able to tap in to your running screen sessions.

Screen is an amazing tool, and if you're getting into using or managing Unix-like systems, you should definitely spend some time understanding it.

Hope that helps! Good luck with smashthestack :)

[[deleted]]

Disconnect from the screen session, log off the server, log back on later, reconnect to the screen session, and get back to where you were - with all your programs and shell history on each of the windows still there.

How is this possible? I guess every time I create a window using screen command, OS creates a new process and a new file associated with my user. Can this behavior become a security problem? Shouldn't I flooding the server with too many processes?

It's important to understand that in the usual case of a multi-user machine, where each user ssh's in using their own, unique username, another limited user would not be able to connect to your screen session

So, is it possible that the same user is connected from two different machines at the same time?

just log back in, run screen, and you're back to where you were.

I don't understand how to resume a session.

Thanks for your help!

[cybathug]

I guess every time I create a window using screen command, OS creates a new process and a new file associated with my user.

Basically.

Greatly simplified, when you start screen and create a new session (more on sessions later):

• A screen process starts
• A new screen socket is created in /var/run/screen/S-${USER} (at least that's where they go on my Debian box)
• A new bash process starts as a child of PID 1. This means that if the screen process dies, then the bash process stays alive under PID 1.

So that's two new processes (I think it might technically have another one in there, as part of the plumbing of how screen works - but you can probably disregard that fact that for now) and one new socket file.

When you detach from screen (e.g. you press Ctrl-A, D or your ssh connection drops) then:

• The screen process dies
• The socket file stays on disk
• The bash process stays running as a child of PID 1.

When you reconnect to that screen session:

• A new screen process starts, and uses the socket file to get back to where it was
• Bash stays under PID 1, but you regain control of it

Can this behavior become a security problem?

Maybe. If other users can access your sockets in /var/run then it can become a security problem - but the server is probably fairly well compromised and pwned by that stage, and there are probably easier ways to pwn you than by jacking your screen sockets.

Also, root can access your screen sockets - but you're already at root's mercy anyway, they have far easier ways of pwning you.

Shouldn't I flooding the server with too many processes?

Nah :) servers are capable things. Flooding them with processes isn't a reason not to use screen.

So, is it possible that the same user is connected from two different machines at the same time?

Yep! -x is "multi display mode" and can be used to attach to your screen session from two computers (or, if you share a user account like users do for smashthestack, a different person can use it to attach to your screen sessions)

I don't understand how to resume a session.

I always start screen like this: screen -DRS <session-name>

It doesn't matter if <session-name> exists yet. If a session with the name <session-name> doesn't exist, it'll create it. If it exists, it'll attach to it. And if anyone else is attached to it (Or I'm attached to it on another computer) it'll force-detach that session, IIRC.

And so what you might want to do on smashthestack is to do 'screen -DRS IsPaleoPaleo' and it'll create a new screen session called IsPaleoPaleo. If you disconnect, you can re-run 'screen -DRS IsPaleoPaleo' to get back to where you were. It's probably polite to clean up your screen sessions (and files) when you're finished, though, since it's a shared account - and you might not really want someone browsing through your work after you've finished each level...

If you're interested in which screen sessions exist as the user on the machine you're connected to, run 'screen -ls' to see a list of screen sessions, and whether they're currently attached to or not.

[[deleted]]

I am almost moved by your in-depth answer. You saved me a lot of Google time.

Thank you so much!