In 1985 when I was working as a sys admin at the Basser Department of Computer Science at the University of Sydney with John Mackin we used to have the odd problem with bozo students who fancied their chances at hacking our VAX 11/780s. During the course of the day, to see what was going on, I'd regularly run:
ps -dfhy | sort | more
You'll be doing well if you know what the h and y options to ps were.
I had the programmable function keys on my Viewpoint VP90 (previously a Teleray T1062) programmed so that repetitive stuff like that was easy to do. The standard programming was:
Every once in a while this marvellous security tool would turn up something interesting.F1 ls -ltr F2 ls | mc F3 exec -sh F4 ps -dfhy | sort | more
One day I found Terry Jones, one of the honours students, trying to do some sort of hacking (password cracking, I think) and this swiftly lead to his machine access being suspended. He was in the middle of some sort important (to him) assignment or report or something and we later caught him using Suzy Deck's account. Suzy Deck was his girlfriend at the time.
We knew what the score was because our systems had ttyconnect(2) which would allow us to spy on or even take over other terminal sessions. Of course, you had to be root. As we suspected that Terry would use Suzy's account we'd have a bit of a squiz whenever she was logged on.
He had been warned to cease and desist but we thought this would prove fruitless. I had an idea of how to keep an eye on Terry and Suzy without having to lift a finger. It was beautiful.
My first idea was to copy /bin/pause to my bin directory and then to execute this thing with an argument of suzy. However there were problems; I had no idea what to call it and it would not consume any time, giving the impression that it did nothing. A small amount of C later and I had this program that put itself in the background, ignored signals and called sleep(3) in a loop.
A program that did absolutely nothing at all and you could see it with ps -fe:
Terry and Suzy meet terrify suzy.boyd 6501 6500 0 13:19:04 g26/h0 0:10 terrify suzy
A few days later, Jenny Seberry, their supervisor, came storming into g26 (our office) screaming her head off about this psy-ops campaign we were running against her poor, defenseless, little students. This continued until she was almost apoplectic -- over the program that did absolutely nothing at all. She was in such a state that she was in tears.
We laughed and laughed and laughed, which finally forced us to leave Madsen and go over to Wentworth.