How to have sshd write passwords associated with login attempts in logs?

Question

I would like to gather common login/password pairs.

Currently, I have this in my system.log file:

sshd[9117]: error: PAM: authentication error for root from localhost via ::1

How can I have the password inside the logs ?

Edit: this is for my personal usage, on my own network, on which I am the only legitimate user.

score 3 · Answer 1 · answered Oct 28 '12 at 10:57

3

You can't. At least not with the standard ssh.
You need to edit the source code (auth.c is the file to look at) and recompile the software.

It is a damn stupid idea though, unless you are specifically building a honey-pot system.
Doing this violates the whole purpose of the secure shell.
The system-log is readable by most users on the system so as soon as somebody does log in he could read the other users passwords.

In some countries this is even prohibited by law. They threat this as a privacy violation. (Germany and some other European countries have such laws.)

answered Oct 28 '12 at 10:57

Tonny

6,332
1
18
31

Did you notice the honeypot tag? My goal is to open my network and play a little with those guys/bots that try to connect to my machine. – alecail Oct 28 '12 at 11:10
Why do you post repeated answes? First check what previews answers look like – Hex Oct 28 '12 at 11:31
1

@Antoine I have seen that. That's why I added "unless it's a honeypot". I wrote the answer to be of more general interest than just for you alone. After all... more people visit this site and might see the question+answer. – Tonny Oct 28 '12 at 12:21
@Hex I didn't see yours until after I submitted mine. – Tonny Oct 28 '12 at 18:51

score 2 · Answer 2 · answered Oct 28 '12 at 10:54

2

You can achieve this by patching the auth.c file of opensshd. But it is never a good idea to store passwords to a log file because you will end up logging successful logins too. There is an article talking about this issue here

You can also try to edit sshd_config and set the LogLevel of SyslogFacility to VERBOSE

SyslogFacility AUTH
LogLevel VERBOSE

and check if you can achieve anything

answered Oct 28 '12 at 10:54

Hex

1,949
11
17

2

As far as I know even the highest debug/loglevel doesn't divulge passwords. SSH would not be considered secure if you could do this. Any sysadmin would be able to change the setting and get at other users passwords. – Tonny Oct 28 '12 at 11:02
@Tonny: Correct! – Hex Oct 28 '12 at 19:00

score 2 · Accepted Answer · answered Oct 28 '12 at 11:30

2

Here someone describes an approach using PAM with a customized module. Haven't tried this myself, but it seems to be what you're looking for.

answered Oct 28 '12 at 11:30

Ansgar Wiechers

4,247
2
18
26

How to have sshd write passwords associated with login attempts in logs?

3 Answers3