Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

Is it possible on the server to log the password encoded by the remote user inside a log. I want to make a honeypot to see the type of user/password used.

share|improve this question
Can you provide more information about what you are trying to do? What do you mean by a honeypot? A honeypot is normally something that intentionally looks vulnerable but that should never normally be used so that anyone accessing it can be identified as an intruder. As for the original question about decrypting an SSH connection on the server, there are multiple ways this could be done based on what you are trying to accomplish and what type of configuration you are using. Some software supports it natively, also proxies could be used or a raw log could be dumped and decoded manually. – AJ Henderson Sep 19 '12 at 19:24
I want to see who i trying to connect with old passwords on shared user accounts ;) not a real honeypot in fact. Thanks ! – si2w Sep 19 '12 at 21:22

3 Answers

up vote 4 down vote accepted

Another method is to attach strace to the process (and it's children). Input/output will be logged there after decryption, yielding the password. In my experience this sort of thing works more reliably than mucking about with the log levels of sshd (but of course YMMV).

write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\nPassword: \0\0"..., 34) = 34
read(5, "\0\0\0\r", 4)                  = 4
read(5, "4\0\0\0\1\0\0\0\4asdf", 13)    = 13
share|improve this answer
up vote 4 down vote

If you run ssh in full debug mode you can have it log the content of all packets and then go back and extract the passwords from that. you can do this bu running 

ssh -dddddddd

or add it to your /etc/ssh/sshd_config:

LogLevel DEBUG3

this runs it once, in non-daemon mode and logs way more than you care about. you can improve this by disabling the sshd service and running ssh with the -ddddd from xinitd.

At work I currently maintain an open-ssh fork that includes this ability because it uses an external web service to verify the passwords. If you can afford to maintain an open-ssh fork it will likely give a cleaner experience.

share|improve this answer
Is it possible to define that inside the sshd_config ? – si2w Sep 19 '12 at 19:24
good point!, editing to add this. – Arthur Ulfeldt Sep 19 '12 at 19:38
It seems that DEBUG3 doesn't show the password : Failed password for invalid user xxxx from 192.168.xxx.xxx port 54120 ssh2. Do you know to integrate that inside the config ? – si2w Sep 19 '12 at 23:19
does it work for you when running sshd in debug more (-d) – Arthur Ulfeldt Sep 19 '12 at 23:21
it doesn't work for me. do you have another idea except fork openssh ;-) ? thanks – si2w Sep 19 '12 at 23:42
up vote 0 down vote

This is dramatically simpler to accomplish if you just modify the sshd binary to log password attempts either to a log file or to a remote logging service.

This is trivial to accomplish since the source code is availble and very well-written. In fact, attackers who get root level access on a server typically install modified ssh and sshd binaries that do exactly that! It should be simple to find source code patches out there if you have a look; I know I've seen the patch files show up on people's servers many times in the past.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.