Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to improve my SSH log. I would like to basically be able to see failed attempts with ip address and the password used. is that possible?

Right now I see something like this:

Failed password for invalid user root from port 60831 ssh2
Failed password for invalid user root from port 56180 ssh2
Failed password for invalid user root from port 56822 ssh2
share|improve this question
You really don't want to log bad passwords. If you typo your password and the log is later leaked, someone could easily guess it. It's a privacy and security nightmare. – Polynomial Nov 28 '12 at 14:42
totally right. Thanks! – whynot Nov 28 '12 at 19:13
Disable passwords and enforce keys. – Martin Schröder Nov 29 '12 at 8:38
up vote 6 down vote accepted

It is usually considered bad form to log failed passwords, because failed passwords are often very similar to correct passwords with just one bad key stroke; or they could be the right password for the same user on another server. Writing passwords in files, well, that's rarely appropriate.

That being said, it is possible to log the passwords, with minimal source code modification of the SSH server. I just don't recommend it at all.

share|improve this answer

What would be the use of that information? Do you want to know if the attacker is just bruteforcing, or actually having good guesses? Something interesting to log instead would be successful logins. This way if you see a bunch of failed attemps and one succesfull one, you know more! There is a good document from Nist about security logging management.

share|improve this answer
That's correct, just trying to see if the failed attempts are brute force or an employee/contractor trying to guess it. Thanks for the link – whynot Nov 28 '12 at 15:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.