Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to improve my SSH log. I would like to basically be able to see failed attempts with ip address and the password used. is that possible?

Right now I see something like this:

Failed password for invalid user root from 121.10.140.215 port 60831 ssh2
Failed password for invalid user root from 121.10.140.215 port 56180 ssh2
Failed password for invalid user root from 121.10.140.215 port 56822 ssh2
share|improve this question
5  
You really don't want to log bad passwords. If you typo your password and the log is later leaked, someone could easily guess it. It's a privacy and security nightmare. –  Polynomial Nov 28 '12 at 14:42
    
totally right. Thanks! –  whynot Nov 28 '12 at 19:13
    
Disable passwords and enforce keys. –  Martin Schröder Nov 29 '12 at 8:38
add comment

2 Answers

up vote 6 down vote accepted

It is usually considered bad form to log failed passwords, because failed passwords are often very similar to correct passwords with just one bad key stroke; or they could be the right password for the same user on another server. Writing passwords in files, well, that's rarely appropriate.

That being said, it is possible to log the passwords, with minimal source code modification of the SSH server. I just don't recommend it at all.

share|improve this answer
add comment

What would be the use of that information? Do you want to know if the attacker is just bruteforcing, or actually having good guesses? Something interesting to log instead would be successful logins. This way if you see a bunch of failed attemps and one succesfull one, you know more! There is a good document from Nist about security logging management.

share|improve this answer
    
That's correct, just trying to see if the failed attempts are brute force or an employee/contractor trying to guess it. Thanks for the link –  whynot Nov 28 '12 at 15:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.