Is it possible on the server to log the password encoded by the remote user inside a log. I want to make a honeypot to see the type of user/password used.

  • Can you provide more information about what you are trying to do? What do you mean by a honeypot? A honeypot is normally something that intentionally looks vulnerable but that should never normally be used so that anyone accessing it can be identified as an intruder. As for the original question about decrypting an SSH connection on the server, there are multiple ways this could be done based on what you are trying to accomplish and what type of configuration you are using. Some software supports it natively, also proxies could be used or a raw log could be dumped and decoded manually. Sep 19, 2012 at 19:24
  • I want to see who i trying to connect with old passwords on shared user accounts ;) not a real honeypot in fact. Thanks !
    – hotips
    Sep 19, 2012 at 21:22

3 Answers 3


Another method is to attach strace to the process (and it's children). Input/output will be logged there after decryption, yielding the password. In my experience this sort of thing works more reliably than mucking about with the log levels of sshd (but of course YMMV).

write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\nPassword: \0\0"..., 34) = 34
read(5, "\0\0\0\r", 4)                  = 4
read(5, "4\0\0\0\1\0\0\0\4asdf", 13)    = 13

If you run ssh in full debug mode you can have it log the content of all packets and then go back and extract the passwords from that. you can do this bu running

ssh -dddddddd

or add it to your /etc/ssh/sshd_config:

LogLevel DEBUG3

this runs it once, in non-daemon mode and logs way more than you care about. you can improve this by disabling the sshd service and running ssh with the -ddddd from xinitd.

At work I currently maintain an open-ssh fork that includes this ability because it uses an external web service to verify the passwords. If you can afford to maintain an open-ssh fork it will likely give a cleaner experience.

  • Is it possible to define that inside the sshd_config ?
    – hotips
    Sep 19, 2012 at 19:24
  • good point!, editing to add this. Sep 19, 2012 at 19:38
  • It seems that DEBUG3 doesn't show the password : Failed password for invalid user xxxx from 192.168.xxx.xxx port 54120 ssh2. Do you know to integrate that inside the config ?
    – hotips
    Sep 19, 2012 at 23:19
  • does it work for you when running sshd in debug more (-d) Sep 19, 2012 at 23:21
  • it doesn't work for me. do you have another idea except fork openssh ;-) ? thanks
    – hotips
    Sep 19, 2012 at 23:42

This is dramatically simpler to accomplish if you just modify the sshd binary to log password attempts either to a log file or to a remote logging service.

This is trivial to accomplish since the source code is availble and very well-written. In fact, attackers who get root level access on a server typically install modified ssh and sshd binaries that do exactly that! It should be simple to find source code patches out there if you have a look; I know I've seen the patch files show up on people's servers many times in the past.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .