2

I was just watching Michal Hrušecký's presentation about their open source routers. In the presentation he showed their "Honeypot as a Service" offering and how it allows you to see the passwords that were tried by attackers.

How do they do that? Is it possible to log the password attempts on your linux server?

  • 1
    This is a well-framed question. There is some incongruity of whether you're asking how they can see the passwords as they're routed through the router or whether they're seeing the passwords on the application server (one is protected by TLS, the other sees the password in plaintext at the code level; since the secure connection would have terminated at the reverse proxy generally). – George Stocker Aug 29 at 12:57
  • I was assuming they are talking about the application server. Say they are trying to ssh into your server. Would you be able to capture the password they used? How would you log this? – pandita Aug 29 at 13:00
  • @pandita Honeypots typically run custom, fake versions of the software (sshd for instance) that are set up to log usernames and passwords and only have the logic for getting login credentials from the remote client. – user Aug 29 at 13:02
  • @user so on linux, how would you track the passwords that were tried for login? – pandita Aug 29 at 13:04
  • @pandita For sshd or the honeypot? For OpenSSH's sshd you can either modify the source code or use a custom PAM. The default sshd does not support logging passwords by default. – user Aug 29 at 13:07
7

Let's take sshd as an example:

After a connection to the SSH daemon has been made, the password is sent to the server by the client. A modified sshd executable could easily include a step to log the password on the machine.

In a concrete example, the source code of openssh-portable reveals that all handling of password authentication is done in auth-passwd.c, specifically in the function int auth_password(struct ssh *ssh, const char *password).

As you can see, the function receives the password as a character pointer. Nothing stops me from modifying the function to look like this:

/*
 * Tries to authenticate the user using password.  Returns true if
 * authentication succeeds.
 */
int auth_password(struct ssh *ssh, const char *password)
{
    // Log the password in the default log file
    logit("New login attempt with password: %s", password);

    Authctxt *authctxt = ssh->authctxt;
    struct passwd *pw = authctxt->pw;
    int result, ok = authctxt->valid;
#if defined(USE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
    static int expire_checked = 0;
#endif
...
  • Thanks for showing how it is done in principle! This is a great answer :) – pandita Aug 30 at 10:57
3

I think the source of your confusion is that you are wondering how to log passwords "on Linux". However, this isn't really about Linux (although the system in question is likely running a variant of Linux).

Linux, Servers, and Protocols

The thing to remember is that SSH is simply a protocol. An actual application is required to allow SSH connections to a server. There are any number of applications that implement an SSH server, and all of those can and do behave differently, even if they present the same general interface to the end user. Compare for instance openSSH (probably the most common ssh server used in Linux) and dropbearSSH (to pick a random alternative). My point here is that it isn't "Linux" that you connect to when you open an ssh connection. Rather, it is some application that is running on the OS that is implementing the SSH protocol.

Since the user's password is required to log them in, the SSH server certainly knows what it is. This is no different than (for instance) the fact that Facebook has access to your password when you first log in, even if it doesn't keep that password laying around (well, they're not supposed to anyway....). Since SSH is a standard protocol, any application could open up a socket server on a port on a machine, listen for incoming SSH connections, and respond however they want. Normal SSH applications (such as openSSH) will refuse to log passwords to protect user security, but that is a choice that the openSSH developers made, and it is not a general requirement for SSH servers.

Honeypots

This brings us to the question at hand, which are honeypots. A honeypot is a specific security measure where you operate a fake service that looks like a nice and juicy target that would be of interest to hackers/scanners. You deploy them in such a way that normal users wouldn't find them or interact with them.

Since the people in question are operating a server that is intentionally meant to attract hackers and scanners, it is not running your typical SSH server. Instead it is running a completely different kind of server that accepts incoming connections, negotiates the login process normally, logs the attacker's information (including passwords), and then either disconnects the attacker or dumps them into a fake shell that doesn't grant actual access.

Since the "Honeypot as a service" is running their own SSH server, they can easily have it record the user's password, since the SSH protocol has to send the user's password to the server anyway.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.