0

I want to improve my SSH log. I would like to basically be able to see failed attempts with ip address and the password used. is that possible?

Right now I see something like this:

Failed password for invalid user root from 121.10.140.215 port 60831 ssh2
Failed password for invalid user root from 121.10.140.215 port 56180 ssh2
Failed password for invalid user root from 121.10.140.215 port 56822 ssh2
Improve this question
2
  • 5
    You really don't want to log bad passwords. If you typo your password and the log is later leaked, someone could easily guess it. It's a privacy and security nightmare.
    – Polynomial
    Nov 28, 2012 at 14:42
  • Disable passwords and enforce keys.
    – Martin Schröder
    Nov 29, 2012 at 8:38

2 Answers 2

Reset to default
5

It is usually considered bad form to log failed passwords, because failed passwords are often very similar to correct passwords with just one bad key stroke; or they could be the right password for the same user on another server. Writing passwords in files, well, that's rarely appropriate.

That being said, it is possible to log the passwords, with minimal source code modification of the SSH server. I just don't recommend it at all.

Improve this answer
1

What would be the use of that information? Do you want to know if the attacker is just bruteforcing, or actually having good guesses? Something interesting to log instead would be successful logins. This way if you see a bunch of failed attemps and one succesfull one, you know more! There is a good document from Nist about security logging management.

Improve this answer
1
  • That's correct, just trying to see if the failed attempts are brute force or an employee/contractor trying to guess it. Thanks for the link
    – whynot
    Nov 28, 2012 at 15:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .