I want to improve my SSH log. I would like to basically be able to see failed attempts with ip address and the password used. is that possible?
Right now I see something like this:
Failed password for invalid user root from 126.96.36.199 port 60831 ssh2
Failed password for invalid user root from 188.8.131.52 port 56180 ssh2
Failed password for invalid user root from 184.108.40.206 port 56822 ssh2
It is usually considered bad form to log failed passwords, because failed passwords are often very similar to correct passwords with just one bad key stroke; or they could be the right password for the same user on another server. Writing passwords in files, well, that's rarely appropriate.
That being said, it is possible to log the passwords, with minimal source code modification of the SSH server. I just don't recommend it at all.
What would be the use of that information? Do you want to know if the attacker is just bruteforcing, or actually having good guesses?
Something interesting to log instead would be successful logins. This way if you see a bunch of failed attemps and one succesfull one, you know more!
There is a good document from Nist about security logging management.