/var/log/auth.log logs (among other things) failed login attempts to my debian linux.

I was wandering if it is possible to ask it to log the password that was used in the failed attempt.

This is out of curiosity as to the nature of those failed attempts, are they using dictionaries? combinations of words? length of passwords used? and so on

I feel that knowing the passwords that are being tried might help me to better understand the level of risk posed by those attempts.

  • 2
    I'm not sure if this is possible but I'm sure it is definitely not something that even should be possible as this leaks any passwords that are entered with as little mistake as a single typo. If you've ever made a typo while entering your password (and there's no single man on Earth that hasn't) then you'd never even want that to happen. – Erathiel Apr 30 '15 at 8:21
  • @epeleg: assuming Linux and other supported platforms, you could presumably write your own PAM module to achieve what you want. Clearly modules like pam_unix.so and pam_cracklib.so have access to the password. – 0xC0000022L Apr 30 '15 at 8:25
  • 3
    @0xC0000022L, as fas as I remember they have access to hash, not the password itself. epeleg, from security point of view this is very bad idea. – Romeo Ninov Apr 30 '15 at 8:43
  • 1
    @RomeoNinov: I guess your memory betrays you. How would pam_cracklib be able to check for palindromes, passwords containing the username and similar conditions merely based on the hash? – 0xC0000022L Apr 30 '15 at 10:15
  • @0xC0000022L, probably :) But my humble opinion is not to store passwords in log file :) – Romeo Ninov Apr 30 '15 at 10:20

You can do it the trick mentioned in this blog post,
You edit a line in one of the files of OpenSSH, then compile it and use it. Short version, just run following script:

OPENSSH=/opt/openssh2
mkdir -p /opt/openssh2/dist/
cd ${OPENSSH}
wget http://zlib.net/zlib-1.2.11.tar.gz
tar xvfz zlib-1.2.11.tar.gz
cd zlib-1.2.11
./configure --prefix=${OPENSSH}/dist/ && make && make install
cd ${OPENSSH}
wget http://www.openssl.org/source/openssl-1.0.1e.tar.gz
tar xvfz openssl-1.0.1e.tar.gz
cd openssl-1.0.1e
./config --prefix=${OPENSSH}/dist/ && make && make install
cd ${OPENSSH}
wget https://ftp.eu.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-6.2p1.tar.gz
tar xvfz openssh-6.2p1.tar.gz
cd openssh-6.2p1
sed -e 's/struct passwd \* pw = authctxt->pw;/logit("Honey: Username: %s Password: %s", authctxt->user, password);\nstruct passwd \* pw = authctxt->pw;/' -i auth-passwd.c
./configure --prefix=${OPENSSH}/dist/ --with-zlib=${OPENSSH}/dist --with-ssl-dir=${OPENSSH}/dist/ && make && make install

For the long and interesting version, read the blog post.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.