/var/log/auth.log logs (among other things) failed login attempts to my Debian Linux.

I was wondering if it is possible to ask it to log the password that was used in the failed attempt.

This is out of curiosity as to the nature of those failed attempts. Are they using dictionaries? Combinations of words? Length of passwords used?

I feel that knowing the passwords that are being tried might help me to better understand the level of risk posed by those attempts.

  • 3
    I'm not sure if this is possible but I'm sure it is definitely not something that even should be possible as this leaks any passwords that are entered with as little mistake as a single typo. If you've ever made a typo while entering your password (and there's no single man on Earth that hasn't) then you'd never even want that to happen. – Erathiel Apr 30 '15 at 8:21
  • @epeleg: assuming Linux and other supported platforms, you could presumably write your own PAM module to achieve what you want. Clearly modules like pam_unix.so and pam_cracklib.so have access to the password. – 0xC0000022L Apr 30 '15 at 8:25
  • 4
    @0xC0000022L, as fas as I remember they have access to hash, not the password itself. epeleg, from security point of view this is very bad idea. – Romeo Ninov Apr 30 '15 at 8:43
  • 1
    @RomeoNinov: I guess your memory betrays you. How would pam_cracklib be able to check for palindromes, passwords containing the username and similar conditions merely based on the hash? – 0xC0000022L Apr 30 '15 at 10:15
  • 1
    @0xC0000022L, probably :) But my humble opinion is not to store passwords in log file :) – Romeo Ninov Apr 30 '15 at 10:20

It is strongly recommended not to do this, unless you know what you are doing. Since you basically have passwords sitting around in your log file(it compromises several very important security practices).
But saying that if you know what you're doing(compromising your security standards), here is a way:
You can do it the trick mentioned in this blog post,
You edit a line in one of the files of OpenSSH, then compile it and use it. Short version, just run following script:

mkdir -p /opt/openssh2/dist/
wget http://zlib.net/zlib-1.2.11.tar.gz
tar xvfz zlib-1.2.11.tar.gz
cd zlib-1.2.11
./configure --prefix=${OPENSSH}/dist/ && make && make install
wget http://www.openssl.org/source/openssl-1.0.1e.tar.gz
tar xvfz openssl-1.0.1e.tar.gz
cd openssl-1.0.1e
./config --prefix=${OPENSSH}/dist/ && make && make install
wget https://ftp.eu.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-6.2p1.tar.gz
tar xvfz openssh-6.2p1.tar.gz
cd openssh-6.2p1
sed -e 's/struct passwd \* pw = authctxt->pw;/logit("Honey: Username: %s Password: %s", authctxt->user, password);\nstruct passwd \* pw = authctxt->pw;/' -i auth-passwd.c
./configure --prefix=${OPENSSH}/dist/ --with-zlib=${OPENSSH}/dist --with-ssl-dir=${OPENSSH}/dist/ && make && make install

For the long and interesting version, read the blog post.

  • 1
    Never, ever, ever, EVER do this on any sensitive system - or any system that shares users with a sensitive system because users reuse passwords. Once you do this, you lose all accountability and non-repudiation. Have an employee you think did some bad things? "Wasn't me - you're logging all passwords, aren't you?" Ooops. – Andrew Henle Dec 31 '20 at 16:37
  • @AndrewHenle added a security warning at the start of the post. Thanks for the constructive feedback. – FazeL Jan 1 at 4:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.