/var/log/auth.log logs (among other things) failed login attempts to my debian linux.

I was wandering if it is possible to ask it to log the password that was used in the failed attempt.

This is out of curiosity as to the nature of those failed attempts, are they using dictionaries? combinations of words? length of passwords used? and so on

I feel that knowing the passwords that are being tried might help me to better understand the level of risk posed by those attempts.

  • 2
    I'm not sure if this is possible but I'm sure it is definitely not something that even should be possible as this leaks any passwords that are entered with as little mistake as a single typo. If you've ever made a typo while entering your password (and there's no single man on Earth that hasn't) then you'd never even want that to happen. – Erathiel Apr 30 '15 at 8:21
  • @epeleg: assuming Linux and other supported platforms, you could presumably write your own PAM module to achieve what you want. Clearly modules like pam_unix.so and pam_cracklib.so have access to the password. – 0xC0000022L Apr 30 '15 at 8:25
  • 2
    @0xC0000022L, as fas as I remember they have access to hash, not the password itself. epeleg, from security point of view this is very bad idea. – Romeo Ninov Apr 30 '15 at 8:43
  • 1
    @RomeoNinov: I guess your memory betrays you. How would pam_cracklib be able to check for palindromes, passwords containing the username and similar conditions merely based on the hash? – 0xC0000022L Apr 30 '15 at 10:15
  • @0xC0000022L, probably :) But my humble opinion is not to store passwords in log file :) – Romeo Ninov Apr 30 '15 at 10:20

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.