If you do this, (1) log to authpriv, (2) make sure authpriv can be read only by root. See syslog.conf or rsyslog.conf for details. Next, you'll have to hack the source code. At some point the password will be sent to a library call
crypt. Just before that, use the logging code to log the input string. Alternatively to hacking the ssh code, you can use LD_PRELOAD to intercept the
crypt call; then you must start your
sshd daemon with the LD_PRELOAD environment variable set to your new library (of one or two calls).
For extra-security, consider encrypting the output string using a symmetric key. This isn't very good security, but it will prevent accidental exposure to good passwords (the scenario where sshd captures your own passwords and someone walks by while you've got the contents of authpriv on the screen).
For more on intercepting lib calls with LD_PRELOAD, see https://rafalcieslak.wordpress.com/2013/04/02/dynamic-linker-tricks-using-ld_preload-to-cheat-inject-features-and-investigate-programs/
How to do syslog in C:
http://www.gnu.org/software/libc/manual/html_node/Syslog-Example.html. If you hack the ssh code, there will already be logging function; just copy and modify as needed.