I need to log ssh passwords attempts. I read somewhere you could get this done by patching openssh but I don't know if that is the correct way to get this done.

I am using Arch.


I want to get the passwords people tried to guess to gain access to my system. It could be with journalctl or get piled in a text file. If the person let's say types 1234 and tries to get access I want something like

"ssh loggin attempt failed, tried user "admin" with password "1234"

  • 2
    Have you looked in the log files, attempts are usually logged there. – Anthon Feb 6 '16 at 15:58
  • Yes, but only log attempts, not the passwords used in the log attempt. – HoNgOuRu Feb 6 '16 at 16:00
  • It is not clear from your question that it is that what you are looking for, please update it with the exact thing that you need, and describing what you are going to do with the information doesn't hurt either (as there might be other ways to achieve your goal, like downloading a database of passwords from somewhere) – Anthon Feb 6 '16 at 16:21
  • 7
    This is a really bad idea. You will end up logging user's mistyped passwords, which is a great starting point to guess their real password from the plaintext. Logging such a thing may even be illegal in your jurisdiction, and it dramatically decreases overall user security. Use keys instead and you will never have to worry about password attempts. – Chris Down Feb 6 '16 at 16:28
  • my system is only used for me. I consider this a great idea. – HoNgOuRu Feb 6 '16 at 16:30

What I think is a better answer is to download the LongTail SSH honeypot which is a hacked version of openssh to log username, password, source IP and port, and Client software and version.

The install script is at https://github.com/wedaa/LongTail-Log-Analysis/blob/master/install_openssh.sh

I also do analytics at http://longtail.it.marist.edu


If you do this, (1) log to authpriv, (2) make sure authpriv can be read only by root. See syslog.conf or rsyslog.conf for details. Next, you'll have to hack the source code. At some point the password will be sent to a library call crypt. Just before that, use the logging code to log the input string. Alternatively to hacking the ssh code, you can use LD_PRELOAD to intercept the crypt call; then you must start your sshd daemon with the LD_PRELOAD environment variable set to your new library (of one or two calls).

For extra-security, consider encrypting the output string using a symmetric key. This isn't very good security, but it will prevent accidental exposure to good passwords (the scenario where sshd captures your own passwords and someone walks by while you've got the contents of authpriv on the screen).

For more on intercepting lib calls with LD_PRELOAD, see https://rafalcieslak.wordpress.com/2013/04/02/dynamic-linker-tricks-using-ld_preload-to-cheat-inject-features-and-investigate-programs/

How to do syslog in C: http://www.gnu.org/software/libc/manual/html_node/Syslog-Example.html. If you hack the ssh code, there will already be logging function; just copy and modify as needed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.