A cardinal rule of security is that you *never* record passwords
unencrypted. Even if you only store failed passwords, you'll still be
collecting a lot of correct but mis-typed passwords, which would be a
huge help to an attacker if he could get hold of it.
Logging should (and I believe, does) collect user names in failed
attempts, and you should look for attempts to login as root or other
system accounts such as oracle (if used).
Perhaps if you explain *why* you want to see passwords we can make more
meaningful suggestions.
- Philip
Derek Martin wrote:
On Thu, Oct 21, 2004 at 03:26:36PM -0400, mike@genxweb.net wrote:
Is it possible to have sshd log the passwords and times of failed
logins?
David,
I may be missunderstanding you but I believe sshd already does.
I think you're misunderstanding... possibly as a result of the evil
and dreaded top-post, which fails to retain context properly. =8^)
David appears to be asking for the PASSWORD the user used on a failed
attempt. I'm not 100% positive, but I believe OpenSSH does not
provide a mechanism to get the password.
If you do a cat on the /var/log/secure it has info of failed login
attempts, the account they tried and the time. You cna easily use
Also note that /var/log/secure is the default on most Linux systems,
but by no means the only place these messages could appear. This
depends entirely on where the system's LOG_AUTHPRIV log messages are
going, and that's only if the user hasn't changed the SyslogFacility
in the sshd config file.
*******************************************************
This email has originated from Steria Limited, Registration No: 2706218.
Privileged, confidential and/or copyright information may be contained in this
email, and is only for the use of the intended addressee. To copy, forward,
disclose or otherwise use it in any way if you are not the intended recipient
or responsible for delivering to him/her is prohibited.
If you receive this email by mistake, please advise the sender immediately, by
using the reply facility in your email software.
We may monitor the content of emails sent and received via our network for the
purposes of ensuring compliance with policies and procedures.
This message is subject to and does not create or vary any contractual
relationships between Steria Limited and the recipient.
Office registered at: Three Cherry Trees Lane, Hemel Hempstead, Hertfordshire,
HP2 7AH
www.steria.co.uk
******************************************************
