News for hackers. Stuff that matters.

A comment on SSH Brute Force – The 10 Year Old Attack That Still Persists. Parent comment

Re:SSH Brute Force – The 10 Year Old Attack That Still Persists by andrewcooke on Monday July 15, 2013 @01:29PM (#6047079)
do (can?) auth failures display passwords? if so, is that a good idea? people (ie me) sometimes enter the wrong, but valid password. having that logged somewhere seems like a bad idea.
[ Parent | on HN ]
Re:SSH Brute Force – The 10 Year Old Attack That Still Persists by DavidHogue on Monday July 15, 2013 @02:04PM (#6047369)
The standard sshd does not log failed passwords. A few years ago I was seeing a lot of brute force attempts and I was curious to see the passwords. The only way I could do it was to edit the source code of sshd to add my own logging line and recompile the whole thing.
[ Parent | on HN ]
Re:SSH Brute Force – The 10 Year Old Attack That Still Persists by erhardm on Monday July 15, 2013 @01:42PM (#6047184)
If you use public-key it only shows the ip. I don't know if you use password, 2-factor auth or Kerberos it shows any additional information.

I would guess that if you enable debugging it will show some identifiable information, I never had to debug it.

[ Parent | on HN ]