up vote 3 down vote favorite
1
share [g+] share [fb]

Is there a way I can capture the passwords or hashes being used by a "dictionary attack" against my ssh server?

I would like to see what they are trying, to be able to better guard against it.

link|improve this question
76% accept rate
feedback

3 Answers

up vote 6 down vote accepted

I believe you can do this with strace against the ssh daemon. See this example / script. I think this will probably slow the ssh daemon down. It will show the actual password, not the hash.

The core of that example is (need to be root most likely):

strace -f -etrace=write -s 64 -p $ssh_pid 2>&1

My test with the above command where $ssh_pid is the pid of /usr/sbin/sshd:

ssh localhost
kbrandt@localhost's password: 
Permission denied, please try again.
...
pid 14742] write(4, "\0\0\0\10foobazes"..., 12) = 12
link|improve this answer
See roe's answer regarding ethics, its not really something you should be doing... "My own interests are purely academic, of course" -- Prof. Slughorn :-) – Kyle Brandt♦ Dec 9 '09 at 19:06
The ethics don't have anything to do with the technique. Either you're defending a server you are responsible for, or you snarfing passwords you shouldn't be looking at. Strace doesn't steal credentials, people steal credentials. – pboin Dec 9 '09 at 19:40
1  
Another thing to keep in mind is that if you run this, and maybe dump the information to a file, the passwords now are in plain text, which is generally not a good idea. – Kyle Brandt♦ Dec 9 '09 at 19:42
Very helpful info - everyone! – Brent Dec 9 '09 at 20:17
feedback
up vote 4 down vote

I don't think this is possible, at least not without making a pam-module which does that for you. It sounds rather unethical too, so tread carefully. It might be ok for analyzing attacks, but grab the 'incorrect' password of a legitimate user, and you might have picked up a password he uses somewhere else.

link|improve this answer
2  
...or, more likely, you can figure out what his passowrd really is by reverse-engineering the way he fumbled it. – David Mackintosh Dec 9 '09 at 19:48
...or notify your users so they can prepare. Who knows, it might even help reduce forgotten-password resets. ;D – faraz Apr 20 at 8:11
feedback
up vote 0 down vote

By definition a dictionary attack uses words that are found in a dictionary. Although it may be interesting to see what passwords were attempted it is really a waste of time because of the almost infinite number of non-dictionary passwords that could be used. A better way to protect your server from SSH attacks is to hide the server behind a non-standard port. I use a high port number above 10000 and find that I get very few break-in attempts.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.