Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way I can capture the passwords or hashes being used by a "dictionary attack" against my ssh server?

I would like to see what they are trying, to be able to better guard against it.

share|improve this question
up vote 7 down vote accepted

I believe you can do this with strace against the ssh daemon. See this example / script. I think this will probably slow the ssh daemon down. It will show the actual password, not the hash.

The core of that example is (need to be root most likely):

strace -f -etrace=write -s 64 -p $ssh_pid 2>&1

My test with the above command where $ssh_pid is the pid of /usr/sbin/sshd:

ssh localhost
kbrandt@localhost's password: 
Permission denied, please try again.
pid 14742] write(4, "\0\0\0\10foobazes"..., 12) = 12
share|improve this answer
See roe's answer regarding ethics, its not really something you should be doing... "My own interests are purely academic, of course" -- Prof. Slughorn :-) – Kyle Brandt Dec 9 '09 at 19:06
The ethics don't have anything to do with the technique. Either you're defending a server you are responsible for, or you snarfing passwords you shouldn't be looking at. Strace doesn't steal credentials, people steal credentials. – pboin Dec 9 '09 at 19:40
Another thing to keep in mind is that if you run this, and maybe dump the information to a file, the passwords now are in plain text, which is generally not a good idea. – Kyle Brandt Dec 9 '09 at 19:42
Very helpful info - everyone! – Brent Dec 9 '09 at 20:17

I don't think this is possible, at least not without making a pam-module which does that for you. It sounds rather unethical too, so tread carefully. It might be ok for analyzing attacks, but grab the 'incorrect' password of a legitimate user, and you might have picked up a password he uses somewhere else.

share|improve this answer
...or, more likely, you can figure out what his passowrd really is by reverse-engineering the way he fumbled it. – David Mackintosh Dec 9 '09 at 19:48
...or notify your users so they can prepare. Who knows, it might even help reduce forgotten-password resets. ;D – faraz Apr 20 '12 at 8:11

By definition a dictionary attack uses words that are found in a dictionary. Although it may be interesting to see what passwords were attempted it is really a waste of time because of the almost infinite number of non-dictionary passwords that could be used. A better way to protect your server from SSH attacks is to hide the server behind a non-standard port. I use a high port number above 10000 and find that I get very few break-in attempts.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.