Is there a way I can capture the passwords or hashes being used by a "dictionary attack" against my ssh server?

I would like to see what they are trying, to be able to better guard against it.


I believe you can do this with strace against the ssh daemon. See this example / script. I think this will probably slow the ssh daemon down. It will show the actual password, not the hash.

The core of that example is (need to be root most likely):

strace -f -etrace=write -s 64 -p $ssh_pid 2>&1

My test with the above command where $ssh_pid is the pid of /usr/sbin/sshd:

ssh localhost
kbrandt@localhost's password: 
Permission denied, please try again.
pid 14742] write(4, "\0\0\0\10foobazes"..., 12) = 12
  • See roe's answer regarding ethics, its not really something you should be doing... "My own interests are purely academic, of course" -- Prof. Slughorn :-) – Kyle Brandt Dec 9 '09 at 19:06
  • 1
    The ethics don't have anything to do with the technique. Either you're defending a server you are responsible for, or you snarfing passwords you shouldn't be looking at. Strace doesn't steal credentials, people steal credentials. – pboin Dec 9 '09 at 19:40
  • 1
    Another thing to keep in mind is that if you run this, and maybe dump the information to a file, the passwords now are in plain text, which is generally not a good idea. – Kyle Brandt Dec 9 '09 at 19:42
  • Very helpful info - everyone! – Brent Dec 9 '09 at 20:17

I don't think this is possible, at least not without making a pam-module which does that for you. It sounds rather unethical too, so tread carefully. It might be ok for analyzing attacks, but grab the 'incorrect' password of a legitimate user, and you might have picked up a password he uses somewhere else.

  • 2
    ...or, more likely, you can figure out what his passowrd really is by reverse-engineering the way he fumbled it. – David Mackintosh Dec 9 '09 at 19:48
  • ...or notify your users so they can prepare. Who knows, it might even help reduce forgotten-password resets. ;D – fny Apr 20 '12 at 8:11

By definition a dictionary attack uses words that are found in a dictionary. Although it may be interesting to see what passwords were attempted it is really a waste of time because of the almost infinite number of non-dictionary passwords that could be used. A better way to protect your server from SSH attacks is to hide the server behind a non-standard port. I use a high port number above 10000 and find that I get very few break-in attempts.

  • Security through obscurity is not a good practice since 1851: See en.wikipedia.org/wiki/Security_through_obscurity You may get a few hits less but you do not get away from the more serious attackers. If this inconvenience is only for you, that's maybe fine, but you shouldn't annoy your users with non-standard ports. – Adrian Zaugg Dec 16 '19 at 22:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.