Is there a way I can capture the passwords or hashes being used by a "dictionary attack" against my ssh server?
I would like to see what they are trying, to be able to better guard against it.
I believe you can do this with strace against the ssh daemon. See this example / script. I think this will probably slow the ssh daemon down. It will show the actual password, not the hash.
The core of that example is (need to be root most likely):
strace -f -etrace=write -s 64 -p $ssh_pid 2>&1
My test with the above command where $ssh_pid is the pid of /usr/sbin/sshd:
ssh localhost kbrandt@localhost's password: Permission denied, please try again. ... pid 14742] write(4, "\0\0\0\10foobazes"..., 12) = 12
I don't think this is possible, at least not without making a pam-module which does that for you. It sounds rather unethical too, so tread carefully. It might be ok for analyzing attacks, but grab the 'incorrect' password of a legitimate user, and you might have picked up a password he uses somewhere else.
By definition a dictionary attack uses words that are found in a dictionary. Although it may be interesting to see what passwords were attempted it is really a waste of time because of the almost infinite number of non-dictionary passwords that could be used. A better way to protect your server from SSH attacks is to hide the server behind a non-standard port. I use a high port number above 10000 and find that I get very few break-in attempts.