Re: Logging attempted passwords

From: Philip Le Riche (philip.leriche_at_virgin.net)
Date: 10/22/04

  • Next message: Greg Wooledge: "Re: Logging attempted passwords" 
    Date: Fri, 22 Oct 2004 09:52:17 +0100
To: secureshell@securityfocus.com

    A cardinal rule of security is that you *never* record passwords
    unencrypted. Even if you only store failed passwords, you'll still be
    collecting a lot of correct but mis-typed passwords, which would be a
    huge help to an attacker if he could get hold of it.

    Logging should (and I believe, does) collect user names in failed
    attempts, and you should look for attempts to login as root or other
    system accounts such as oracle (if used).

    Perhaps if you explain *why* you want to see passwords we can make more
    meaningful suggestions.

    - Philip

    Derek Martin wrote:

    >On Thu, Oct 21, 2004 at 03:26:36PM -0400, mike@genxweb.net wrote:
    >
    >
    >>>Is it possible to have sshd log the passwords and times of failed
    >>>logins?
    >>>
    >>>
    >>David,
    >>I may be missunderstanding you but I believe sshd already does.
    >>
    >>
    >
    >I think you're misunderstanding... possibly as a result of the evil
    >and dreaded top-post, which fails to retain context properly. =8^)
    >
    >David appears to be asking for the PASSWORD the user used on a failed
    >attempt. I'm not 100% positive, but I believe OpenSSH does not
    >provide a mechanism to get the password.
    >
    >
    >
    >>If you do a cat on the /var/log/secure it has info of failed login
    >>attempts, the account they tried and the time. You cna easily use
    >>
    >>
    >
    >Also note that /var/log/secure is the default on most Linux systems,
    >but by no means the only place these messages could appear. This
    >depends entirely on where the system's LOG_AUTHPRIV log messages are
    >going, and that's only if the user hasn't changed the SyslogFacility
    >in the sshd config file.
    >
    >
    >




    *******************************************************
    This email has originated from Steria Limited, Registration No: 2706218.

    Privileged, confidential and/or copyright information may be contained in this email, and is only for the use of the intended addressee. To copy, forward, disclose or otherwise use it in any way if you are not the intended recipient or responsible for delivering to him/her is prohibited.

    If you receive this email by mistake, please advise the sender immediately, by using the reply facility in your email software.

    We may monitor the content of emails sent and received via our network for the purposes of ensuring compliance with policies and procedures.

    This message is subject to and does not create or vary any contractual relationships between Steria Limited and the recipient.

    Office registered at: Three Cherry Trees Lane, Hemel Hempstead, Hertfordshire, HP2 7AH
    www.steria.co.uk
    ******************************************************

  • Next message: Greg Wooledge: "Re: Logging attempted passwords"

    Relevant Pages

    • password expiration policy for admin and system accounts ?
      ... Our auditors are objecting to our having Domain Administrator and domain ... system accounts with passwords that never expire. ... Yes, we change some of these passwords from time to time, but they're ...
      (microsoft.public.security)
    • password expiration policy for admin and system accounts ?
      ... Our auditors are objecting to our having Domain Administrator and domain ... system accounts with passwords that never expire. ... Yes, we change some of these passwords from time to time, but they're ...
      (microsoft.public.win2000.security)
    • Re: Daily Mail Password?
      ... There has got to be a better way of collecting these passwords. ... confusing at the moment. ... Prev by Date: ...
      (uk.rec.competitions)
    • Re: so how much Dead does anyone have.
      ... I've been collecting digital versions ... logins, passwords and port #s to get access to someone's server). ...
      (rec.music.gdead)