From owner-freebsd-questions@FreeBSD.ORG Tue Apr 26 11:54:23 2005 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D430616A4CE for ; Tue, 26 Apr 2005 11:54:23 +0000 (GMT) Received: from orchid.homeunix.org (avm78.neoplus.adsl.tpnet.pl [83.27.46.78]) by mx1.FreeBSD.org (Postfix) with ESMTP id 14CCE43D31 for ; Tue, 26 Apr 2005 11:54:21 +0000 (GMT) (envelope-from freebsd@orchid.homeunix.org) Received: from [192.168.1.66] (blackacidevil.orchid.homeunix.org [192.168.1.66]) (authenticated bits=0) by orchid.homeunix.org (8.13.1/8.13.1) with ESMTP id j3QBs6nu059679 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 26 Apr 2005 13:54:13 +0200 (CEST) (envelope-from freebsd@orchid.homeunix.org) Message-ID: <426E2BE8.5030603@orchid.homeunix.org> Date: Tue, 26 Apr 2005 13:54:16 +0200 From: Karol Kwiatkowski User-Agent: Mozilla Thunderbird 1.0.2 (X11/20050326) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Daniel Bye References: <20050426104206.GA53044@catflap.slightlystrange.org> In-Reply-To: <20050426104206.GA53044@catflap.slightlystrange.org> X-Enigmail-Version: 0.91.0.0 Content-Type: text/plain; charset=ISO-8859-2 Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV 0.83/853/Mon Apr 25 21:22:22 2005 on orchid.homeunix.org X-Virus-Status: Clean cc: freebsd-questions@freebsd.org Subject: Re: illegal user root user failed login attempts X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: freebsd@orchid.homeunix.org List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Apr 2005 11:54:24 -0000 Daniel Bye wrote: > On Tue, Apr 26, 2005 at 09:22:34AM +0100, Peter Kropholler wrote: >>Is there any way to actually record what passwords >>the hackers' scripts are trying? I am just really intrigued >>to know what they are thinking might work. > > > No - ssh transport is encrypted even by the time passwords are involved. But in this scenario it is me (sshd) who does encryption/decryption :) As I understand it, there's no way to log password except hacking ssh daemon source code. This link might help: http://seclists.org/lists/incidents/2005/Feb/0004.html (I haven't tried it and patch is against OpenSSH 3.5p1 - be careful) Regards, Karol -- Karol Kwiatkowski