Hacker News Reader

do (can?) auth failures display passwords? if so, is that a good idea? people (ie me) sometimes enter the wrong, but valid password. having that logged somewhere seems like a bad idea.

View on HN

The standard sshd does not log failed passwords. A few years ago I was seeing a lot of brute force attempts and I was curious to see the passwords. The only way I could do it was to edit the source code of sshd to add my own logging line and recompile the whole thing.

If you use public-key it only shows the ip. I don't know if you use password, 2-factor auth or Kerberos it shows any additional information.

I would guess that if you enable debugging it will show some identifiable information, I never had to debug it.

Reply on news.ycombinator.com