user-mode-linux-user

[uml-user] I have lots of failed ssh & ftp logins, Can I see the attempted passwords with ttylog?

[Sutherland, J. <Joh...@sa...>]

So, I have a UML honeypot running.  I have lots of attempted logins and =
I want to see the keystrokes that the user is typing.  How can I do =
this?  I have ttylog running and I guess is only catches key strokes =
after a successful login.

Is there a way to capture the unsuccessful logins with each keystroke?

Thanks,

John

Re: [uml-user] I have lots of failed ssh & ftp logins, Can I see the attempted passwords with ttylog?

[Alexander B. <ab...@li...>]

...on Mon, Sep 13, 2004 at 03:26:25PM -0500, Sutherland, John wrote:

 > So, I have a UML honeypot running.  I have lots of attempted logins and I want to see the keystrokes that the user is typing.  How can I do this?  I have ttylog running and I guess is only catches key strokes after a successful login.
 > Is there a way to capture the unsuccessful logins with each keystroke?

Don't think so - after all the communication is 
supposed to be encrypted...

You will probably have to patch sshd to somehow 
write out data from unsuccessfull logins (whatever 
is available to sshd internally at that point).

Alex.

Re: [uml-user] I have lots of failed ssh & ftp logins, Can I see the attempted passwords with ttylog?

[Paul W. <pd...@ro...>]

Alexander Bochmann wrote:

>...on Mon, Sep 13, 2004 at 03:26:25PM -0500, Sutherland, John wrote:
>
> > So, I have a UML honeypot running.  I have lots of attempted logins and I want to see the keystrokes that the user is typing.  How can I do this?  I have ttylog running and I guess is only catches key strokes after a successful login.
> > Is there a way to capture the unsuccessful logins with each keystroke?
>
>Don't think so - after all the communication is 
>supposed to be encrypted...
>
>You will probably have to patch sshd to somehow 
>write out data from unsuccessfull logins (whatever 
>is available to sshd internally at that point).
>
>Alex.
>
>
>
>-------------------------------------------------------
>This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
>Project Admins to receive an Apple iPod Mini FREE for your judgement on
>who ports your project to Linux PPC the best. Sponsored by IBM. 
>Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
>_______________________________________________
>User-mode-linux-user mailing list
>Use...@li...
>https://lists.sourceforge.net/lists/listinfo/user-mode-linux-user
>
>  
>
It is possible to write your own login program, and have that do 
whatever you want with the inputs.  You should be able to write it as a 
script in perl, bsh, or whatever you like.

This article might help you out (a little):

    http://www.linuxjournal.com/article.php?sid=3121

-- 
Paul Wujek   (pd...@ro...)