5 ms·
Here's a one line patch to make OpenSSH log passwords: http://16s.us/docs/sshlog/sshlog.patch http://16s.us/docs/sshlog/sshlog.patch I log passwords (just as
by ef47d35620c1 13y ago
Here's a one line patch to make OpenSSH log passwords:
http://16s.us/docs/sshlog/sshlog.patch http://16s.us/docs/sshlog/sshlog.patch
I log passwords (just as a hobby) to see what type of passwords the brute-force bots are currently using.
Here's the top 10:
PASS COUNT
123456 3785
password 2531
1234 2053
admin 2005
12345 1390
root 1281
123 1246
1qaz2wsx 1207
root123 1150
passw0rd 1120
Here's the top 10 complex:
PASS COUNT
P@ssw0rd 1027
1qaz@WSX 466
!QAZ2wsx 357
Admin@123 310
P@$$w0rd 299
P@ssw0rd1 177
Admin123!@# 172
P@ssw0rd123 166
1qaz@WSX3edc 153
1qazXSW@ 150
Don't use any of those passwords on your systems.
Edit: Formatting.
- brunoqc 13y agoDoes that mean that you also log your user's password?
- ef47d35620c1 13y agoThese are not production systems, but yes, that patch logs all passwords. I only use keys.
- deleted 13y ago[deleted]
- mahmud 13y agoIs it you or openssh that declares two variables on one line (int result, ok)? I hope it's just you, because that's bad practice :-/
- jrockway 13y agoFor someone here criticizing C style, I'm surprised you can't read unified diffs. The lines starting with " " are context. The lines starting with "+" are the ones the author of the patch added.
- mahmud 13y agoThat's what I get for reading diffs on a mobile phone at 11PM. But my concern does stand, OpenSSH does allow for multiple declarations on one line in their style guide.
- brohee 13y agoOpenSSH is in Kernel Normal Form (http://www.openbsd.org/cgi-bin/man.cgi?query=style§ion=9 http://www.openbsd.org/cgi-bin/man.cgi?query=style§ion=9) which doesn't have any qualms about it. Specifically it says : "When declaring variables in functions, declare them sorted by size (largest to smallest), then in alphabetical order; multiple ones per line are okay."
- mahmud 13y agoRiiight. Thank you. That answers my question.
- coprmesis 13y agoOr use signature log in only?
- deleted 13y ago[deleted]
- sjclemmy 13y agoI've never seen the 1qaz2wsx password pattern. Does that mean there's also 3edc4rfv and things like that in your 'logs'?
- dfc 13y agojohn the ripper has a mode dedicated to create "sequences of adjacent keys on a keyboard as candidate passwords." Take a look in john.conf and search for [List.External:Keyboard]
- joshbaptiste 13y agoNice.. that's one of reasons the first thing I do after a fresh install in /etc/ssh/sshd_config AllowUsers myuser PermitRootLogin no (yes I still use a password)
- CSDude 13y agoI hope you use something similar to fail2ban
- ef47d35620c1 13y agoI do not. That would interfere with my experiment. My hosts stand on their own on the Internet. All account passwords are 160-bits. Have at guessing them.
- jsegura 13y agoAnybody knows what is the success rate of those? I would pay to know how much people has their password listed in the first TOP 10 list.