3 ms·
As I understand it this will log all passwords anyone enters -- even correct ones. This seems like a terrible idea, or at the very least should be used only af
by cillian64 11y ago
As I understand it this will log all passwords anyone enters -- even correct ones. This seems like a terrible idea, or at the very least should be used only after careful consideration. Even logging incorrect passwords is a bad idea, due to slight typos by legitimate users.
- w8rbt 11y agoYou are correct. The patch is meant for IT security research and honeypots. The purpose is to see what passwords the SSH brute-force bots are using. It should not be used on production systems where legit users are logging in via SSH. That would be unethical and possibly criminal (depending on location). Also, with SSH, I use keys, not passwords. I encourage others to do that as well. You could have this patch on a honeypot and by using a SSH key, your account password would not be in play.
- angry_octet 11y agoAgree 100%. While it might be interesting as an academic study it shouldn't be used on any system with actual users. It is just the kind of thing I would expect dumb IT mgmt to require so they can ban swear words from passwords.