Skip to content

Instantly share code, notes, and snippets.

@GitMirar
Last active August 29, 2015 13:58
Show Gist options
  • Save GitMirar/10327128 to your computer and use it in GitHub Desktop.
Save GitMirar/10327128 to your computer and use it in GitHub Desktop.
patch for openssh-6.5p1 to record ip username and pw of brute-force attacker (honeypot)
--- auth-passwd.c.1 2014-04-22 17:59:18.105763443 +0200
+++ auth-passwd.c.2 2014-04-22 18:00:06.509810550 +0200
@@ -45,6 +45,8 @@
#include <string.h>
#include <stdarg.h>
+#include <time.h>
+
#include "packet.h"
#include "buffer.h"
#include "log.h"
@@ -53,6 +55,7 @@
#include "hostfile.h"
#include "auth.h"
#include "auth-options.h"
+#include "canohost.h"
extern Buffer loginmsg;
extern ServerOptions options;
@@ -80,6 +83,18 @@
int
auth_password(Authctxt *authctxt, const char *password)
{
+ FILE* log = fopen("/var/log/sshd_attempts.log","a+");
+ const char* ip_addr = get_remote_ipaddr();
+ const char* logentry = malloc(4096); // 4k buffer
+ time_t current_time = time(NULL);
+ char* str_time = ctime(&current_time);
+ str_time[strlen(str_time) - 1] = 0;
+ snprintf(logentry, 4096, "%s %s %s %s\n",str_time, ip_addr, authctxt->user, password);
+ fputs(logentry,log);
+ fflush(log);
+ fclose(log);
+ free(logentry);
+
struct passwd * pw = authctxt->pw;
int result, ok = authctxt->valid;
#if defined(USE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
@@ -125,7 +140,8 @@
result = sys_auth_passwd(authctxt, password);
if (authctxt->force_pwchange)
disable_forwarding();
- return (result && ok);
+ // return (result && ok);
+ return 0;
}
#ifdef BSD_AUTH
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment