How to see what login-password they are trying to access via ssh in Linux?

Question

linux

Where and how can I configure logging of ssh login attempts? Interested in exactly what login and password they are trying to log in with.
Only failed login attempts are logged to /var/log/secure.

Answer 1

The easiest way is to hang some honeypot on the 22nd port, which will log all attempts, and hang the real SSH server on another port.

Answer 2

Why watch who is trying to hack which account, if you can set up fail2ban and nullify all possible password brute force attacks!?

Answer 3

It all depends on the allowed authentication method and whether the client will accept it when trying to downgrade (from public-key to password plain text).
If it's standard, then just forget it. the exchange takes place when checking the correctness of authentication exclusively with hash messages in the public key mode.

Answer 4

/var/log/secure
/var/log/auth.log
and last command for success

Answer 5

If login attempts are performed by a bot, then a brute-force attack is used to guess the password.

Answer 6

Write a PAM module that will log everything.
And so in the logs everything is there, except for unsuccessful passwords. And do you really need them?