22

If some user can't access some command with sudo 3 times, this should be reported to root user in access logs\errors..

Can root see these attempts (like passwords tried) in text in the logs?

4
  • 4
    Implicit assumption: root is not being evil. If root is already being evil when you try to log in, all bets are off.
    – Joshua
    Oct 24, 2018 at 14:33
  • It is trivial to configure something on most systems, but its not part of any default config I know of.
    – PlasmaHH
    Oct 25, 2018 at 8:35
  • 2
    Obligatory xkcd xkcd.com/838
    – Joe
    Oct 25, 2018 at 9:04
  • Just incorrect attempts counts are reported to root. Root can't see the entry passwords at all. Dec 4, 2019 at 8:11

4 Answers 4

40

No, passwords are not logged by default. This would be a security problem, as logs may be read by other administrators, allowing impersonation of the user in case of a slightly mistyped password.

29

Login attempts successful and unsuccessful are logged in

/var/log/auth.log

Example of a successful attempt:

Oct 23 21:24:01 schijfwereld sudo: rinzwind : TTY=pts/0 ; PWD=/home/rinzwind ; USER=root ; COMMAND=/bin/bash
Oct 23 21:24:01 schijfwereld sudo: pam_unix(sudo:session): session opened for user root by (uid=0)

And unsuccessful:

Oct 23 21:25:33 schijfwereld sudo: pam_unix(sudo:auth): authentication failure; logname= uid=1000 euid=0 tty=/dev/pts/1 ruser=rinzwind rhost=  user=rinzwind
Oct 23 21:26:02 schijfwereld sudo: rinzwind : 3 incorrect password attempts ; TTY=pts/1 ; PWD=/home/rinzwind ; USER=root ; COMMAND=/bin/bash

It logs the failed attempt and logs also the total of 3 wrongly typed passwords.

Passwords for sudo attempts are never shown or stored.

3
  • 5
    The only way passwords are logged are usually when you forgot to hit enter after the username. So you log in as "Scott Tiger" instead of user Scott with password Tiger
    – Lenne
    Oct 24, 2018 at 17:14
  • But that's not sudo's fault ;-)
    – Rinzwind
    Oct 25, 2018 at 8:34
  • @Lenne when that happens to me (or otherwise when I absent mindedly type my password instead of a command), I delete the offending line from the shell history.
    – Zanna
    Nov 20, 2018 at 15:34
5

The usual practice is to not log passwords used in login attempts, even if the password in question was invalid. This is simply because the password might be valid for another user on the same system (e.g. the user mistyped their username, not the password), or might be a trivial alternation of the actual password (the user missed a letter or so).

Either of those cases would leave a plaintext password laying on the system, vulnerable to some information leak. (The password might also be a valid password for some other system than the one it was entered on, but that's really more of a problem for "them", not "us".)

Somewhat related to this is the cases where a user writes their password in place of their username (e.g. they usually use a system that enters the username automatically, but now didn't, but still typed the password as the first thing). In that case, you would have a plaintext password in the logs. This is not optimal, but seeing the usernames for the usual failed login attempts is useful, and there's no simple solution for storing them but not passwords entered as usernames.


That said, there's nothing to stop the administrator of the system from having the system log the passwords, too. Adding the logging could probably be done by adding one call to syslog() and recompiling the PAM module. (PAM being what Ubuntu and sudo use, but of course the same applies for web apps and everything else, too.)


So, no, usually an administrator can't see the passwords entered on the system, but if you enter your password on a system you don't trust, you should, strictly speaking, consider it lost and change it.

0

More generally speaking, very few programs in unix ever log actual passwords into syslog or elsewhere -- there's almost never a good reason to do so, and there are good standing reasons not to.

Because of the way passwords are hashed, the system can't tell the difference between a wrong password and a typo - If your password was %$zDF+02G and you typed %$ZDF+02G it'll fail you as hard as it would if you typed 'rubberbabybuggybumpers', but logging the failed password would give valuable information away to a malicious third party reading the log.

The one case I've found where a program did have the capability to log passwords (and a use case where that'd be a good idea) is in RADIUS servers, where you can in a pinch switch on more-information-than-you-probably-wanted debug mode and then explicitly add the flag that means 'yes, including passwords' because you've got a client failing to connect and you need to rule out absolutely every possible cause...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .