A small tool to log IPs, usernames and passwords from incoming ssh-auth requests.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Augusto Dwenger J. 4fea62262f
Fix IPv4 port to bind to 0.0.0.0
1 month ago
.gitignore Init commit 1 month ago
LICENSE Init commit 1 month ago
README.md Update repository location 1 month ago
go.mod Update repository location 1 month ago
go.sum Update repository location 1 month ago
main.go Fix IPv4 port to bind to 0.0.0.0 1 month ago
main_test.go Add ip to username and password log with new format 1 month ago

README.md

sshlog

A small tool to log IPs, usernames and passwords from incoming ssh-auth requests.

It opens a minimal SSH-Server and listens on IPv4 and IPv6 for auth requests. The goal of this little tool is to log the requests coming from bots living inside the wild internet.

Install

Make sure you have Golang installed and configured.

git clone https://git.sr.ht/~hamburghammer/sshlog
cd sshlog
go build

Now you should be able to execute the newly generated executable with ./sshlog.

Usage

Start with:

sshlog -p 2222

Output:

2021/06/02 23:08:31 Starting ssh logger on port 2222...
2021/06/02 23:08:52 SRC=127.0.0.1 USERNAME=test PASSWORD=foo
2021/06/02 23:08:53 SRC=127.0.0.1 USERNAME=test PASSWORD=foof
2021/06/02 23:08:54 SRC=127.0.0.1 USERNAME=test PASSWORD=fooof

Options

A small tool to log IPs, usernames and passwords from incoming ssh-auth requests.

USAGE:
        sshlog [FLAGS]

FLAGS:
  -h, --help          Prints this help message and exits.
  -k, --key string    Path to the host key for the ssh server.
                      If absent it will automatically generate a new one for each run.
  -4, --onlyIPv4      Only listens on IPv4.
  -p, --port string   Port to listen for incoming connections. (default "22"))