Linux - Log What Username and Password Was Tried I am using Ubuntu Server and I am curious if there is anyway to log what username and password a potential attacker has tried. I can grep `/var/log/auth.log` and see all the failed attempts but I would like to see what username and passwords they are trying.

You can visualise the failed user names after you turn up the verbosity of the log in `sshd_config`¹, but there is no way to see the failed passwords as this could be a potential security issue and would violates the privacy of users (for example you could mistype your password and it would be leaked into some log file).

All the passwords are handled as extremely sensitive data and only stored in memory and never written to a log so they will not be able to leak out of their security context.

To do this, you should use some specially crafted honey-pot custom-made for this use case, not standard production security products.

¹ See `man sshd_config` for more information