Detections
Analytics

5.2.14 Ensure sshd LogLevel is configured

Information

SSH provides several logging levels with varying amounts of verbosity. The DEBUG options are specifically not recommended other than strictly for debugging SSH communications. These levels provide so much data that it is difficult to identify important security information, and may violate the privacy of users.

More information about the openSSH server configuration is available in the "Configure SSH Server" section overview.

The INFO level is the basic level that only records login activity of SSH users. In many situations, such as Incident Response, it is important to determine when a particular user was active on a system. The logout record can eliminate those users who disconnected, which helps narrow the field.

The VERBOSE level specifies that login and logout activity as well as the key fingerprint for any SSH key used for login will be logged. This information is important for SSH key management, especially in legacy environments.

Solution

Edit the /etc/ssh/sshd_config file to set the LogLevel parameter to VERBOSE or INFO above any Match entries as follows:

LogLevel VERBOSE
 - OR -
LogLevel INFO

See Also

https://workbench.cisecurity.org/benchmarks/25279

Item Details

Category: AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AU-2, 800-53|AU-3, 800-53|AU-7, 800-53|AU-12, 800-53|SI-5, CSCv7|6.2, CSCv7|6.3

Plugin: Unix

Control ID: 722abd65425ca8bcf8b85312f64fd9e1b5ba71284b03501115f7c3957eb09efd