Detections
Analytics

4.2.13 Ensure sshd LogLevel is configured

Information

LogLevel gives the verbosity level used when logging messages from sshd. The possible values are: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3 . The default is INFO . DEBUG and DEBUG1 are equivalent. DEBUG2 and DEBUG3 each specify higher levels of debugging output.

Note: Logging with a DEBUG level violates users' privacy and is not recommended.

SSH provides several logging levels with varying amounts of verbosity. The DEBUG options are specifically not recommended other than strictly for debugging SSH communications. These levels provide so much data that it is difficult to identify critical security information and may violate users' privacy. Also, improper usage of DEBUG may quickly fill up the available hard disk space, making the system unavailable.

The INFO level is the basic level that only records the login activity of SSH users. In many situations, such as Incident Response, it is essential to determine when a particular user was active on a system. The logout record can eliminate disconnected users, which helps narrow the field.

The VERBOSE level specifies that login and logout activity and the key fingerprint for any SSH key used for login will be logged. This information is essential for SSH key management, especially in legacy environments.

Solution

Edit the /etc/ssh/sshd_config file to set the parameter above any Include entries as follows:

LogLevel VERBOSE

-OR-

LogLevel INFO

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AU-2, 800-53|AU-3, 800-53|AU-7, 800-53|AU-12, 800-53|SI-5, CSCv7|6.2, CSCv7|6.3

Plugin: Unix

Control ID: 8962e8aa03b81d151a6c00c3351be6a0c3ebf368c70b7169124dc73e3dfcac88