Detections
Analytics

5.1.16 Ensure sshd LogLevel is configured

Information

SSH provides several logging levels with varying amounts of verbosity. The DEBUG options are specifically not recommended other than strictly for debugging SSH communications. These levels provide so much data that it is difficult to identify important security information, and may violate the privacy of users.

The INFO level is the basic level that only records login activity of SSH users. In many situations, such as Incident Response, it is important to determine when a particular user was active on a system. The logout record can eliminate those users who disconnected, which helps narrow the field.

The VERBOSE level specifies that login and logout activity as well as the key fingerprint for any SSH key used for login will be logged. This information is important for SSH key management, especially in legacy environments.

Solution

Edit the /etc/ssh/sshd_config file to set the LogLevel parameter to VERBOSE or INFO above any Include and Match entries as follows:

LogLevel VERBOSE
 - OR -
LogLevel INFO

Impact:

Setting LogLevel to INFO or VERBOSE increases the volume of SSH log data; VERBOSE additionally records the key fingerprint used for each login. Ensure log storage, rotation, and any downstream log collection are sized to accommodate the additional volume.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AU-2, 800-53|AU-3, 800-53|AU-7, 800-53|AU-12, 800-53|SI-5, CSCv7|6.2, CSCv7|6.3

Plugin: Unix

Control ID: afc16f7464dff5cd6b383f869a43f6c22eecc0f12a252d2632a459273544b908