cis-ubuntu2004-v300-5-1-14

name	cis-ubuntu2004-v300-5-1-14
description	Ensure sshd LogLevel is configured
category	cis-networking
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","ssh"]
cis_id	5.1.14
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure sshd LogLevel is configured (Automated)

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

SSH provides several logging levels with varying amounts of verbosity. The DEBUG options are specifically not recommended other than strictly for debugging SSH communications. These levels provide so much data that it is difficult to identify important security information, and may violate the privacy of users.

Rationale

The INFO level is the basic level that only records login activity of SSH users. In many situations, such as Incident Response, it is important to determine when a particular user was active on a system. The logout record can eliminate those users who disconnected, which helps narrow the field.

The VERBOSE level specifies that login and logout activity as well as the key fingerprint for any SSH key used for login will be logged. This information is important for SSH key management, especially in legacy environments.

Audit Procedure

Command Line

Run the following command and verify that output matches loglevel VERBOSE or loglevel INFO:

# sshd -T | grep loglevel

loglevel VERBOSE
   - OR -
loglevel INFO

• IF - Match set statements are used in your environment, specify the connection parameters to use for the -T extended test mode and run the audit to verify the setting is not incorrectly configured in a match block. Example additional audit needed for a match block for the user sshuser:

# sshd -T -C user=sshuser | grep loglevel

Note: If provided, any Match directives in the configuration file that would apply are applied before the configuration is written to standard output. The connection parameters are supplied as keyword=value pairs and may be supplied in any order, either with multiple -C options or as a comma-separated list. The keywords are addr (source address), user (user), host (resolved source host name), laddr (local address), lport (local port number), and rdomain (routing domain)

Expected Result

loglevel VERBOSE

or