documentation_complete: true

title: 'Set LogLevel to INFO'

description: |-
    The INFO parameter specifies that record login and logout activity will be logged.
    <br/>
    The default SSH configuration sets the log level to INFO. The appropriate
    configuration is used if no value is set for <tt>LogLevel</tt>.
    <br/>
    To explicitly specify the log level in SSH, add or correct the following line in
    {{{ sshd_config_file() }}}
    <pre>LogLevel INFO</pre>

rationale: |-
    SSH provides several logging levels with varying amounts of verbosity. <tt>DEBUG</tt> is specifically
    not recommended other than strictly for debugging SSH communications since it provides
    so much data that it is difficult to identify important security information. <tt>INFO</tt> level is the
    basic level that only records login activity of SSH users. In many situations, such as Incident
    Response, it is important to determine when a particular user was active on a system. The
    logout record can eliminate those users who disconnected, which helps narrow the field.

severity: low

identifiers:
    cce@rhel8: CCE-82282-5
    cce@rhel9: CCE-90813-7
    cce@rhel10: CCE-90121-5
    cce@sle12: CCE-92278-1
    cce@sle15: CCE-91394-7

references:
    cis@debian11: 9.3.2
    cis@sle12: 5.2.5
    cis@sle15: 5.2.5
    nist: AC-17(a),CM-6(a)

{{{ complete_ocil_entry_sshd_option(default="yes", option="LogLevel", value="INFO") }}}


template:
    name: sshd_lineinfile
    vars:
        parameter: LogLevel
        value: INFO
        datatype: string
        is_default_value: 'true'
