Description
LogLevel sets how much the OpenSSH server writes to the system log. INFO records successful
and failed logins; VERBOSE also records the fingerprint of the key used for each login. This
control requires {{ ssh_log_level }}.
Rationale
SSH logs are the main evidence of who logged in, from where and when. Knowing which key was used
tells which person or automation logged in when several keys open the same account, and which
key to revoke after a leak. QUIET, FATAL and ERROR hide logins altogether; DEBUG levels
can log sensitive data.
Impact
VERBOSE adds about one line per login to the logs.
Applies when
Detected: when: OpenSSH server is installed A scanner reports the control not applicable when one is false.
Setting
| Location | /etc/ssh/sshd_config.d/00-cirsec.conf |
| Default | INFO |
| Recommended | {{ ssh_log_level }} |
Parameters
| Parameter | Core | Server | Server hardened | Desktop | Desktop hardened | Bounds |
|---|---|---|---|---|---|---|
ssh_log_levelenum. Expected LogLevel of the SSH server. | INFO | INFO | VERBOSE | INFO | VERBOSE | one of INFO, VERBOSE |
The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.
Audit
Run sshd -T | grep '^loglevel '. It must print loglevel {{ ssh_log_level }}.
Automated: every check must pass. Scanners report each check by its id.
log-level
LogLevel.
key: loglevel
value: '{{ ssh_log_level }}'
Remediation
Add LogLevel {{ ssh_log_level }} to /etc/ssh/sshd_config.d/00-cirsec.conf, check with
sshd -t, then run systemctl reload ssh.
| Restart | service: ssh |
| Disruption | none |
| Lockout risk | yes: can cut off administrative access. Off by default in generated scripts and playbooks, opt in through a tailoring file. |
Rollback
Remove the line and run systemctl reload ssh.
log-level
Generated from check log-level: the engine writes the fix for every output, it sets the expected value and the check runs again after.
Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.
References
- sshd_config(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
Mappings
| Framework | ID | Relation |
|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | AU-12 | partial |
| NIST SP 800-53 Rev. 55.1.1 | AU-3 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
People and lifecycle
| Authors |
|
| Verified | 2026-10-18 by Sn0wAlice on 12, Proxmox VM 921, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64. INFO passes in core; VERBOSE set by the generated fix in server-hardened; SSH by key still accepted. |
| Verified | 2026-10-18 by Sn0wAlice on 13, Proxmox VM 931, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64. INFO passes in core; VERBOSE set by the generated fix in server-hardened; SSH by key still accepted. |
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-18, 2026-10-18 |
| Translations | fr |
