{
  "id": "CB-UBU-NET-019",
  "standard": "ubuntu",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-NET-019",
  "json": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-NET-019.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-NET-019.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-NET-019",
    "title": "Log SSH logins with enough detail",
    "finding": {
      "title": "The SSH server logs too little to trace logins",
      "description": "Without login records, and in hardened setups without the key used, an intrusion through SSH cannot be traced back."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "automated",
    "tags": [
      "ssh",
      "logging"
    ],
    "applicability": {
      "facts": [
        "openssh-server"
      ]
    },
    "description": "`LogLevel` sets how much the OpenSSH server writes to the system log. `INFO` records successful\nand failed logins; `VERBOSE` also records the fingerprint of the key used for each login. This\ncontrol requires `{{ ssh_log_level }}`.\n",
    "rationale": "SSH logs are the main evidence of who logged in, from where and when. Knowing which key was used\ntells which person or automation logged in when several keys open the same account, and which\nkey to revoke after a leak. `QUIET`, `FATAL` and `ERROR` hide logins altogether; `DEBUG` levels\ncan log sensitive data.\n",
    "impact": "`VERBOSE` adds about one line per login to the logs.\n",
    "setting": {
      "location": "/etc/ssh/sshd_config.d/00-cirsec.conf",
      "default_value": "INFO",
      "recommended_value": "{{ ssh_log_level }}"
    },
    "parameters": [
      {
        "name": "ssh_log_level",
        "type": "enum",
        "description": "Expected LogLevel of the SSH server.",
        "default": "INFO",
        "allowed": [
          "INFO",
          "VERBOSE"
        ],
        "profile_defaults": {
          "server-hardened": "VERBOSE",
          "desktop-hardened": "VERBOSE"
        }
      }
    ],
    "audit": {
      "manual": "Run `sshd -T | grep '^loglevel '`. It must print `loglevel {{ ssh_log_level }}`.\n",
      "checks": [
        {
          "id": "log-level",
          "engine": "sshd-config",
          "description": "LogLevel.",
          "spec": {
            "key": "loglevel",
            "value": "{{ ssh_log_level }}"
          }
        }
      ]
    },
    "remediation": {
      "manual": "Add `LogLevel {{ ssh_log_level }}` to `/etc/ssh/sshd_config.d/00-cirsec.conf`, check with\n`sshd -t`, then run `systemctl reload ssh`.\n",
      "effects": {
        "restart": "service",
        "services": [
          "ssh"
        ],
        "disruption": "none",
        "lockout_risk": true
      },
      "rollback": "Remove the line and run `systemctl reload ssh`.\n",
      "scripts": [
        {
          "id": "log-level",
          "from_check": "log-level"
        }
      ]
    },
    "references": [
      {
        "title": "sshd_config(5), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man5/sshd_config.5.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-12",
        "relation": "partial"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-3",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1021.004"
      },
      {
        "framework": "cwe",
        "id": "CWE-778"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic, BIOS boot",
        "notes": "INFO passes in core; VERBOSE set by the generated fix in server-hardened, key fingerprints logged; SSH by key still accepted after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic, BIOS boot",
        "notes": "INFO passes in core; VERBOSE set by the generated fix in server-hardened, key fingerprints logged; SSH by key still accepted after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic, BIOS boot",
        "notes": "INFO passes in core; VERBOSE set by the generated fix in server-hardened, key fingerprints logged; SSH by key still accepted after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic, BIOS boot",
        "notes": "INFO passes in core; VERBOSE set by the generated fix in server-hardened, key fingerprints logged; SSH by key still accepted after reboot."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}