# Ensure sshd LogLevel is configured

The SSH `LogLevel` parameter specifies the verbosity level of messages logged by the SSH daemon. Proper configuration is essential for security monitoring, incident response, and forensic analysis. Without sufficient logging, administrators cannot effectively detect or investigate unauthorized access attempts, brute-force attacks, or other malicious activities. A LogLevel that is too low may fail to capture critical security events, while one that is too high can flood logs with unnecessary data, obscuring genuine threats. The audit script inspects the `/etc/ssh/sshd_config` file to report the currently configured `LogLevel`. The remediation script modifies this file to set the desired level and restarts the SSH service to apply the change. The 'Basic' state of 'INFO' provides a good baseline, logging standard connection and authentication events. The 'Moderate' and 'Strict' state of 'VERBOSE' is recommended by benchmarks like CIS for providing more detailed information, such as the public key used for authentication, which significantly enhances the audit trail for security investigations without creating the excessive noise associated with DEBUG levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['INFO']` |
| **Moderate** | `['VERBOSE']` |
| **Strict** | `['VERBOSE']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the `/etc/ssh/sshd_config` file for the `LogLevel` setting. The script should first look for an active, uncommented `LogLevel` entry. If found, it should return only the value (e.g., 'VERBOSE'). If no active entry is found, the script should return the default value, 'INFO', without any additional text or labels.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired SSH `LogLevel` (e.g., 'VERBOSE'). The script must modify the `/etc/ssh/sshd_config` file by either updating the existing `LogLevel` entry or appending it if it doesn't exist. After updating the configuration, the script must restart the `sshd` service to apply the changes. The script must return 'true' on successful completion and 'false' if any step fails.

