# Ensure sshd LogLevel is configured

The SSH LogLevel parameter specifies the verbosity level of messages logged by the SSH daemon. Proper configuration is essential for monitoring and auditing SSH session activity, which helps in detecting and investigating unauthorized access attempts, brute-force attacks, and policy violations. Misconfiguration could lead to insufficient log data for forensic analysis after a security incident. The audit script inspects the '/etc/ssh/sshd_config' file to determine the currently configured LogLevel. The remediation script modifies this file to set the desired level and reloads the SSH service to apply the change. The 'INFO' level (Basic) provides a baseline by logging routine user login and logout events. The 'VERBOSE' level (Moderate/Strict) is recommended by security benchmarks like CIS because it provides more detailed information, including the fingerprints of keys used for authentication and the start and end of SSH sessions, which is crucial for detailed forensic analysis without the excessive noise and potential performance impact of DEBUG levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['INFO']` |
| **Moderate** | `['VERBOSE']` |
| **Strict** | `['VERBOSE']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the 'LogLevel' setting from the '/etc/ssh/sshd_config' file. The script should output only the configured value (e.g., 'VERBOSE'). If the setting is commented out or not explicitly configured, it should return the system default value, 'INFO'.

## Remediation Script Working

Bash script that sets the 'LogLevel' in '/etc/ssh/sshd_config'. The script must accept the desired log level as a single positional argument (e.g., 'VERBOSE'). It should find and replace an existing 'LogLevel' entry (commented or uncommented) or append it if it does not exist. After successfully updating the file and restarting the sshd service, it must output 'true'; otherwise, it must output 'false'.

