The INFO parameter specifies that login and logout activity will be logged.
Rationale
SSH provides several logging levels with varying amounts of verbosity. DEBUG is specifically not recommended other than strictly for debugging SSH communications since it provides so much data that it is difficult to identify important security information. INFO level is the basic level that only records login activity of SSH users. In many situations, such as Incident Response, it is important to determine when a particular user was active on a system. The logout record can eliminate those users who disconnected, which helps narrow the field.
Audit Procedure
Using Command Line
To verify the correct SSH setting, run the following command and verify that the output is as shown:
grep "^LogLevel" /etc/ssh/sshd_config
Expected Result
LogLevel INFO
Remediation
Using Command Line
Edit the /etc/ssh/sshd_config file to set the parameter as follows:
LogLevel INFO
Default Value
LogLevel INFO
References
CIS Ubuntu 12.04 LTS Server Benchmark v1.1.0
Profile
Level 1 - Scored
1---2name: cis-ubuntu1204-v110-9-3-23description: Set LogLevel to INFO4---56# 9.3.2 Set LogLevel to INFO (Scored)78## Profile Applicability910- Level 11112## Description1314The `INFO` parameter specifies that login and logout activity will be logged.1516## Rationale1718SSH provides several logging levels with varying amounts of verbosity. `DEBUG` is specifically _not_ recommended other than strictly for debugging SSH communications since it provides so much data that it is difficult to identify important security information. `INFO` level is the basic level that only records login activity of SSH users. In many situations, such as Incident Response, it is important to determine when a particular user was active on a system. The logout record can eliminate those users who disconnected, which helps narrow the field.1920## Audit Procedure2122### Using Command Line2324To verify the correct SSH setting, run the following command and verify that the output is as shown:2526```bash27grep "^LogLevel" /etc/ssh/sshd_config28```2930## Expected Result3132```33LogLevel INFO34```3536## Remediation3738### Using Command Line3940Edit the `/etc/ssh/sshd_config` file to set the parameter as follows:4142```bash43LogLevel INFO44```4546## Default Value4748LogLevel INFO4950## References5152- CIS Ubuntu 12.04 LTS Server Benchmark v1.1.05354## Profile5556Level 1 - Scored
Run npx skillmds@latest add cyberstrikeus/cis-ubuntu1204-v110-9-3-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Set LogLevel to INFO It is listed under Coding & Dev Tools on SkillMD.
SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.
cyberstrikeus