UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The system must display the date and time of the last successful account login upon login.


Overview

Finding ID Version Rule ID IA Controls Severity
V-22299 GEN000452 SV-37187r1_rule ECSC-1 Low
Description
Providing users with feedback on when account accesses last occurred facilitates user recognition and reporting of unauthorized account use.
STIG Date
Red Hat Enterprise Linux 5 Security Technical Implementation Guide 2014-01-09

Details

Check Text ( C-35888r2_chk )
Check that pam_lastlog is used and not silent, or that the SSH daemon is configured to display last login information.

# grep pam_lastlog /etc/pam.d/sshd
If pam_lastlog is present, and does not have the "silent" option, this is not a finding.

# grep -i PrintLastLog /etc/ssh/sshd_config

If PrintLastLog is not present in the configuration, this is not a finding. This is the default setting.
If PrintLastLog is present in the configuration and set to "yes" (case insensitive), this is not a finding.
Otherwise, this is a finding.
Fix Text (F-31144r1_fix)
Implement pam_lastlog, or enable PrintLastLog in the SSH daemon.

To enable pam_lastlog, add a line such as "session required pam_lastlog.so" to /etc/pam.d/sshd.

To enable PrintLastLog in the SSH daemon, remove any lines disabling this option from /etc/ssh/sshd_config.