RHEL 8 must display the date and time of the last successful account logon upon logon.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-230381	RHEL-08-020340	SV-230381r858726_rule		Low

Description
Providing users with feedback on when account accesses last occurred facilitates user recognition and reporting of unauthorized account use.

STIG	Date
Red Hat Enterprise Linux 8 Security Technical Implementation Guide	2022-12-06

Details

Check Text ( C-33050r567889_chk )
Verify users are provided with feedback on when account accesses last occurred with the following command: $ sudo grep pam_lastlog /etc/pam.d/postlogin session required pam_lastlog.so showfailed If "pam_lastlog" is missing from "/etc/pam.d/postlogin" file, or the silent option is present, this is a finding.

Fix Text (F-33025r567890_fix)
Configure the operating system to provide users with feedback on when account accesses last occurred by setting the required configuration options in "/etc/pam.d/postlogin". Add the following line to the top of "/etc/pam.d/postlogin": session required pam_lastlog.so showfailed