UCF STIG Viewer Logo

The system must display the date and time of the last successful account login upon login.


Overview

Finding ID Version Rule ID IA Controls Severity
V-22299 GEN000452 SV-44833r1_rule Low
Description
Providing users with feedback on when account accesses last occurred facilitates user recognition and reporting of unauthorized account use.
STIG Date
SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide 2018-09-19

Details

Check Text ( C-42304r1_chk )
Check that pam_lastlog is used and not silent, or that the SSH daemon is configured to display last login information.

# grep pam_lastlog /etc/pam.d/sshd
If pam_lastlog is present, and does not have the "silent" option, this is not a finding.

# grep -i PrintLastLog /etc/ssh/sshd_config


If PrintLastLog is not enabled in the configuration either explicitly or by default, this is a finding.
Fix Text (F-38270r1_fix)
Implement pam_lastlog, or enable PrintLastLog in the SSH daemon.

To enable pam_lastlog, add a line such as "session required pam_lastlog.so" to /etc/pam.d/sshd.

To enable PrintLastLog in the SSH daemon, remove any lines disabling this option from /etc/ssh/sshd_config.