Ensure PAM Displays Last Logon/Access Notification
Description
To configure the system to notify users of last logon/access using pam_lastlog
,
add or correct the pam_lastlog
settings in /etc/pam.d/postlogin
to include showfailed
option, such as:
session [default=1] pam_lastlog.so showfailed
And make sure that the silent
option is not set for this specific line.
Rationale
Users need to be aware of activity that occurs regarding their account. Providing users with
information regarding the number of unsuccessful attempts that were made to login to their
account allows the user to determine if any unauthorized activity has occurred and gives them
an opportunity to notify administrators.
Warning
If the system relies on authselect
tool to manage PAM settings, the remediation
will also use authselect
tool. However, if any manual modification was made in
PAM files, the authselect
integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.