#1066060 libpam-modules: pam_lastlog.so missing

Package:
libpam-modules
Source:
libpam-modules
Description:
Pluggable Authentication Modules for PAM
Submitter:
Mourad De Clerck
Date:
2025-01-21 00:09:02 UTC
Severity:
normal
#1066060#5
Date:
2024-03-11 21:12:29 UTC
From:
To:
I noticed the following line in my logs:

login[2449]: PAM unable to dlopen(pam_lastlog.so): /usr/lib/security/pam_lastlog.so: cannot open shared object file: No such file or directory

I looked in the deb files from snapshot.debian.org, and noticed the last version
that had it was 1.5.2-9.1 - starting from 1.5.3-1 it disappeared.

Maybe it's fallout from the time_t transition and you're already aware of it, in
which case feel free to close.

Thanks,
#1066060#10
Date:
2024-03-30 22:31:39 UTC
From:
To:
I don't know what the Debian pam maintainers intend to do about it, but
this is surely the result of:

https://github.com/linux-pam/linux-pam/commit/357a4ddbe9b4b10ebd805d2af3e32f3ead5b8816

A note in NEWS.Debian might be worthwhile.
#1066060#15
Date:
2024-04-02 08:58:01 UTC
From:
To:
Hi,
[..]

login should also stop having pam_lastlog.so in its PAM
configuration, but this is something src:login needs to do.
I've cloned this bug report to src:login for this part.

I'll note that #1068017 has discussion about enabling
pam_lastlog2.so, where we'd also appreciate your input regarding
sshd, Colin.

Chris
#1066060#22
Date:
2024-04-02 09:29:40 UTC
From:
To:
Yep, replied there.
#1066060#27
Date:
2024-05-29 21:49:37 UTC
From:
To:
Dear shadow maintainers,

as originally requested, please drop pam_lastlog.so from the PAM
config.

Please also drop the lastlog binary, which isn't very useful when
the data it is reading is not updated anymore.

Chris
#1066060#36
Date:
2024-05-30 00:22:23 UTC
From:
To:
Apologies, this was the wrong half of the bug.

I think in src:pam not much is to be done, except the NEWS.Debian
entry?

Chris
#1066060#47
Date:
2025-01-20 22:28:55 UTC
From:
To:
Hi.
I wish I had noticed this back in May, but I missed it then and only ran
across it while looking at the new pam build system.

It looks like pam_lastlog was deprecated in pam 1.5, but *not* removed.
It's a build time option, and it looks like it is still present in pam
1.7, which I hope to ship for trixie.
I suspect it will eventually go away.
But if we want pam_lastlog for one last release, that's easy to
accomplish.

Should I bring back pam_lastlog for trixie?
I apologize I don't remember where we got with everything and whether
this would help or just make more of a mess.
Let me know what is desired.
#1066060#52
Date:
2025-01-20 23:06:50 UTC
From:
To:
* Sam Hartman <hartmans@debian.org> [250120 23:29]:
[..]
[..]

No, please don't. We already have a release notes draft for
pam_lastlog2 and the packaging and so on.

Best,
Chris
#1066060#57
Date:
2025-01-21 00:04:01 UTC
From:
To:
    Chris> No, please don't. We already have a release notes draft for
    Chris> pam_lastlog2 and the packaging and so on.

Confirmed.