Dear Maintainer,

section 5.1.9 of the release notes says /var/log/lastlog* can be
deleted, as "there is no tool to read" these files.

While this may be true, this file seems still required by opensshd.
After I had deleted the above files, I got the following errors in
syslog:

sshd-session[333690]: lastlog_openseek: Couldn't stat
/var/log/lastlog: No such file or directory

Or did I somehow misunderstand anything?

Many thanks.

Kind regards,

Ralf

is this a bug in openssh?

is this a bug in openssh?

Hi Richard, are you asking me?

Personally, I don't think so, I believe it's probably "normal behavior"
of openssh.

The problem seems to be that this was missed, and thus the release notes
suggested there is no point in keeping the file around and to delete it...

Control: reassign -1 openssh-server

This should be fixed in openssh, probably. #1108375 is related.

Chris

Hi Richard, are you asking me?

Personally, I don't think so, I believe it's probably "normal behavior"
of openssh.

The problem seems to be that this was missed, and thus the release notes
suggested there is no point in keeping the file around and to delete it...

In my opinion, this bug deserves more attention, as it might be relevant
for security:

If configured with "PrintLastLog yes" (the default), openssh-server
checks /var/log/lastlog. It prints a *LastLogin: Date from IP* message
in the post-login banner. Deprecation of lastlog functionality in Debian
13 Trixie effectively disables the LastLogin notice. Discussion should
focus around the functionality, i.e. whether or not future
openssh-server editions should *provide an option to display the last
login in the banner*. The option name *PrintLastLog *refers to its
implementation (i.e. inspection of /var/log/lastlog), which is
unfortunate. If the functionality was to be continued, it should be
renamed to *PrintLastLogin *(or similar). But most importantly, it would
have to find another source of information, like the journal.

Therefore, I believe that *countless workaround proposals *found on the
internet *hide rather than address the problem*. Creating an empty
/var/log/lastlog might keep openssh-server quiet about not finding the
file, but it surely will not supply any information about the last user
login. The same ist true for attempts to stop those messages from
appearing in the journal.

Andreas

The information in my previous mail is partly incorrect. Further tests
with freshly installed Trixie machines show the following behaviour.

0. In the initial Debian Trixie image provided by my ISP liblastlog2-2
is installed (via util-linux).

1. As long as /var/log/lastlog does not exist, sshd-session logs an INFO
(Level 6) complaint in the journal. In my case, it is actually logged
twice per login. No last login message appears in the post-login banner
of interactive SSH user sessions.

2. sudo touch /var/log/lastlog creates the missing file. From that point
onward, this file is somehow updated, containing valid data. The last
login message appears normally in the post-login banner. Furthermore, it
is configurable via PrintLastLog (yes/no).

3. Installing lastlog2 via apt (with automatic dependencies
libpam-lastlog2  libpam-wtmpdb  logrotate  wtmpdb) modifies the the
behaviour. Now, the last login message in the post-login banner is
placed above the /etc/motd content. And it is placed there even with
PrintLastLog no. That is to say, this switch appears to be corrupted in
this scenario.

Hope that helps to clarify things
Andreas