PAM_LASTLOG(8)

💖 PAM_LASTLOG(8) 💖

okay bestie, gather round, because we're about to talk about pam_lastlog — that's the Linux-PAM Manual page for the lastlog module, and yes she's a whole vibe. 🎀

---

✨ NAME ✨

pam_lastlog — a PAM module that shows you the date of your last login and does the inactive-account lockout thing. she does both. she's multitasking. 💅

---

🌸 SYNOPSIS 🌸

pam_lastlog.so [debug] [silent] [never] [nodate] [nohost] [noterm]
               [nowtmp] [noupdate] [showfailed] [inactive=<days>]
               [unlimited]

look at all those brackets, so many options, she's flexible fr fr 🦋

---

💜 DESCRIPTION 💜

okay so pam_lastlog is a PAM module that displays a line of info about the user's last login. and on top of that, she also maintains the /var/log/lastlog file. upkeep queen 👑

some applications do this whole thing themselves, lowkey. and in those cases? this module is not necessary. so don't be extra. 🙈

here's the tea: the module checks the LASTLOG_UID_MAX option in /etc/login.defs, and it does not update or display last login records for users whose UID is higher than that value. if the option isn't there, or its value is invalid, then no user ID limit gets applied at all. no cap. ✨

and if the module gets called in the auth or account phase? then accounts that weren't used recently enough get disallowed from logging in 💀. but — and this is important — the check is not performed for the root account, so root never gets locked out. also not performed for users with a UID higher than the LASTLOG_UID_MAX value. periodt.

---

🎀 OPTIONS 🎀

• debug — prints debug information. she's telling you everything, oversharing era 💬
• silent — don't tell the user about any previous login, just update the /var/log/lastlog file. ngl this one does not affect the display of bad login attempts, so those still show up.
• never — if the /var/log/lastlog file has no old entries for the user, say that the user has never previously logged in, with a welcome message. aww. 🫶
• nodate — don't display the date of the last login. keeping it mysterious ✨
• noterm — don't display the terminal name where the last login was attempted.
• nohost — don't indicate which host the last login was attempted from.
• nowtmp — don't update the wtmp entry.
• noupdate — don't update any file. zero updates. none. 💀
• showfailed — display the number of failed login attempts and the date of the last failed attempt from btmp. (the date is not displayed when nodate is specified, so keep that in mind bestie)
• inactive=<days> — this one is specifically for the auth or account phase. it sets how many days after the user's last login the user gets locked out by the module. the default value is 90. ninety. ninety days of not logging in and you're out 🚪
• unlimited — if the fsize limit is set, this option can override it, which prevents failures on systems with large UID values that lead lastlog to become a huge sparse file. huge sparse file is giving chaos ngl 😭

---

👑 MODULE TYPES PROVIDED 👑

the auth and account module types let you lock out users who didn't log in recently enough. 🔒

the session module type is provided for displaying the info about the last login and/or updating the lastlog and wtmp files. 🌈

---

⭐ RETURN VALUES ⭐

• PAM_SUCCESS — everything was successful. we love a happy ending 💖
• PAM_SERVICE_ERR — internal service module error. not her fault, it's internal 😭
• PAM_USER_UNKNOWN — user not known. who is she?? 💀
• PAM_AUTH_ERR — user locked out in the auth or account phase due to inactivity.
• PAM_IGNORE — there was an error while reading the lastlog file in the auth or account phase, so the inactivity of the user can't be determined. shrug, we tried 🤷

---

🌈 EXAMPLES 🌈

drop this line into /etc/pam.d/login to display the last login time of a user:

session  required  pam_lastlog.so nowtmp

and if you wanna reject a user when they haven't logged in during the previous 50 days, use this line:

auth  required  pam_lastlog.so inactive=50

slay. copy, paste, done. ✨

---

🍓 FILES 🍓

• /var/log/lastlog — the lastlog logging file. this is where the receipts live 🧾

---

🦋 SEE ALSO 🦋

limits.conf(5), pam.conf(5), pam.d(5), pam(7)

go read those too, bestie, the lore is deep 📚

---

💜 AUTHOR 💜

pam_lastlog was written by Andrew G. Morgan <morgan@kernel.org>.

inactive account lock out added by Tomáš Mráz <tm@t8m.info>.

---

and that's the whole page, no notes 💅 this was Linux-PAM Manual, version dated 09/03/2021 — thanks for coming to my ted talk, mwah 🫶✨