Bug 1014285

Logins using lightdm are not recorded in /var/log/wtmp and so no login history is maintained. For any system, the recording of logins is needed for basic security auditing. [G]dm and kdm, for example, both properly record to /var/log/wtmp.

Although /etc/pam.d/lightdm "includes" the "postlogin" pam file, /etc/pam.d/postlogin and /etc/pam.d/postlogin-ac (with authconfig) by default do not process wtmp entries. [A]uthconfig will overwrite any changes made to /etc/pam.d/postlogin-ac if enabling wtmp processing is attempted there. The policy seems to be that any wtmp processing is the responsibility of the display manager.

Enabling wtmp processing for lightdm can be achieved simply by adding an entry such as "session optional pam_lastlog.so silent" or something similar to /etc/pam.d/lightdm near the end of the file before "including" postlogin. The changes can be seen in the following commands and output.

#################
[root@chariot ~]# cat /etc/pam.d/lightdm
#%PAM-1.0
auth     [success=done ignore=ignore default=bad] pam_selinux_permit.so
auth       required    pam_env.so
auth       substack    system-auth
-auth       optional    pam_gnome_keyring.so
-auth       optional    pam_mate_keyring.so
auth       include     postlogin
account    required    pam_nologin.so
account    include     system-auth
password   include     system-auth
session    required    pam_selinux.so close
session    required    pam_loginuid.so
session    optional    pam_console.so
-session    optional    pam_ck_connector.so
session    required    pam_selinux.so open
session    optional    pam_keyinit.so force revoke
session    required    pam_namespace.so
-session    optional    pam_gnome_keyring.so auto_start
-session    optional    pam_mate_keyring.so auto_start
session    include     system-auth
session    include     postlogin

#################
[root@chariot ~]# sed -i -e 21i"session    optional    pam_lastlog.so silent" /etc/pam.d/lightdm ; cat /etc/pam.d/lightdm
#%PAM-1.0
auth     [success=done ignore=ignore default=bad] pam_selinux_permit.so
auth       required    pam_env.so
auth       substack    system-auth
-auth       optional    pam_gnome_keyring.so
-auth       optional    pam_mate_keyring.so
auth       include     postlogin
account    required    pam_nologin.so
account    include     system-auth
password   include     system-auth
session    required    pam_selinux.so close
session    required    pam_loginuid.so
session    optional    pam_console.so
-session    optional    pam_ck_connector.so
session    required    pam_selinux.so open
session    optional    pam_keyinit.so force revoke
session    required    pam_namespace.so
-session    optional    pam_gnome_keyring.so auto_start
-session    optional    pam_mate_keyring.so auto_start
session    include     system-auth
session    optional    pam_lastlog.so silent
session    include     postlogin