Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1229724

Summary: pam_lastlog(sshd:session): unable to open /var/log/lastlog: No such file or directory
Product: Red Hat Enterprise Linux 7 Reporter: Jan Pazdziora (Red Hat) <jpazdziora>
Component: rhel-server-atomicAssignee: Colin Walters <walters>
Status: CLOSED WONTFIX QA Contact: atomic-bugs <atomic-bugs>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.1CC: jpazdziora, miabbott, walters
Target Milestone: rcKeywords: Extras
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-12-15 07:34:45 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jan Pazdziora (Red Hat) 2015-06-09 14:01:50 UTC
Description of problem:

On fresh Atomic Host installation, ssh-ing to the host causes errors about /var/log/lastlog logged in journal:

Jun 09 09:55:35 test.example.com sshd[13268]: pam_lastlog(sshd:session): unable to open /var/log/lastlog: No such file or directory
Jun 09 09:55:36 test.example.com sshd[13271]: lastlog_openseek: Couldn't stat /var/log/lastlog: No such file or directory
Jun 09 09:55:36 test.example.com sshd[13271]: lastlog_openseek: Couldn't stat /var/log/lastlog: No such file or directory

Version-Release number of selected component (if applicable):

-bash-4.2# cat /etc/redhat-release 
Red Hat Enterprise Linux Atomic Host release 7.1
-bash-4.2# rpm-ostree status
  TIMESTAMP (UTC)         VERSION     ID             OSNAME          REFSPEC                                            
* 2015-06-08 15:42:52     7.1.575     276bdc26ab     atomic-host     atomic-host:rhel-atomic-host/7/x86_64/standard     

How reproducible:

Deterministic.

Steps to Reproduce:
1. On Atomic Host, run journalctl -f | grep -E 'sss|ssh|AVC'
2. In another terminal, ssh to that Atomic Host

Actual results:

Error lines about /var/log/lastlog.

Expected results:

No error lines about /var/log/lastlog.

Additional info:

The error message is right

-bash-4.2# ls -la /var/log/lastlog
ls: cannot access /var/log/lastlog: No such file or directory

But out of box with no modifications to Atomic's configuration, there shouldn't be errors like that in the log.

Comment 2 Micah Abbott 2018-02-12 16:14:41 UTC
On a freshly booted RHELAH 7.4.5 system, I can see both errors about the missing 'lastlog' file and a message saying that it was created.


# journalctl | grep lastlog
Feb 12 15:34:44 micah-rhelah-vm0212a sshd[13484]: pam_lastlog(sshd:session): unable to open /var/log/lastlog: No such file or directory
Feb 12 15:34:44 micah-rhelah-vm0212a sshd[13484]: lastlog_openseek: Couldn't stat /var/log/lastlog: No such file or directory
Feb 12 15:34:44 micah-rhelah-vm0212a sshd[13484]: lastlog_openseek: Couldn't stat /var/log/lastlog: No such file or directory
Feb 12 15:34:46 micah-rhelah-vm0212a su[13508]: pam_lastlog(su-l:session): file /var/log/lastlog created


It appears that the 'lastlog' file hasn't been created before the first SSH login, but when I escalate privileges via 'sudo su -' this causes the file to be created.

Interestingly, if I do the same thing with a freshly provisioned RHEL 7.4 Server system, there are no errors in the journal about the 'lastlog' file.


From the compose logs for the RHELAH content, I do see the following:

...
Mutating /usr/lib/os-release
Executing postprocessing script 'treecompose-post-7.4.sh'
+ cp -f /usr/lib/locale/locale-archive /usr/lib/locale/locale-archive.tmpl
+ build-locale-archive
Finished postprocessing script 'treecompose-post-7.4.sh'
Initializing rootfs
Moving /usr to target
Copying toplevel compat symlinks
Migrating /usr/etc/passwd to /usr/lib/
Migrating /usr/etc/group to /usr/lib/
Ignoring non-directory/non-symlink '/var/log/tallylog'
Ignoring non-directory/non-symlink '/var/log/grubby_prune_debug'
Ignoring non-directory/non-symlink '/var/log/lastlog'
...


And those three files under /var/log are not present on a freshly provisioned RHELAH host.

Colin, is this something that should be changed as part of our compose process?  Seems like having '/var/log/lastlog' present on a fresh host would be important for keeping parity with RHEL Server.

Comment 4 RHEL Program Management 2020-12-15 07:34:45 UTC
After evaluating this issue, there are no plans to address it further or fix it in an upcoming release.  Therefore, it is being closed.  If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened.

Comment 5 Red Hat Bugzilla 2023-09-14 03:00:23 UTC
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days