How to have "last login" shown when ssh...

[dexus]

On one of my VPS when I login to ssh, it shows "last login: date and IP", I would like to have that shown on every VPS, but I just can't find the way to do that.

Does anyone know how?

Thanks.

[elix]

That's pretty standard...as far as I know, are you sure it's not showing on your other VPSes?

[Izzy]

You can go one better than that for each VPS by adding this line to:
/root/.bash_profile

echo 'ALERT - Root Shell Access on:' `date` `who` | mail -s "Alert: Root Access from `who | awk '{print $6}'`" you@youremailaddress.tld

This will email you every time access is made with the date and time and who accessed.

This way you can get to know quicker and depending on how frequent you poll your reporting email address you will be able to log on to root the same time as who ever else is accessing and then check the .bash_history to see where they have been.

[dexus]

Ok, thanks, that's nice too, but I don't realy want that.

I hope someone will know how to set this.

[dexus]

I just tried that mail alert, and it's not working when you su to root, so that realy doesn't work for me, because I have disabled root login.

[DavidP]

There are some issues with certain versions of SSHD in centos-4 in which case sshd does not log to wtmp. This can be solved by installing the newest version of OpenSSH, but I would not recommend doing that just yet.

I tried to push out this version of ssh a couple of months ago for general use in our VPSes, but was overruled do to lack of testing.

If you're up for the risk, install it and let me know how it goes. I've seen no problems with it right now, however, if you get migrated it will very likely break due to the way virtuozzo handles migrations.

If that happens, you'll have to open a support ticket and have us fix it for you.

[DavidP]

On a side note, if sshd IS logging to wtmp, then you just need to change your configuration file to print the lastlogin. You can find the config file at /etc/ssh/sshd_config.

[Izzy]

Not sure if this is the problem but:
On the VPS that don't show the message check for the exsistance of /var/log/lastlog
On the VPS that does show the message check for the exsistance of /var/log/lastlog

Also worth noting is that if logrotate rotated your /var/log/lastlog then it will be empty and no last login information will be displayed.

/var/log/lastlog - Contains information about the last time a login was done on the system.

[dexus]

It is logging correctly, I can get logins with last and who commands, I just wan't it to show me the last login automaticaly when I login to ssh.

@Izzy
I have /var/log/lastlog on all VPS.

@DavidP
What do I need to change /etc/ssh/sshd_config ? I just didn't find such option.

Thanks.

[Daniel]

Look for the option:

"PrintLastLog" towards the bottom. It should say Yes, if not add it in.

[dexus]

No, that's not it. It still doesn't show last login.

Also on my other VPS, the one that is showing that last login, that option is also commented.

[Daniel]

Does the command 'last' show anything?

[dexus]

Yes, shows, entire list of logins correctly.

[DavidP]

Drop a support ticket and we'll look at it.

[dexus]

I find problem on one VPS. The lastlog file was renamed to lastlog.bak, so I renamed it to lastlog and now that one is showing last login. So only one VPS left with this issue, and I can't realy find what is the problem there.

I will open a support ticket now.

[DavidP]

:) All better then.

[dexus]

I'ts ok now, thank you. :)