Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm trying to configure the PAM modules working with su command. I want to su shows the "last login" information, as ssh or login do.

I find, on /etc/pam.d/login a PAM module called pam_lastlog that does exactly what I want. I simply copy the line from login to su configuration file, but when I run su I didn't get the expected behavior.

This is the content of my /etc/pam.d/su:

#%PAM-1.0
auth     sufficient     pam_rootok.so
auth     include        common-auth
account  sufficient     pam_rootok.so
account  include        common-account
password include        common-password
session  include        common-session
session  optional   pam_lastlog.so  nowtmp
session  optional       pam_xauth.so

This is the default GNU/Linux distribution's file, only adding the session optional pam_lastlog.so nowtmp line commented above.

Why is this not working?

share|improve this question

migrated from serverfault.com May 31 '13 at 16:42

This question came from our site for professional system and network administrators.

2 Answers 2

up vote 1 down vote accepted

Try changing your line to:

session required pam_lastlog.so nowtmp

    $ su 
Password: 
Last login: Thu May 30 16:19:42 EDT 2013 on pts/0

Works on RHEL/CentOS 6 box.

share|improve this answer
    
Hi! Thanks for your answer jeffattrackaid, but it is still not working on the distro I'm testing. I just tested on another distro (Debian) and it works using session optional too! Is there any way to "debug" de PAM API and check what is happening? –  JoseLSegura May 31 '13 at 6:17
    
I just discover my mistake: I was writing the config line after the include common-session. Now, I just put it before this line and it works. I still cannot understand why is this happening. My common-session file has the following modules: pam_limits (required), pam_unix2 (required) and pam_umask (optional). –  JoseLSegura May 31 '13 at 7:06

I just figured that changing the order on the session modules works:

#%PAM-1.0
auth     sufficient     pam_rootok.so
auth     include        common-auth
account  sufficient     pam_rootok.so
account  include        common-account
password include        common-password
session  optional       pam_lastlog.so  nowtmp
session  include        common-session
session  optional       pam_xauth.so

Putting pam_lastlog just before the include of common-session just works. As you can read in my comment to @jeffatrackaid, I still don't understand why the order influences in that way.

The common-session included file has the following 3 modules:

session  required      pam_limits.so
session  required      pam_unix2.so
session  optional      pam_umask.so

Any idea?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.