I'm parsing out the lastlog command into a custom file when a user logs in for use with another application that monitors SSH logins.

In /etc/pam.d/sshd I have included the line and the very bottom:

session optional pam_exec.so seteuid /usr/local/bin/run_on_login.sh

This work with one major disadvantage. The script runs BEFORE /var/log/lastlog or /var/log/wtmp is updated. I presume because a successful login is not considered complete until AFTER the script is being ran.

I tried putting the line in /etc/pam.d/login and it seems to make no difference.

Is there a way to run a pam_exec script after the full login process has completed including writing to the logs?


I was able to solve this by having the initial /usr/local/bin/run_on_login.sh fork another script that runs as a background process, waits a few seconds, then parses the 'last' command.

In example, pam_exec run this script:

# /usr/local/bin/run_on_login.sh

nohup /usr/local/bin/parse_last.sh >/dev/null 2>&1 &

Which triggers this scripts:

# /usr/local/bin/parse_last.sh

sleep 5

# (truncated for brevity)
last -iF | head -n 50 | awk '{print "something"}'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.