I'm parsing out the
lastlog command into a custom file when a user logs in for use with another application that monitors SSH logins.
/etc/pam.d/sshd I have included the line and the very bottom:
session optional pam_exec.so seteuid /usr/local/bin/run_on_login.sh
This work with one major disadvantage. The script runs BEFORE
/var/log/wtmp is updated. I presume because a successful login is not considered complete until AFTER the script is being ran.
I tried putting the line in
/etc/pam.d/login and it seems to make no difference.
Is there a way to run a pam_exec script after the full login process has completed including writing to the logs?