Verify Group Who Owns /var/log/lastlog File
Ensures /var/log/lastlog is group-owned by utmp so login-accounting data stays accurate and tamper-resistant.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/var/log/lastlog records the most recent login of every user and is consulted at login time. Its expected group is utmp so the login-accounting subsystem can update it while ordinary users cannot rewrite it. A wrong group could let an attacker falsify last-login records to hide unauthorized access, or read login patterns. Setting the group to utmp keeps login accounting accurate and tamper-resistant.
What Pavois checks
Pavois reads the resolved group ownership of /var/log/lastlog via the InSpec file resource and asserts the group is utmp. It inspects the live inode metadata, so it reflects the file's actual ownership rather than a packaged default, important because login tooling may recreate the file.
only_if { file('/var/log/lastlog').exist? }
describe file('/var/log/lastlog') do
its('group') { should be_in ['root', 'utmp'] }
endHow to verify it is applied
Run stat -c '%G' /var/log/lastlog. The expected output is:
utmp
List it with ls -l /var/log/lastlog, and view its contents with the lastlog command.
Inspect & investigate
This file is the last-login database: read it with lastlog (per-user latest login) and cross-check active sessions with last (from /var/log/wtmp) and who. To trace permission changes, add an auditd watch (auditctl -w /var/log/lastlog -p wa -k logperms) and grep /var/log/audit/audit.log for key="logperms".
Remediation
No automated remediation for this rule, apply it manually following the standard.
Impact & precautions
A wrong group can let an attacker forge or read last-login records, weakening intrusion detection. The fix only changes group ownership; it does not disrupt logins. Precaution: keep the group utmp, not root, the PAM/login stack relies on the utmp group to update the file, and forcing root could break last-login recording. Note newer systems may use /var/log/lastlog2 (an SQLite DB); verify which file is in use before adjusting.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.4.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.