Verify User Who Owns /var/log/lastlog File
Ensures /var/log/lastlog, the per-user last-login record, is owned by root (UID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/var/log/lastlog records the most recent login of every user, the data shown by the lastlog command. If it is not owned by root (UID 0), an attacker could rewrite it to hide the time and origin of a login, erasing evidence of unauthorized access and breaking accountability for who used the system and when.
What Pavois checks
Pavois checks that the owner UID of /var/log/lastlog is 0 (root) when the file exists (only_if). It reads the live filesystem owner (stat) on the target rather than a default, so any chown by a misconfigured PAM/login stack or a deployment script is caught at scan time.
only_if { file('/var/log/lastlog').exist? }
describe file('/var/log/lastlog') do
its('uid') { should eq 0 }
endHow to verify it is applied
Confirm the owner with:
stat -c '%U %u' /var/log/lastlog
Expected output is root 0.
Inspect & investigate
This file holds the last-login data. Inspect ownership and the records:
stat /var/log/lastlog
lastlog
Login events are also written to /var/log/auth.log. Ownership changes can be tracked with grep 'lastlog' /var/log/audit/audit.log if auditd watches are configured.
Remediation
No automated remediation plan is defined, so this rule must be applied manually. Restore root ownership with:
chown root /var/log/lastlog
(pavois harden apply will not change this file until a remediation resource is added.)
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /var/log/lastlog |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Consequences if misconfigured: a non-root owner can tamper with the last-login record to conceal when and from where an account was used.
Precautions before applying: re-owning to root is safe, the login stack writes lastlog as root via PAM. The only_if guard skips hosts that lack the file, so applying the fix is harmless on systems that do not maintain lastlog.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.4.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.