Verify Permissions on /var/log/lastlog(.*) Files
Ensure /var/log/lastlog carries no execute, setuid, setgid or sticky bit and is not other-writable, so the record of users' last logins cannot be tampered with.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/var/log/lastlog records the most recent login of every user. If it is other-writable an attacker can rewrite or wipe their last-login timestamp to cover their tracks, and stray execute or setuid/setgid bits on a pure data file are a sign of tampering or misconfiguration that could be abused. Restricting it keeps the login history trustworthy for forensics and intrusion detection.
What Pavois checks
Pavois reads the live inode of /var/log/lastlog and asserts the absence of any execute, setuid, setgid or sticky bit and of other-write. Checking the real filesystem object catches drift left by a manual chmod, a restore or a misbehaving tool, what matters is the effective mode the kernel enforces, not what a config or package manifest claims.
only_if { file('/var/log/lastlog').exist? }
describe file('/var/log/lastlog') do
it { should_not be_executable.by('owner') }
it { should_not be_setuid }
it { should_not be_executable.by('group') }
it { should_not be_setgid }
it { should_not be_executable.by('other') }
it { should_not be_writable.by('other') }
it { should_not be_sticky }
endHow to verify it is applied
Run stat -c '%A %U:%G' /var/log/lastlog. Expect something like -rw-rw-r-- root:utmp (CIS allows 0664 here) with no x, s, S, t or T, and no write bit for other.
Inspect & investigate
The file itself is consumed by lastlog and last; run lastlog to see the records it protects. To watch for tampering, add auditctl -w /var/log/lastlog -p wa and review /var/log/audit/audit.log. Current state: ls -l /var/log/lastlog.
Remediation
No automated harden plan ships for this rule, so it must be applied manually: chown root:utmp /var/log/lastlog and chmod ug-x,o-wx,u-s,g-s,-t /var/log/lastlog (commonly chmod 0664).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| mode | 0664 |
|---|---|
| path | /var/log/lastlog |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Leaving the file other-writable lets users forge their login history; an erroneous execute bit could be (ab)used if the file is ever replaced. Precautions: lastlog is owned by root:utmp and must stay readable by the utmp group so login programs can update it, do not strip group access or change ownership away from utmp, or pam_lastlog/login may fail to record sessions. Removing bits is safe; tightening to 0600 is usually unnecessary and can break session accounting.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.4.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.