Enable SSH Print Last Log
Makes sshd display the date, time and origin of the user's previous login at each SSH login by setting PrintLastLog yes.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
Showing the previous login's time and source IP at each SSH login gives users immediate feedback to spot accesses they did not perform. This human-in-the-loop signal helps detect and report compromised credentials or unauthorized account use far sooner than relying on log review alone.
What Pavois checks
Pavois reads the effective printlastlog value from sshd -T, the daemon's resolved configuration. A scan of /etc/ssh/sshd_config could miss a value set in an Included drop-in under /etc/ssh/sshd_config.d/, sshd -T reflects exactly what the running daemon enforces.
describe command('sshd -T') do
its('stdout') { should match(/^printlastlog\s+yes$/i) }
endHow to verify it is applied
Run sudo sshd -T | grep -i printlastlog. The expected output is printlastlog yes. You can also log in interactively and confirm a Last login: ... line appears.
Inspect & investigate
The data shown comes from the lastlog database; inspect it with lastlog or last. SSH login events themselves are recorded in /var/log/secure (RHEL family), follow with journalctl -u sshd -f.
Remediation
pavois harden apply sets the sshd_setting directive printlastlog to yes in a managed drop-in, validates it with sshd -t -f %{path}, then notifies a reload of the ssh service so the last-login line is shown without dropping live sessions.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| directive | printlastlog |
|---|---|
| notify | action: reload, service: ssh.service |
| resource | sshd_setting |
| value | yes |
| verify | sshd -t -f %{path} |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
With PrintLastLog no, users lose a simple early-warning cue and may not notice that their account was used by someone else. Enabling it is cosmetic-to-helpful and carries essentially no operational risk. Precaution: if PAM already prints the last-login line (some distributions do via pam_lastlog), you may see it twice, harmless, but you can disable one source if desired. The reload preserves your current SSH session, so there is no lockout risk.