[SRU] login: remove pam_lastlog.so from config

[Alfonso Sanchez-Beato]

[ Impact ]

 * The following line has been found in users logs when trying to log in to their systems:
   login[2449]: PAM unable to dlopen(pam_lastlog.so): /usr/lib/security/pam_lastlog.so: cannot open shared object file: No such file or directory
   This is the only known occurrence of the log. It occurs when users log in to their systems using a tty, or rather referred to as the 'login' method in shadow/pam etc. This log error message is not present when logging in via ssh, gdm, xdm, or other login methods, as they do not depend on the lastlog binary.

 * The upload fixes the issue by dropping pam_lastlog.so from all config, as well as not installing the lastlog binary.

[ Test Plan ]

```
wget https://releases.ubuntu.com/noble/ubuntu-24.04.1-desktop-amd64.iso
qemu-system-x86_64 -boot d -cdrom /path/to/ubuntu-24.04.1-desktop-amd64.iso -m 8192M -smp 2 -hda /tmp/yarf-vm.qcow2 -enable-kvm -device qxl
# install the system, and reboot
# at the login screen post-reboot, press ctrl+alt+f2
# login via tty
journalctl -b 0 --no-pager | grep pam_lastlog.so
# and you will see the error message
sudo sed '/session optional pam_lastlog.so/d' /etc/pam.d/login
# logout
# log back in via tty
journalctl # check the logs since you logged in, you will not see any mention of pam_lastlog.so
```

 * In order to test this after the fix lands in noble proposed, do the same as above, except instead of manuall removing the entry from /etc/pam.d/login, install the version of shadow from proposed, and assert that the log messages are no longer present.

[ Where problems could occur ]

 * It seems extremely improbable anyone would configure login.pam to explicitly *require* pam_lastlog.so, I also can't imagine anyone would create any functionality that'd explicitly *depend* on pam_lastlog.so being *required*.

[ Other Info ]

 * the pam_lastlog.so binary was dropped in shadow/1:4.13+dfsg1-5. Included in this change also is dropping pam_lastlog.so from debian/login.pam.

 * The version of shadow in oracular is 1:4.15.3-3ubuntu2, and thus this error message isn't present in oracular onwards.

 * We absolutely *cannot* re-introduce pam_lastlog.so as it was dropped as part of the time_t transition, see commit: https://github.com/linux-pam/linux-pam/commit/357a4ddbe9b4b10ebd805d2af3e32f3ead5b8816

 * pam_lastlog2 is depended upon in util-linux after version 2.40-7. We can make changes in shadow going forward that depends on pam_lastlog2 rather than pam_lastlog. But that's not really relevant to the SRU I guess. These changes are planned to be implemented upstream https://bugs.debian.org/cgi-bin/bugreport.cgi?att=0;bug=1068229;msg=39, so likely from Ubuntu's side, we can just wait for the changes.

 * However, upstream, shadow still doesn't have any mention of lastlog2 in debian/login.pam. So we can't SRU a change to depend on this new lastlog binary, as it's not in devel yet.

 * We could, however, SRU a change wherein we revert the dropping of pam_lastlog.so in shadow, but this is more involved and would likely be a separate SRU, wherein either that SRU or this one lands.

[Original description]

Imported from Debian bug http://bugs.debian.org/1068229:

Package: libpam-modules
Version: 1.5.3-6
Severity: normal

I noticed the following line in my logs:

login[2449]: PAM unable to dlopen(pam_lastlog.so): /usr/lib/security/pam_lastlog.so: cannot open shared object file: No such file or directory

I looked in the deb files from snapshot.debian.org, and noticed the last version
that had it was 1.5.2-9.1 - starting from 1.5.3-1 it disappeared.

Maybe it's fallout from the time_t transition and you're already aware of it, in
which case feel free to close.

Thanks,

-- M

-- System Information:
Debian Release: trixie/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386, arm64

Kernel: Linux 6.7.9-amd64 (SMP w/4 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages libpam-modules depends on:
ii debconf [debconf-2.0] 1.5.86
ii libaudit1 1:3.1.2-2.1
ii libc6 2.37-15.1
ii libcrypt1 1:4.4.36-4
ii libpam-modules-bin 1.5.3-6
ii libpam0g 1.5.3-6
ii libselinux1 3.5-2
ii libsystemd0 255.4-1+b1

libpam-modules recommends no packages.

libpam-modules suggests no packages.

-- debconf information excluded

[Alfonso Sanchez-Beato (alfonsosanchezbeato)]

/etc/pam.d/login references the module:

session optional pam_lastlog.so

[Ramonskie (ramonskie)]

i acknowledge that pam_lastlog.so is indeed removed from this package

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Andrei B (bogatav)]

Hello!

Can't run my system properly whith this one, all the time can't pass the login screen. While you fixing it is there any workaround?

[Ramonskie (ramonskie)]

pam_lastlog is deprecated but should be replaced with pam_lastlog2
which is now packaged with util-linux

but the util-linux shipped with noble is 2.39.3-9ubuntu6
and it seems that its only packaged with util-linux => 2.40

[Seth Arnold (seth-arnold)]

Andrei, try to log in via multiple methods. Every service (ssh, login, gdm, xdm, etc) has its own PAM configuration and some of them may reference this module and some may not.

Once you've logged in, edit the files in /etc/pam.d/ that reference this module. Remove or comment them out. Save, then test. Don't quit any root shells in the process of testing, because changing PAM configuration can lock you out of your system -- as you've discovered.

Thanks

[cosine (mvanross)]

Hi

I think this is related to an issue with last and lastlog.

I have users who log in via ssh, but do not show with last or lastlog.

Solution might be with /etc/pam.d/sshd
https://unix.stackexchange.com/questions/348620/why-my-linux-doesnt-display-last-login-date

[Thomas Dejean (th2j84)]

Hi,

As suggested before, i edited the file /etc/pam.d/login :

sudo nano /etc/pam.d/login

and commented this line with #, and restarted :

#session optional pam_lastlog.so

[Ramonskie (ramonskie)]

is there any possibility to upgrade util-linux to 2.40 in noble repository
so this issue can be solved?

[Julian Andres Klode (juliank)]

triage: remove pam_lastlog.so from configuration following the debian change

[Tim Andersson (andersson123)]

Hi all,

I spent some time reproducing this issue, thus far, it seems as though this issue is entirely cosmetic - I've only been able to reproduce the annoying log message, but have failed to reproduce any issues actually logging in. Can anyone please confirm to me that this issue is purely cosmetic?

@bogatav do you have any more details about your system you can provide which will help me to reproduce your issue? Otherwise, I will SRU a fix only to stop the occurrence of the log message regarding pam_lastlog.so.

Since this is an SRU, I won't apply the whole patch as debian did:
https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=1068229;filename=shadow-4.13%2Bdfsg1-4.1-nmu.diff;msg=39

I plan to just remove the mention of pam_lastlog.so from debian/login.pam. Removing mentions of the lastlog binary may break any scripts using lastlog.

[Mikael Boke (mibolunda)]

I believe it is a problem, since it seems to be causing "last" not to work correctly.

Removing the entry in /etc/pam.d/login will just clean up the /var/log/auth.log file and not fix the missing entry in /var/log/wtmp - right?

[Tim Andersson (andersson123)]

Hi Mikael,

The missing entry in /var/log/wtmp is a pre-existing issue. To fix that in noble would involve a separate SRU, to my understanding. We would need to SRU changes from util-linux/2.40* (which includes pam_lastlog2.so) to noble, as well as SRU'ing changes to shadow which would involve depending on the lastlog2 binary instead of lastlog.

This SRU is about getting rid of the noisy log messages from /var/log/auth.log

Thanks, and please let me know if you believe this to be inaccurate.

[Tim Andersson (andersson123)]

MP attached to bug, ready for review, I think

[Tim Andersson (andersson123)]

Staging this bug with block-proposed-noble as the impact isn't high enough to warrant an upload on it's own. This is a nice-to-have, fixing a cosmetic issue, and should be bundled with another SRU.

[Tim Andersson (andersson123)]

Looking for sponsorship for this!

[Timo Aaltonen (tjaalton)]

Hello Alfonso, or anyone else affected,

Accepted shadow into noble-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/shadow/1:4.13+dfsg1-4ubuntu3.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-noble to verification-done-noble. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-noble. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Tim Andersson (andersson123)]

I performed a fresh noble install in a VM, first I verified that the issue was still persistent. See screenshot attached

[Tim Andersson (andersson123)]

Then, (in GDM, not a tty) I downloaded:
http://launchpadlibrarian.net/761035045/login_4.13+dfsg1-4ubuntu3.3_amd64.deb

Ran:
```
sudo apt install ./login_4.13+dfsg1-4ubuntu3.3_amd64.deb
```
verified that the problematic entry was no longer present in /etc/pam.d/login:
```
$ cat /etc/pam.d/login | grep lastlog
$ echo $?
1
$
```
Then, I logged back in via tty, and took the screenshot attached in this comment, verifying that the log message no longer persists.

[Valentyna (valia0906)]

update to login 4.13+dfsg1-4ubuntu3.3 solved problem

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted shadow (1:4.13+dfsg1-4ubuntu3.3) for noble have finished running.
The following regressions have been reported in tests triggered by the package:

autopkgtest/5.38ubuntu1~24.04.1 (arm64)
samba/2:4.19.5+dfsg-4ubuntu9 (s390x)
samba/unknown (amd64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/noble/update_excuses.html#shadow

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!