Noble: default pam config for login tries do load non-existent pam_lastlog.so

Bug #2063257 reported by Andreas Hasenack
22
This bug affects 4 people
Affects Status Importance Assigned to Milestone
shadow (Debian)
New
Unknown
shadow (Ubuntu)
Confirmed
Undecided
Unassigned
Noble
Confirmed
Undecided
Unassigned

Bug Description

pam_lastlog.so was dropped by upstream in 1.5.3[1][4]. It's still there in the code, but not built by default.

And indeed, in noble (1.5.3) we don't have it, while mantic (1.5.2) does.

This does not prevent console logins, but generates an error in the logs:
Apr 23 20:02:09 n1 login[835]: PAM unable to dlopen(pam_lastlog.so): /usr/lib/security/pam_lastlog.so: cannot open shared object file: No such file or directory
Apr 23 20:02:09 n1 login[835]: PAM adding faulty module: pam_lastlog.so

Debian's shadow package is also still shipping this config[2].

If you think we should re-enable pam_lastlog, then this becomes a bug in the src:pam package, but keep in mind upstream is keen on removing it, and we might be better off switching to an alternative, perhaps pam_lastlog2[3].

1. https://github.com/linux-pam/linux-pam/blob/cec36a8cd2c69cc87eacc21da471334fbef128ee/NEWS#L65
2. https://salsa.debian.org/debian/shadow/-/blob/master/debian/login.pam?ref_type=heads#L82
3. https://wiki.debian.org/PamLastlog2
4. https://github.com/linux-pam/linux-pam/commit/357a4ddbe9b4b10ebd805d2af3e32f3ead5b8816

summary: - Default pam config for login tries do load non-existent pam module
- pam_lastlog.so
+ Noble: default pam config for login tries do load non-existent pam
+ module pam_lastlog.so
summary: - Noble: default pam config for login tries do load non-existent pam
- module pam_lastlog.so
+ Noble: default pam config for login tries do load non-existent
+ pam_lastlog.so
description: updated
description: updated
Changed in shadow (Debian):
status: Unknown → New
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in shadow (Ubuntu Noble):
status: New → Confirmed
Changed in shadow (Ubuntu):
status: New → Confirmed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.