Bug#1111973: release-notes: Release notes suggest to delete /var/log/lastlog*, which seems required by opensshd
"Andreas Jaeger, MMF GmbH" <[email protected]> Sat, 14 Feb 2026 11:50:37 +0100
| Newsgroups | gmane.linux.debian.devel.ssh |
|---|---|
| Organization | MMF GmbH |
| Message-ID | <f7c77df3-a176-47fd-b395-30c3ca91cb7c__38079.2532976315$1771066770$gmane$org@mmf-research.de> |
In my opinion, this bug deserves more attention, as it might be relevant for security: If configured with "PrintLastLog yes" (the default), openssh-server checks /var/log/lastlog. It prints a *LastLogin: Date from IP* message in the post-login banner. Deprecation of lastlog functionality in Debian 13 Trixie effectively disables the LastLogin notice. Discussion should focus around the functionality, i.e. whether or not future openssh-server editions should *provide an option to display the last login in the banner*. The option name *PrintLastLog *refers to its implementation (i.e. inspection of /var/log/lastlog), which is unfortunate. If the functionality was to be continued, it should be renamed to *PrintLastLogin *(or similar). But most importantly, it would have to find another source of information, like the journal. Therefore, I believe that *countless workaround proposals *found on the internet *hide rather than address the problem*. Creating an empty /var/log/lastlog might keep openssh-server quiet about not finding the file, but it surely will not supply any information about the last user login. The same ist true for attempts to stop those messages from appearing in the journal. Andreas