Bug#1111973: release-notes: Release notes suggest to delete /var/log/lastlog*, which seems required by opensshd

"Andreas Jaeger, MMF GmbH" <[email protected]> Mon, 16 Feb 2026 12:08:27 +0100
Newsgroups gmane.linux.debian.devel.ssh
Organization MMF GmbH
Message-ID <2a9166bf-1e2a-477d-9752-9fabfb67c42a__40786.8986179651$1771240653$gmane$org@mmf-research.de>
The information in my previous mail is partly incorrect. Further tests 
with freshly installed Trixie machines show the following behaviour.

0. In the initial Debian Trixie image provided by my ISP liblastlog2-2 
is installed (via util-linux).

1. As long as /var/log/lastlog does not exist, sshd-session logs an INFO 
(Level 6) complaint in the journal. In my case, it is actually logged 
twice per login. No last login message appears in the post-login banner 
of interactive SSH user sessions.

2. sudo touch /var/log/lastlog creates the missing file. From that point 
onward, this file is somehow updated, containing valid data. The last 
login message appears normally in the post-login banner. Furthermore, it 
is configurable via PrintLastLog (yes/no).

3. Installing lastlog2 via apt (with automatic dependencies 
libpam-lastlog2  libpam-wtmpdb  logrotate  wtmpdb) modifies the the 
behaviour. Now, the last login message in the post-login banner is 
placed above the /etc/motd content. And it is placed there even with 
PrintLastLog no. That is to say, this switch appears to be corrupted in 
this scenario.

Hope that helps to clarify things
Andreas