Comments on: Double motd and last login

By: Aleksandr Tsertkov

Aleksandr Tsertkov — Tue, 11 Jan 2011 19:02:08 +0000

long holidays. cleaning up now, sorry.

By: GigaHooker

GigaHooker — Thu, 06 Jan 2011 21:02:24 +0000

So lot of spam.. WHY?!
Moderator, WTF??????

By: ben K

ben K — Wed, 03 Dec 2008 02:05:58 +0000

Nolan, thanks for pointing this out; it’s an even better (and simpler) solution. I’m surprised I didn’t read through the rest of sshd_config and pay attention to the UsePAM setting!

Thanks.

By: Alexandr Chertkov

Alexandr Chertkov — Tue, 02 Dec 2008 09:49:31 +0000

Thats a good point, Nolan!

By: Nolan Eakins

Nolan Eakins — Tue, 02 Dec 2008 02:59:29 +0000

Thanks for this. After reading this, I toggled a few settings to see what they did. Setting SSHD’s UsePAM option to “no” also fixed this issue for me along w/ the other possible fixes.

By: ben K

ben K — Fri, 28 Nov 2008 00:12:49 +0000

Thanks, this is what I’ve now done (more or less). I commented out the lastlog, motd and mail modules in /etc/pam/system-login (which is included from system-remote-login which is included from sshd).

Maybe a more proper solution though would be to edit /etc/pam/sshd directly as you suggest, so as not to inadvertently cripple anything else using the system-login method…

By: Alexandr Chertkov

Alexandr Chertkov — Sat, 15 Nov 2008 09:48:43 +0000

It looks that ssh does not have any configuration option to disable lastlog logging. Though you can overwrite “session” pam.d rules for ssh in /etc/pam.d/sshd file, remove pam_lastlog.so and pam_motd.so lines and enable PrintMotd and PrintLastLog in /etc/sshd_config.

For example in my case I got following pam.d/sshd:

auth       include      system-remote-login
account    include      system-remote-login
password   include      system-remote-login
 
session    required     pam_env.so
session    include      system-auth

By: ben K

ben K — Fri, 14 Nov 2008 22:01:18 +0000

Thanks too; this addresses the exact issue I was seeking by a google search for “gentoo ssh double login”!

I’ve disabled the params in the ssh config as you suggest, and it suppresses the double motd. However, there are still double entries in the ‘last’ log (one for ‘ssh’, and one for the ‘pts/X’). The ‘ssh’ entries didn’t used to show up before the upgrade. How can I remove the redundant logging?

ben

By: Ferran

Ferran — Wed, 12 Nov 2008 13:01:58 +0000

This issue was on my system after recovering /etc from a backup and re-emerging system packages and i was searching around like a fool; thank you!

By: Sascha W.

Sascha W. — Tue, 11 Nov 2008 18:25:40 +0000

Very useful.
Thank You.