Detections
Analytics
OL6-00-000507 - The operating system, upon successful logon, must display to the user the date and time of the last logon or access via ssh.
Information
Users need to be aware of activity that occurs regarding their account. Providing users with information regarding the date and time of their last successful login allows the user to determine if any unauthorized activity has occurred and gives them an opportunity to notify administrators.At ssh login, a user must be presented with the last successful login date and time.
Solution
Update the 'PrintLastLog' keyword to 'yes' in /etc/ssh/sshd_config:PrintLastLog yes
While it is acceptable to remove the keyword entirely since the default action for the SSH daemon is to print the last login date and time, it is preferred to have the value explicitly documented.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_6_V1R18_STIG.zip
Item Details
Audit Name: DISA STIG Oracle Linux 6 v1r18
Category: ACCESS CONTROL
References: 800-53|AC-9, CAT|II, CCI|CCI-000052, Group-ID|V-50609, Rule-ID|SV-209056r603263_rule, STIG-ID|OL6-00-000507, STIG-Legacy|SV-64815, STIG-Legacy|V-50609, Vuln-ID|V-209056
Plugin: Unix
Control ID: 883a22ca0f1bdf1fa89e42019fa4f3db026a89195560a8caada2cf6f6dc75022