documentation_complete: true

title: 'Print Last Log'

description: |-
    When enabled, SSH will display the date and time of the last
    successful account logon. To enable LastLog in
    SSH, add or correct the following line in the <tt>/etc/ssh/sshd_config</tt> file:
    <pre>PrintLastLog yes</pre>

rationale: |-
    Providing users feedback on when account accesses last occurred facilitates user
    recognition and reporting of unauthorized account use.

severity: medium

identifiers:
    cce: 80504-4

references:
    disa: 52
    nist: AC-9
    srg: SRG-OS-000025
    stigid: RHEL-06-000507

ocil_clause: 'it is commented out or is not enabled'

ocil: |-
    To check if PrintLastLog is enabled or set correctly, run the
    following command:
    <pre>$ sudo grep PrintLastLog /etc/ssh/sshd_config</pre>
    If configured properly, output should be <pre>yes</pre>
