4.2 and the 'last' command

[Jason.C.Burns at wellsfargo.com]

> Jason.C.Burns at wellsfargo.com wrote:
> > My question:  I can't find in the source where 'last' is explicitly 
> > called, so is there an API call that was added between 
> these versions 
> > that would refer the system to 'last'?
> 
> Depends.  What platform are you running, and which build and 
> run-time options have you enabled?
> 
> AFAIK sshd doesn't exec "last" itself, although it's possible 
> that something it calls does under the covers.

Thanks for the reply Darren.

The main system I can see the problem is HP-UX, 11.00 and 11i.

The build options are:
--with-pam
--disable-suid-ssh
--without-rsh
--with-ssl-dir=
--with-kerberos5=
--with-tcp-wrappers=
--with-zlib=
--with-default-path=
--with-superuser-path=
--without-privsep-user
--without-privsep-path
--prefix=
--sysconfdir=
--with-libs="-L/lib -L/usr/lib -L/usr/local/lib"
--with-rand-helper
--with-random=/dev/urandom
--with-ldflags=-ldld

Run time:
ssh:
ForwardX11 yes
GSSAPIDelegateCredentials yes
GSSAPIAuthentication yes

sshd:
ChallengeResponseAuthentication yes
KerberosAuthentication no
GSSAPIAuthentication yes
UsePAM yes
X11Forwarding yes
UsePrivilegeSeparation no
MaxStartups 30
Subsystem       sftp    /usr/libexec/sftp-server


I agree.  From what I've looked at, I can't see 'last' being called
explicitly.  Using process monitoring tools, I don't even see last being
called on Linux and Solaris systems, but it could be running too fast to
catch.  I'm still looking to see anything where sshd asks the system for
the last login information and last is implicitly called, but any
information you might be able to provide would be much appreciated!

Jason