AIX /etc/security/lastlog not updated when login via ssh

Security auditing has led us to find that on older AIX systems, accessing the system via ssh does NOT result in /etc/security/lastlog being updated. We have about 40 systems where this is a problem; a typical one has levels:
iswhbfocd# oslevel
iswhbfocd# ssh -V
OpenSSH_3.6.1p2, SSH protocols 1.5/2.0, OpenSSL 0x0090701f
(Also happens with OpenSSH_2.5.2p2, OpenSSH_3.4p1,OpenSSH_3.7.1p1)
Can anyone point me to where/how I can enable logging to
lastlog? In later systems I can see a stanza in sshd.config:
PrintLastLog yes
# Specifies whether sshd should print the date and time when the
# user last logged in. The default is ``yes''.
Is this relevant?
Any comments would be appreciated.
Regards, Bernie.
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Did you build the openssh binary from soure or download the binary from

If you built it from soure, when you run configure, did you include:
--with-lastlog=FILE will specify the location of the lastlog file.
./configure searches a few locations for lastlog, but may not find
it if lastlog is installed in a different place.

All your AIX boxes are running the same version of OS? and openssh is complied
with the same version of AIX? (if you complied on AIX 4.x, lastlog will not work under
AIX 5.x).
You can also try to download a newer version of openssh binary package from
the following site (IBM), and install and test it out, it should work.
when  u installed it, did u mention

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
The 7 Worst Nightmares of a Sysadmin

Fear not! To defend your business’ IT systems we’re going to shine a light on the seven most sinister terrors that haunt sysadmins. That way you can be sure there’s nothing in your stack waiting to go bump in the night.

bernie01Author Commented:
Update: found that by changing /usr/local/etc/sshd_config parm #UseLogin no, change to UseLogin yes I can get an entry placed in /etc/security/lastlog on the systems with
But have found that the majority of these systems run
OpenSSH_2.5.2p2, SSH protocols 1.5/2.0,
and when I try the above fix on these boxes I get error:

spwhsms# su - webaeb
$ ssh localhost
webaeb@localhost's password:
Permission denied, please try again.
webaeb@localhost's password:
/dev/pts/4: 3004-004 You must "exec" login from the lowest login shell.
This version of Openssh was installed long, long before my time.  I am not sure whether the insallation was from binaries or source.  
If you don't know how the old version of openssh was installed (complied), and you want to make
it to work with lastlog.  It is time to uodate it now. (download the binary from IBM site, or download
the source and complie it yourself. I thinks bianary is easy way to do it.)
"spwhsms# su - webaeb
$ ssh localhost
webaeb@localhost's password:
Permission denied, please try again.
webaeb@localhost's password:
/dev/pts/4: 3004-004 You must "exec" login from the lowest login shell."

It looks like it is a bug in the older version of openssh:

Please consider to update your openssh.
bernie01Author Commented:
These systems are AIX 4.1.5 and 4.2.1 level. Looking at IBM's OpenSSH download pages I dont think there is a binary version for these old levels of AIX:
For now we have altered the Audit tool to ignore these errors.  
Well, if you are using 4.x, you endup have to compile it yourself, you only need to do it
in one box, and then create a tar ball to copy it to different boxes.
There are a few versions of sshd around:
one from IBM Linux Affinity Toolbox, which writes lastlog, but fails to log in users oftenly.
one from IBM, in bff format, kind of too old to be secure.
another from, once you configure syslog, it writes some records on connections/sessions.
none writes that lastlog, i.e. no login sessions...( try UseLogin yes in sshd_config, this may help or just lock you off the system).

oslevel of 4.2.x.x is too old ....

what do you audited about $ cat . ??? writesrv ??? portmap ??? these are nasty&unavoidable
no need to secure connections, for sure vulnerable portmapper is always on...
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
OS Security

From novice to tech pro — start learning today.