id: file-hide-last-login-information

info:
  name: Hide SSH Last Login Information
  author: pussycat0x
  severity: unknown
  description: |
    SSH last login information helps detect unauthorized access but may expose user activity details to attackers.
  remediation: |
    Set PrintLastLog no in /etc/ssh/sshd_config to disable last login information and restart the SSH service.
  reference:
    - https://vishalraj82.medium.com/hardening-openssh-security-37f5d634015f
    - https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209441
  metadata:
    verified: true
  tags: audit,config,file,ssh

file:
  - extensions:
      - all

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "# This is the sshd server system-wide configuration file"

      - type: word
        words:
          - "PrintLastLog no"
        negative: true
# digest: 4a0a0047304502203511c2c0820b0cdc82fa8a38fd494d06ff1437847cc3620ac9ebdde0526e884e02210080479f74b9d93b28e4bd7c01629aa70bcaacfd2778b6f65acd0e5ebcf6379e27:922c64590222798bb761d5b6d8e72950