Duplicate "Last login" info printed

[Tomas Mraz]

On Po, 2014-11-17 at 10:59 -0700, Andrew Ruch wrote:
> Hello,
> 
> When I log into my RHEL 6.6 system, I have two "Last login" lines
> printed. I know one of them comes from the following line (which I
> added):
> 
> session  required  pam_lastlog.so  showfailed
> 
> Where does the other line come from? I searched /etc/pam.d/ and the
> lastlog module is not used anywhere else. Is it from one of the other
> PAM modules?

It is printed directly by the sshd or login. Use the 'silent' option
with the pam_lastlog.so so it will only print the login failures.

-- 
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
                                              Turkish proverb
(You'll never know whether the road is wrong though.)