Hello,

this is probably a change that we inherited from Debian. I don't think we ever installed it specifically, it was probably installed because it was a dependency of something else, and this dependency was dropped.

Can you clarify the use-case, why do you need lastlog, is it required by some tool or something? Thanks in advance.

Did a bit more research, it's not really straightforward, as the login binary package (which provides the lastlog command) was moved out of src:shadow and into src:util-linux...

So Kali 2024.3 comes with the source package shadow 1:4.15.3-2, meaning that the binary package login 1:4.15.3-2 is pre-installed in Kali. However, this package does NOT provide bin/lastlog, as the command was removed in version 1:4.13, cf. https://salsa.debian.org/debian/shadow/-/commit/3d71c62ab1ee6feab966088daf5acf9066d62098

So, in Kali 2024.3, bin/lastlog is indeed not available (not even in the repo), but you can instead install the package lastlog2 that provides bin/lastlog2. Does that work for you?

NOTE: by default, Kali Linux come preconfigured to use the kali-rolling, meaning that apt will install from kali-rolling, hence upgrading your system. If you don't want that, edit your sources.list to use kali-last-snapshot instead of kali-rolling. Then apt update && apt install lastlog2.

EXTRA NOTE: util-linux 2.40.2-3 and more recent versions now provide the login package, cf. https://salsa.debian.org/debian/util-linux/-/commit/61804946e1b897149ae091884700a023ae451d1d. But there is no bin/lastlog in this package.

No worries. Lastlog is used in some Incident Response stuff since it provides a simplified view of when users have last logged into the system. Lastlog2 is supposed to replace lastlog, but I was surprised to see it int the util-linux package but no pam module or symlink and nothing in any release notes about the change. I can manually install and do this going forward - just wanted to raise the issue if lastlog2 was supposed to be on the images now :)

Thanks for reviewing!

Thanks for the feedback!

Lastlog is used in some Incident Response stuff

Can you tell me which tools exactly? If it's tools we package in Kali, I need to add a dependency on lastlog2 to be sure it's installed.

Also, does those tools work out of the box with lastlog2? I see that the package lastlog2 "Recommends: libpam-lastlog2", so the PAM stuff should be installed after you install the lastlog2 package.

I'm also surprised that there's no compat symlink lastlog -> lastlog2, but I didn't see any bug reports in this regard on the Debian bug tracker, so I suppose it's intended. However if tools look for bin/lastlog only, then we'll need to patch it to support lastlog2.