PAM: Update lastlog when using su?

[pyllyukko]

CentOS has this in /etc/pam.d/postlogin-ac (which is included from /etc/pam.d/su):

session     [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet debug
session     [default=1]   pam_lastlog.so nowtmp showfailed
session     optional      pam_lastlog.so silent noupdate showfailed

So it will update lastlog (but not wtmp) when su is used.

SU(1):

NOTES
       For  security  reasons su always logs failed log-in attempts to the btmp file, but it does not write to the lastlog file at all.  This solution al‐
       lows to control su behavior by PAM configuration.  If you want to use the pam_lastlog module to print warning message about failed log-in  attempts
       then the pam_lastlog has to be configured to update the lastlog file as well. For example by:

              session  required  pam_lastlog.so nowtmp