alphagov/puppet-harden — pull request #1 by dcarley (2013-06-19 17:29:36+00:00)
Title: [#51906587] Manage /var/log/wtmp

Ensure that `/var/log/wtmp` always exists and has the correct file
permissions. Don't manage it's contents.

If this file is deleted, as we've seen with some VM templates, then it won't
be recreated and logins will not be recorded. Subsequently last(1) will
complain as such:

~# last
last: /var/log/wtmp: No such file or directory
Perhaps this file was removed by the operator to prevent logging last info.

NB: This is complimentary to syslog's normal auth/authpriv log.