When the pam_lastlog is listed in the "session" of /etc/pam.d/system-login which is used by SSH, I get two different messages on ssh login and duplicate entries in the output of the `last` command: jkt@pc134c ~ $ ssh batsheba.farm.particle.cz Last login: Mon Dec 8 14:53:02 CET 2008 from pc134c.fzu.cz on pts/1 Last login: Mon Dec 8 14:55:45 2008 from pc134c.fzu.cz batsheba ~ # last root pts/1 pc134c.fzu.cz Mon Dec 8 14:55 still logged in root ssh pc134c.fzu.cz Mon Dec 8 14:55 still logged in root pts/1 pc134c.fzu.cz Mon Dec 8 14:53 - 14:55 (00:02) root ssh pc134c.fzu.cz Mon Dec 8 14:53 - 14:55 (00:02) This wasn't the case back when /etc/pam.d/ssh was directly including system-auth (ie. before the system-remote-login was introduced).
*** This bug has been marked as a duplicate of bug 244816 ***