# manage the lastlog logging of pam
class loginrecords::lastlog::enable(
  $pam_login_file = '/etc/pam.d/login'
){
  file_line{ 'loginrecords-lastlog':
    path  => $pam_login_file,
    match => '^.*session[[:space:]]+optional[[:space:]]+pam_lastlog.so$',
    line  => 'session  optional   pam_lastlog.so',
  }
  file{ '/var/log/lastlog':
    ensure => present,
    owner  => root,
    group  => utmp,
    mode   => '0664';
  }
}