Logs showing any password changes
 

Hello -
I think that my root password was changed on my computer. I performed 'sudo passwd' before thinking too much about it frustrated thinking I wasn't typing correctly or something. But the more I think about the more suspicious I am becoming. Is there a log that would show any password changes or anything along those lines?

-Thankful Ubuntu user

If you can't log in using your root password, you will have to boot into single user mode, and then change your root passwd. Now as far as having password changes logged, by default this does not happen. See here - http://stackoverflow.com/questions/4...anges-in-linux

Cheers,

Josh

Sudo commands are usually logged. If you may have changed the root password by mistake, and you used sudo (not su first), check /var/log/messages log file.

The date & time and user should be listed. For example:
To change the passwd back:
Another option, if you don't have a live distro CD, is to add "init=/bin/sh" to the kernel boot arguments. You will need to mount your root filesystem. One thing I have done, is to copy my regular users /etc/shadow entry to root, reboot, and then run "passwd" as root normally. Another is to chroot to your regular root partition, and run "passwd" as normal.