LinuxQuestions.org
Visit Jeremy's Blog.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 12-04-2011, 11:32 PM   #1
dchester11
LQ Newbie
 
Registered: Feb 2010
Posts: 21

Rep: Reputation: 0
Logs showing any password changes


Hello -
I think that my root password was changed on my computer. I performed 'sudo passwd' before thinking too much about it frustrated thinking I wasn't typing correctly or something. But the more I think about the more suspicious I am becoming. Is there a log that would show any password changes or anything along those lines?

-Thankful Ubuntu user
 
Old 12-04-2011, 11:36 PM   #2
corp769
LQ Guru
 
Registered: Apr 2005
Location: /dev/null
Posts: 5,818

Rep: Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007
If you can't log in using your root password, you will have to boot into single user mode, and then change your root passwd. Now as far as having password changes logged, by default this does not happen. See here - http://stackoverflow.com/questions/4...anges-in-linux

Cheers,

Josh
 
Old 12-04-2011, 11:45 PM   #3
jschiwal
LQ Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 682Reputation: 682Reputation: 682Reputation: 682Reputation: 682Reputation: 682
Sudo commands are usually logged. If you may have changed the root password by mistake, and you used sudo (not su first), check /var/log/messages log file.

The date & time and user should be listed. For example:
Code:
Dec  3 21:22:48 elite sudo: jschiwal : TTY=pts/2 ; PWD=/home/jschiwal ; USER=root ; COMMAND=/usr/bin/tail -f /var/log/messages
To change the passwd back:
Another option, if you don't have a live distro CD, is to add "init=/bin/sh" to the kernel boot arguments. You will need to mount your root filesystem. One thing I have done, is to copy my regular users /etc/shadow entry to root, reboot, and then run "passwd" as root normally. Another is to chroot to your regular root partition, and run "passwd" as normal.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
su - abc showing password in text aggrishabh Linux - Newbie 4 03-29-2011 07:29 AM
Apache Logs - Not Showing Requested URL or User IP dereko Linux - Server 2 06-02-2010 07:23 AM
Logs for showing what IP's are hitting my box? dhg1848 Linux - Newbie 3 07-26-2009 11:51 PM
Emails rejected by Postfix is not showing in the logs andrewthk Linux - Networking 0 01-24-2006 12:48 AM
Apache Logs - Showing unusual domains mdavis Linux - Security 14 04-22-2004 10:05 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 04:08 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration