LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Red Hat (http://www.linuxquestions.org/questions/red-hat-31/)
-   -   root password reset log (http://www.linuxquestions.org/questions/red-hat-31/root-password-reset-log-311907/)

cmsisb 04-11-2005 01:36 AM

root password reset log
 
Hi

Help Me plz. Someone changed my root password I want to check password resetting date and time.

Thanks,
Waheed

|2ainman 04-11-2005 03:08 AM

You probably can't check the logs w/o having root access :-/

cmsisb 04-11-2005 04:10 AM

Local Administrator is another person may be he reset the root password. I want to check the root password resetting date and time olz. tell me the log file which contains the information regarding this. May be he changed the root password in single user mode. Plz. tell me the log file and its location.
Thanks.

aqoliveira 04-11-2005 07:20 AM

howzit

if u have a login u may type this cmd and it will tell u when ure machine was rebooted and when / where the last root login was. Type at the console < last >

The place to check for logs would be /va/log/secure and /var/log /messages

cheers

cowboy_jake 04-14-2005 02:21 PM

The first thing I would do is check the date/time stamp on /etc/shadow to see when it was modified (as long as you haven't made any changes to it yourself).

Then use the "last" command to see if anybody logged in around that time

-Jake

Adickel 01-14-2013 04:49 PM

I had this problem
 
I was searching the nets and found this thread when looking for a resolution for this, one of our nodes had its password changed and it wasn't documented anywhere, luckily we were still able to ssh to it from another trusted node and i found who changed the password for it by running:

history | grep passwd

This gave the person away because they weren't supposed to be logged in as root but ran "passwd" alone and changed the password then they ran "passwd <their username>" and gave them selves away :D.

Just a useful tip for anyone who might be troubleshooting this ( this was for RHEL 5.5 btw)


All times are GMT -5. The time now is 06:42 PM.