root password reset log

cmsisb · 04-11-2005, 01:36 AM

Hi

Help Me plz. Someone changed my root password I want to check password resetting date and time.

Thanks,
Waheed

|2ainman · 04-11-2005, 03:08 AM

You probably can't check the logs w/o having root access :-/

cmsisb · 04-11-2005, 04:10 AM

Local Administrator is another person may be he reset the root password. I want to check the root password resetting date and time olz. tell me the log file which contains the information regarding this. May be he changed the root password in single user mode. Plz. tell me the log file and its location.
Thanks.

aqoliveira · 04-11-2005, 07:20 AM

howzit

if u have a login u may type this cmd and it will tell u when ure machine was rebooted and when / where the last root login was. Type at the console < last >

The place to check for logs would be /va/log/secure and /var/log /messages

cheers

cowboy_jake · 04-14-2005, 02:21 PM

The first thing I would do is check the date/time stamp on /etc/shadow to see when it was modified (as long as you haven't made any changes to it yourself).

Then use the "last" command to see if anybody logged in around that time

-Jake