topic Re: Security in Operating System - HP-UX

Security

Rajesh.K — Thu, 15 Apr 2004 00:09:14 GMT

How to check whether the root password has been changed by whom and when??

Regards,
K.Rajesh

Re: Security

Sanjay Kumar Suri — Thu, 15 Apr 2004 00:37:33 GMT

Only root can change its passwd. Check who has used su command in the syslog.

sks

Re: Security

Michael Tully — Thu, 15 Apr 2004 00:47:49 GMT

Other than checking the /var/adm/syslog/syslog.log and of course /var/adm/sulog you could find out when only if your system is trusted.

# /usr/lbin/getprpw -m spwchg root

Re: Security

Vijaya Kumar_3 — Thu, 15 Apr 2004 00:59:40 GMT

also, check whether you have sudo installed...

If so, check sudo logs too

PS: Are you Rajesh Krishnan from chennai?

Re: Security

Rajesh.K — Thu, 15 Apr 2004 01:05:10 GMT

Yes vijay i am Rajesh.

Where r u ? Give me the contact details.

Re: Security

Vijaya Kumar_3 — Thu, 15 Apr 2004 01:10:14 GMT

well! Not in this forum. I will mail you later...

Did you find the root password change from any of the logs mentioned above?

Re: Security

Rajesh.K — Thu, 15 Apr 2004 01:12:04 GMT

Apart from sudo log where i can find and how?

Re: Security

Vijaya Kumar_3 — Thu, 15 Apr 2004 01:43:01 GMT

Well, pls refer this link

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=151113

Vijay