How to check security logs

[gb karki]

Hi,

Some body has changed passwd policy from /etc/default/security with out enable the shadow file. How to check who has changed this.

Regards
Karki

[Steven E. Protter]

Shalom,

First check permissions on the file.

I think you will find that only root can change /etc/default/security

So someone either directly logged on as root, which you can see in /var/adm/syslog/syslog.log

Or someone did an su to root which shows up in the same file.

You can check the time stamp on the security file and match it up with su entries and such.

I would immediately change the root password and check the systems for back doors that elevate normal users to root access.

SEP

[gb karki]

I checked in /var/adm/syslog/syslog.log but i'm not getting any messages.

Regards
Karki

[B. Hulst]

1. Check the timestamp of the file. When was it edited / saved?

2. Check with the command: last
who was logged in around that time of saving/ editing of the timestamp of step 1.

Ordinary users cannot edit this file but root or 'related to a root group' users can get more privileges to edit this file.

From the last command output you find the hostname or ip address where that root user came from. :-)

[Kapil Jha]

DO u have any logging software like power broker,sudo....check for wtmp file but as said above normally only root can change the file , so you have to find out what time root logged into server or other users at the same time who can potntionally do a su.....do u have sudo defined.
Sysylog.log would not give u much information may be except if root passwd was wrongly entered.


BR
Kapil+