who change password

[ostapvv]

Hello all.

How see, who changed password in hpux 11.31
Enabled trusted mode.

Thanks.

[Hakki Aydin Ucar]

it is not simple way to do it ; if you are superuser you can go to user directory you suspected and check the password command in its history files if you are lucky you can find some clue..

[Hakki Aydin Ucar]

Sorry, on second though, if you say about who changed the ROOT user password, then chance is less than I mentioned before.
Because everything will be written into root history file while changing a root user's password naturally. So you can just look at "su -" OR "su - root" in the history file if you have any suspected user, but not too much clue..

but if you had a HIDS software by chance it is easy to find it. it is good to use on who modified which file investigations..

[ostapvv]

Thanks.

cat /tcb/files/auth/users