cancel
Showing results for 
Search instead for 
Did you mean: 

who change password

ostapvv
Trusted Contributor

who change password

Hello all.

How see, who changed password in hpux 11.31
Enabled trusted mode.

Thanks.
3 REPLIES
Hakki Aydin Ucar
Honored Contributor

Re: who change password

it is not simple way to do it ; if you are superuser you can go to user directory you suspected and check the password command in its history files if you are lucky you can find some clue..
Hakki Aydin Ucar
Honored Contributor

Re: who change password

Sorry, on second though, if you say about who changed the ROOT user password, then chance is less than I mentioned before.
Because everything will be written into root history file while changing a root user's password naturally. So you can just look at "su -" OR "su - root" in the history file if you have any suspected user, but not too much clue..

but if you had a HIDS software by chance it is easy to find it. it is good to use on who modified which file investigations..
ostapvv
Trusted Contributor

Re: who change password

Thanks.

cat /tcb/files/auth/users