about password

[wangxi]

hi expert,
I want to know who change a user's password,what can i do.
Is there any log to record the history of changing passeword.

[Peter Kloetgen]

Hi Wangxi,

only on trusted systems you can activate logging a password history. You can get your system to a trusted system simply using SAM. Then security, and perform the trusted system. After that you can configure a password history.

Allways stay on the bright side of life!

Peter

[Marcin Wicinski]

Hi,
User password can be changed only by the user or root. Only on trusted system you have ability to log password changes. Conversion to trusted:
# /usr/lbin/tsconvert

trusted admionistration by SAM.

Later,

[Ceesjan van Hattum]

History of commands can be found in .sh_history of each $HOME. You can grep on string "passwd".

A small help:
for FILE in `awk 'BEGIN{FS=":"}{printf $6; print "/.sh_history"}' /etc/passwd`
do
grep passwd $FILE
done

Regards,
Ceesjan

[wangxi]

hi expert,
could you explain what's different between trusted system and un-trusted system for me, thank you very much

[Michael Tully]

Hi,

This posting should explain. It also has some very good links to further information should this remain unclear to you.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x12bf3a7b3682d611abdb0090277a778c,00.html

~Michael~

[Patrick Wallek]

There are 3 different ways a users password can be changed that I can think of:

1) The user him / her self can change it (obviously). This could be logged in the users shell history file if it is enabled.

2) root can change anyones passwd. This could be logged in roots shell history, if enabled.

3) If you have set up a "restricted SAM" for help desk users, and included in that the ability to change / reset users passwords. I do not know if this would be logged anywhere or not. You could potentially have a look at SAMs log file.