How to find the log for changing password?

[Kenny Chau]

Hi all,

I want to know where and how to find any files that contain the changing password or any commands can do the same so that I can know which account has changed its password in the past.

Thanks very much.

[FireDragon.Xu]

Hi,Chao

I am come from ShenZhen China.

You can export the HISTFILE variable,monitoring user activities.

Jackie Xu.

????????????????????????????????????????????????????????????.???????????????????????????

[Krzysztof Kielak]

Hi,

if You have global profile for each user, that sets history file in local directory you can grep all those files for passwd command.

for example:
if all your user's account are located in /home, and your history file is named .sw_history in user's home directory, You can issue the command:

find /home -name .sw_history -exec grep passwd {} \;

rgds
Chris

[Roger Baptiste]

hi,

Look at the /var/adm/syslog/syslog.log file
for details of password changes.
Since the file is normally huge for a busy
system, you can simply grep for what you want.
#grep /var/adm/syslog/syslog.log

-raj

[harry d brown jr]

You need to make your system "trusted", otherwise there's no way to determine when a user changed their password last. You can make it trusted from "sam".

live free or die
harry

[Bernie Vande Griend]

I'm assuming you are using local passwords, not NIS or NIS+.
If the system is not runinng as Trusted, it would be difficult. User history may help but it wouldn't tell you exactly when the change occurred. Also if the password was changed from root or another ID history wouldn't help a whole lot unless you looked at everyone's. The changed password is in /etc/passwd but without password aging enable there would be no fields here or elsewhere to see it was changed. I don't believe password changes are logged in /var/adm/syslog.log either, at least they aren't be default.

[David Lodge]

Try the following scriptlet:
(run as root - iff you are running on a trusted system)

for i in $(cut -f 1 -d : do
print "${i}:$(/usr/lbin/getprpw -m slogint ${i} | cut -f 2 -d =)"
done

dave