is there a log for a root password change

[Scott_20]

when the root password is changed, is it logged specifically anywhere? would sudo log it? please advise. I want to configure our monitoring software to flag for it
thanks,
scott

[Pete Randall]

No.


Pete

[Jeff Schussele · Accepted solution]

Hi Scott,

IF the passwd change is accomplished via a sudo command, the sudo log would hold the command of course, but not the value.
But the standard passwd command does not log anywhere AFAIK.

You might consider monitoring root's .sh_history file, but that could be problematic as you'd need to insure it only flags on a passwd command for the root account *only*.

Rgds,
Jeff

[Fabio Ettore]

Hi,

interesting question but as far as I know there isn't a log file for that on HP-UX.

Best regards,
Ettore

[doug mielke]

Monitoring date on /etc/passwd would work in our shop, but only beacuse almost all of our users log into applications, not Unix.

[Camel_1]

If your system has audit turned on and keep tracking the root user/passwd event perhaps you can find out when was the password changed?

Simon

[Pete Randall]

Well, how about "No, sir - sorry", then?


Pete

[MarkSyder]

Hi Scott,

I'm araid I don't know the answer to your question - I looked at this thread in case I could learn something. But your idea of the points system differs from mine, so maybe it would be a good idea to clarify who is right.

My understanding is that if someone tries to help you, you should give them points even if their answer is not what you wanted to read. This means that Pete's original answer was worthy of points. By giving him 0 points you appear to have suggested that he did not even try to help you. His second posting suggests that he took offence - I suspect that giving him 1 point will add to his offence, rather than take away from it!

Pete has helped me in the past. He is knowledgable and helpful and not the sort of person you want to offend - he may not bother to reply next time you ask a question, and you would be the loser, not Pete.

Anyone else got any opinions on whose interpretation of the points system is correct? I would particularly like the opinion of a moderator.

Mark Syder (like the drink but spelt different)

[Steven E. Protter]

The answer is no for obvoius security reasons.

The passwd command is logged in the .sh_history or logfile if that is set.

If you logged the password change it could provide a hacker with something He or she couldl use to compare to the encrypted password and start taking guesses at the root password.

This is an activity that must have no record.

The /etc/passwd file does contain information on when the password expires(for most users) and when the password was last changed.

SEP

[Pete Randall]

Scott/Mark,

Though I think the zero was a bit extreme, I have absolutely no problem with Scott assigning it.

The answer, while technically correct, offered no explanation as to how or why (I was busy and just threw out a quick response). My second response was strictly in jest and I should have put my typical, "I'm kidding" smiley face after it to indicate so but I forgot.

I've helped Scott before and been rewarded for my efforts. I appreciate Mark's point equity efforts but, from my viewpoint, they weren't really necessary.


Pete Randall (like the door knob, only spelled with an "r" instead of an "h" and the last three letters are different but sound the same . . . . . Oh, nevermind!) ;^)

[Cheryl Griffin]

>>Anyone else got any opinions on whose interpretation of the points system is correct? I would particularly like the opinion of a moderator.>>

Mark - How about my opinion? The point system is to mark replies that have value. Pete not only provided the correct response but did so within 5 seconds of the original post. That is value.

Cheryl

[Jdamian]

Steven. I don't agree.

You can change the permission of that file to prevent users to read that info.

But sometimes superuser may need to know when a user changed its password.

[RAC_1]

If system is in trusted mode, checking the change time of root file should give what you want.

Run a script in the background that checks for change to file /tcb/auth/files/root. And this cript logs it the location you want.

[David Hausman]

With Trusted Syetem the passwd change date/time is available by issuing the getprpw command. You will find something like this in the command output;

spwchg=Tue Dec 23 11:38:46 2003