May I know who has changed the password?

[lin.chen]

is there any log in HPUX to record who has changed the password?
thanks!

[Patrick Wallek · Accepted solution]

Which password? root? Someone else's?

Such a log really doesn't exist. You *MIGHT* be able to find something in a users shell history file, but that would be pure luck and it would be difficult to know exactly WHEN they issues the passwd command.

[Vasu Viswanadha]

Hi,

You may try 'last' command to see the logged on users at that time and match it with time stamp of '/etc/passwd' file. If only one user's password is chaanged then you are lucky. If more than one user has changed his / her password, it won't be that easy to trace out.

Finally, if shell history is enabled, you can find out who chaged the password from ~/.sh_history

BR
Vasu