Security

[Rajesh.K]

How to check whether the root password has been changed by whom and when??

Regards,
K.Rajesh

[Sanjay Kumar Suri]

Only root can change its passwd. Check who has used su command in the syslog.

sks

[Michael Tully]

Other than checking the /var/adm/syslog/syslog.log and of course /var/adm/sulog you could find out when only if your system is trusted.

# /usr/lbin/getprpw -m spwchg root

[Vijaya Kumar_3]

also, check whether you have sudo installed...

If so, check sudo logs too



PS: Are you Rajesh Krishnan from chennai?

[Rajesh.K]

Yes vijay i am Rajesh.

Where r u ? Give me the contact details.

[Vijaya Kumar_3]

well! Not in this forum. I will mail you later...

Did you find the root password change from any of the logs mentioned above?

[Rajesh.K]

Apart from sudo log where i can find and how?

[Vijaya Kumar_3]

Well, pls refer this link

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=151113

Vijay