"NP, Ram (CORP, GEITC)" wrote:
>
> Now could some one tell me if
> there is a way to find out when(time) was the Root passwd changed. I
> understand one way would be using Tripwire. since we didnt have tripwire
> earlier on the machine is there a way to recover the time.
Hi,
This information is stored in /etc/shadow.
The third field is the no of days since 1970 that the password was last
changed. e.g. -
bash-2.05# cat /etc/shadow | grep ^root
root:encrypted-honest:11760::::::
^^^^^
You can use the logins command to extract this information, e.g. -
bash-2.05# logins -x -l root
root 0 other 1 Super-User
/
/sbin/sh
PS 031402 -1 -1 -1
^^^^^^
So, I last changed my root password today.
Of course it's quite trivial to change this information, however if this
is a trusted system (if there's such a thing), it may be accurate
enough.
Cheers,
Mike.
