On Wednesday 13 March 2002 11:23, NP, Ram (CORP, GEITC) wrote: > root password is changed without prior notice. Now could some one tell > me if there is a way to find out when(time) was the Root passwd changed. > I understand one way would be using Tripwire. since we didnt have > tripwire earlier on the machine is there a way to recover the time.
You could check the timestamp of /etc/passwd or /etc/shadow, for it changes everytime the file is modified. This, however, won't work if there are other users on the machine and they change their passwords from time to time... -- Radoslav Dejanovic Senior Associate to Mayor's Office City of Zagreb, Croatia
