Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an RHEL 5.7 installation in the lab and someone changed the root password (either by linux single or some other mode). I would like to identify how was it done and basically be able to identify the timelines as to how was this done.

share|improve this question
Generally speaking if they have physical access to the machine you're out of luck, and since they had root they can erase any record of their access. There are some physical security and encryption controls that you can use to reduce the risk of physical access. Look at the CIS RHEL5 Benchmark and the NSA guide for securing RHEL for information on physical security controls. – Jodie C Nov 29 '12 at 12:26

Use chage command. It shows exact date of last password change. Try chage -l root or chage -l username.

share|improve this answer
Thanks Venkat. However it does not give me time as well method of change. – shoonya Nov 29 '12 at 8:01

What might be useful: last and blast to see all the logins / reboots on the system.

If no other passwords have been changed since, the modification time of /etc/shadow would also indicate the time of the password change...

As for the method, on the box that I looked at, PAM logged the password changes in /var/log/secure, at least if passwd was used... If that doesn't show anything, try looking through the shell command history. If a user edited a password say booting from a Live CD and manually editing /etc/shadow, touching it back to the previous modification time, it would be harder...

In general, you might want to ensure that only trusted parties have physical access to the system, that a GRUB password is configured and that as much logging as possible is set up.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.