I have an RHEL 5.7 installation in the lab and someone changed the root password (either by linux single or some other mode). I would like to identify how was it done and basically be able to identify the timelines as to how was this done.
Use chage command. It shows exact date of last password change.
What might be useful:
If no other passwords have been changed since, the modification time of /etc/shadow would also indicate the time of the password change...
As for the method, on the box that I looked at, PAM logged the password changes in /var/log/secure, at least if
In general, you might want to ensure that only trusted parties have physical access to the system, that a GRUB password is configured and that as much logging as possible is set up.