I'm not aware of any such log, and it there was one, it would probably say that "root" modified the root password. Not much help there.
The 3 ways I've seen this occur:
1). A Sys Admin intended to change the password for a different user, but accidentally changed root's password, and didn't notice.
2). The system has been hacked from external source (check /usr/adm/syslog for lots of "sshd" connection attempts).
3). The root login is used so seldom that nobody remembers the password.
"Proof that there is intelligent life in Oregon. Well, Life anyway.
I am working on our VM server running SCO 7.1.1. I need to find the dir - that passwd is located in. I know where it is at on our older 4.x server but this is the first time I have had to edit the passwd file on our newer VM box.
This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.