root passwd expired

[williey]

how can i find out if the root account is set the expired if the /etc/shadow had been updated so root no longer expires.

are there logs I can check?

------------------------------------------
There are 10 kinds of people in this world. One that understands binary and the other one that does not.

 

[Mike042]

Sadly there are 'typos' or words missing from your post that would so change the meaning of your enquiry that it is almost impossible to give you a precise answer to what you are asking.

To find out if an account is expired, check the file /etc/shadow and use the command man shadow.
Also see the logins command (and man logins).

Unless some auditing packages are running it is unlikely you can find out who, how and when the /etc/shadow file was changed. But if there have been regular backups of the system over time, then restores may give you a clue and also provide an earlier version of the file (prior to any changes ocurring).

I hope that helps.

Mike

 

[williey]

opps! the hand is slow than the brain.

ok. what happens was that the root password expired. someone reset the password and disable the expiration option.

Since the /etc/shadow file had been updated, how can I find out what was the original expiration option set to? As far as I know we never reset the password before.

------------------------------------------
There are 10 kinds of people in this world. One that understands binary and the other one that does not.

 

[elgrandeperro]

Do you have a backup of /etc/shadow? (or are there copies in /etc/shadow*?) Without these, I don't think the expiration setting is recorded any where else.

 

[williey]

yes, I'm requesting a restore from backup now. I was hoping I do not have to use that option. Thanks!

------------------------------------------
There are 10 kinds of people in this world. One that understands binary and the other one that does not.