5

does linux store such info about date/hour/minute/second when give user password was changed last time? If so, with which command can view it?

"chage -l user" shows only the day when the password was changed.

kind regards,

4
  • Which linux? Often there's a sudo/auth log, anything in there? – Xen2050 Oct 4 '17 at 10:28
  • Debian 8.x, Redhat 7.x, but I would not like to rely on logs which change very often, and also grabbed by remote loganalyzer tools for safety... – Chris Oct 4 '17 at 12:30
  • The right log file should have a line saying when user X ran passwd (or similar), I'm sure there's a way to log all sudo commands - Ubuntu usually does it by default, any Debian-based should be able to, Redhat must be similar, apparently "an I/O logging plugin" is required, but I don't know exactly how to set that up, so just commenting. Other lines & changes to the logfile wouldn't matter – Xen2050 Oct 4 '17 at 12:43
  • All what I wanted to achieve is to be able compare password change date of a user on two different systems, to ensure which one is the newest one. Because chage -l shows only day, I don't know hour/minute/seconds when the password was changes on each system that day (if the day of the change was the same but at different time). For example, on AIX it is possible to see exact time of the password change in EPOCH time format. – Chris Oct 5 '17 at 14:30
2

Should be an entry in a log saying when passwd was run & by whom, similar to:

Mar 31 12:41:41 UBUNTU sudo: daniel : TTY=pts/1 ; PWD=/dev ; USER=root ; COMMAND=/usr/bin/passwd root
Mar 31 12:41:52 UBUNTU passwd[25160]: (pam_unix) password changed for root
Mar 31 12:41:52 UBUNTU passwd[25160]: (pam_unix) Password for root was changed

The log file varies depending on the distro, should be somewhere in /var/log though, so something like this should search them all (except maybe old gz'd files, try zgrep?):

grep -R -i passwd /var/log/*

Probably in /var/log/auth.log on Debian, or /var/log/secure on Redhat

But if this user can run any commands, they could edit logs too... so watch for unlimited sudo access.

More info:

2
  • does anyone the date returned by chage comes from? # chage -l auser|head -1 Last password change : Nov 04, 2016 or this is fake date meaning nothing? I noticed even for a new user created with no password (disabled account) it shows this date of "last password change"... – Chris Oct 5 '17 at 14:25
  • Unix was different from Windows when doing things. The user has disabled and does not have password, so the null password was considered as a password when the user was created...... even if you cant login with this user. – Luciano Andress Martini Jun 14 '18 at 19:43
2

Recent password changes can be seen via -S

# passwd USERNAME -S 
USERNAME PS 2020-11-27 0 99999 7 -1 (SHA512.)
1
  • Note that the date might not be as obvious as YYYY-MM-DD: on my Mint laptop, it was MM/DD/YYYY, which confused me because that's not the normal order for the UK. I initially thought it was DD/MM/YYYY but checking the log of KeePass showed me otherwise. I've just changed it today (8 March) and the status is now richard P 03/08/2021 0 99999 7 -1, which confirms my conclusion. – IpsRich Mar 8 at 8:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.