Solaris

hi,
i am try to find the log if some one change the password for any account.
plz help me to find this log.


thanks.

---------- Post updated 05-04-10 at 12:50 AM ---------- Previous update was 05-03-10 at 01:43 AM ----------

what i am looking for is the log message from the system for change the password with time, if it's a feature or need something to be active please let me know ...

thanks,
Mahm.

I think, the only chance to do this is using Solaris auditing.

See: Solaris Auditing (System Administration Guide: Security Services) - Sun Microsystems

Alternatively, if the passwords are stored on a LDAP server, password changes should be logged there.

Jlliagre:
so if i am not using LDAP i can't find the logs?!

hergp:
still i am reading this documents... if i got the solution i'll post it here ...

many thanks

You cannot deduce that from what I wrote.
If you are using LDAP, there will be logs (unless they have been disabled).
If you aren't using ldap, there won't be logs unless you set up something to have some. What precisely are you looking for ? Last password change day is recorded in /etc/shadow.

Are you looking for a log of users who change their own passwords or are you trying to determine if someone changed a password that was not theirs? If the latter, you may have a log entry for the use of elevated privileges. It just depends on how your system is configured. This is especially true if you use SU or SUDO to gain elevated privileges.

what i need is very simple:
if i change the root password, should there is a log e.g. root password is changed @ 22:11:34 by root user.
if the root reset any other user passwords like oracle user, e.g. oracle password is changed @ 22:11:34 by root.

so this kind of logs are available or not? if i have to enable or configure any thing please help me..

Jlliagre:
we have an applince called "PAR" e-DMZ Security ? Password Auto Repository (PAR) this applince is managing solaris users, for some reason some of the users complains we are not able to login and the password changed just i need to know why the password reset happend for them so i need to identify the user coz this applince has 1 user equvelent to root called padmin. just i need to know which user is rests the password for specifide users.
i can't got it from /etc/shadow because the applince keep changeing the password for each account request.

thanks.