11/24   Linux question:
                One of our linux servers at work allows anyone to type "su" to
                become root.  Someone did this and changed the root password
                from it's default state of not having a password to having
                a password.  To make a long story short, someone else was
                still logged in as root and erased the entry in the
                /etc/shadow file, so we no longer have the problem.  However,
                how do you determine which user/IP address the change
                originated from?  Keep in mind that the time stamp was changed
                once we fixed the /etc/shadow file, so we can't use the
                original time stamp to help track anyone down.
                \_ I don't suppose you have a sulog, or even /var/log/messages
                  syslog messages reporting successes/failures of su commands?
                \_ of course a good hacker who knows what they're doing will
                   have erased all trace of themselves, and installed
                   something fun like the RootKit, assuring future backdoor
                   access to them and their buddies.
                        \_ you don't need to be a particularly good hacker
                           to break into a linux machine with a blank root
                           password.  Christ, set a password and get on
                           with your life.  -tom
                \_ No root password?  You are fucking stupid and deserve
                   what you get.  SET A FUCKING PASSWORD!  Use sudo if you
                   must.  You're running your unix box like a win95 machine.
                   Even if you do find logs, you can't believe what they say.
                   A malicious person wouldn't have erased all traces but
                   changed the logs to point to _someone else_.  Go hire a
                   real SA and stop letting engineers play root.  It isn't
                   a game.
                \_ Well, thank you for missing the point and responding with
                all the lunacy of a religious zealot.  For god's sake, we're
                behind a firewall, and even if we had a root password, it
                would be told to most everyone anyway.  The linux box is used
                as a test server.  It's ok that it's running "like a win95
                   \_ Something you failed to mention.
                machine".  And it wasn't a goddamn hacker, ok?  What kind of
                                \_ No one said it was.  They said you're
                                   stupid.
                idiot would hack his way behind the firewall, figure out
                        \_ A malicious employee who already works on that
                           side of the firewall.
                someones' login/password, go to superuser, hack at the system,
                cover his tracks, and then change the root password so we
                would become immediately suspicious?
                THINK, IDIOTS, THINK!  The simple, original question, was:
                Can you tell who logged in, then typed su, and then ran
                passwd.  var/log/messages says root did it, and gives a number
                that I'm guessing is the PID.  Can you then tie the PID to
                a user or IP?  Thank you and I apologize for being cranky,
                but it is COMPLETELY unproductive to yell about passwords,
                etc, it doesn't answer the question.  Would you respond to
                "if johnny has $150, and wants to buy a $200 raiders jacket,
                does he have enough money?" with "THE RAIDERS SUCK! JOHNNY'S
                A LOSER!  ARGGGH!"  no, you wouldn't.  Good lord, this is basic
                life skills 101 people.  Oh, also, there's no "sulog". Thanks.