VMware Cloud Community
Opt_1
Contributor
Contributor

ESXi ROOT password date

Hello

i'm looking for command to find when was root password changed/reset on ESXi 6.0 and 6.5

Thanks

Reply
0 Kudos
7 Replies
iiliev
VMware Employee
VMware Employee

Hi,

Try with chage command. Something like the following should work:

chage -l root

Reply
0 Kudos
Opt_1
Contributor
Contributor

Hi

thanks for quick reply

unfortunately did not work

here are output :

[root@hostname:~] chage -l root

-sh: chage: not found

[root@hostname:~]

Reply
0 Kudos
iiliev
VMware Employee
VMware Employee

My mistake, for some reason I thought chage is available.

In that case, another option is to get the information from /etc/shadow file. Try the following command:

cat /etc/shadow | grep root | awk -F":" '{print$3}'

Note the above will not print directly the calendar date when the password last changed. Instead, it will print a single number, which is the number of days since January 1st, 1970 up to the day when the password was last changed. There should be some shell scripts/commands available to convert this number to a more human-readable form.

Reply
0 Kudos
a_p_
Leadership
Leadership

Maybe s.th. like this will do:

myDays=$(cat /etc/shadow | grep root | awk -F ":" '{print $3}')

date -d "1970-01-01 +$(($myDays * 24))"

André

Reply
0 Kudos
pragg12
Hot Shot
Hot Shot

myDays=$(cat /etc/shadow | grep root | awk -F ":" '{print $3}')

date -d "1970-01-01 +$(($myDays * 24))"

Just tested this on 2 ESXi 6.5 U2 hosts.

On 1st host, it returned below information.

Fri Nov  9 00:00:00 UTC 2018

On 2nd host, it returned below error. First command on this host gave output as 16864.

-sh: arithmetic syntax error

Adding 16864 days to 01-01-1970 gives 04-03-2016 (DD-MM-YYYY). It seems the current command cannot display information correctly for root password change date if its quite old.

Consider marking this response as "Correct" or "Helpful" if you think my response helped you in any way.
Reply
0 Kudos
a_p_
Leadership
Leadership

... First command on this host gave output as 16864.

The command shouldn't output anything, but only fill the variable.

Please check the command syntax, and that $myDays contains the expected value after running the first line.

André

Reply
0 Kudos
pragg12
Hot Shot
Hot Shot

Hi,

By first command, I meant the first command shared in this thread.

cat /etc/shadow | grep root | awk -F":" '{print$3}'

I have run the command shared by you exactly as it is and got varying result as shared previously.

Consider marking this response as "Correct" or "Helpful" if you think my response helped you in any way.
Reply
0 Kudos