Hello
i'm looking for command to find when was root password changed/reset on ESXi 6.0 and 6.5
Thanks
Hi,
Try with chage command. Something like the following should work:
chage -l root
Hi
thanks for quick reply
unfortunately did not work
here are output :
[root@hostname:~] chage -l root
-sh: chage: not found
[root@hostname:~]
My mistake, for some reason I thought chage is available.
In that case, another option is to get the information from /etc/shadow file. Try the following command:
cat /etc/shadow | grep root | awk -F":" '{print$3}'
Note the above will not print directly the calendar date when the password last changed. Instead, it will print a single number, which is the number of days since January 1st, 1970 up to the day when the password was last changed. There should be some shell scripts/commands available to convert this number to a more human-readable form.
Maybe s.th. like this will do:
myDays=$(cat /etc/shadow | grep root | awk -F ":" '{print $3}')
date -d "1970-01-01 +$(($myDays * 24))"
André
myDays=$(cat /etc/shadow | grep root | awk -F ":" '{print $3}')
date -d "1970-01-01 +$(($myDays * 24))"
Just tested this on 2 ESXi 6.5 U2 hosts.
On 1st host, it returned below information.
Fri Nov 9 00:00:00 UTC 2018
On 2nd host, it returned below error. First command on this host gave output as 16864.
-sh: arithmetic syntax error
Adding 16864 days to 01-01-1970 gives 04-03-2016 (DD-MM-YYYY). It seems the current command cannot display information correctly for root password change date if its quite old.
... First command on this host gave output as 16864.
The command shouldn't output anything, but only fill the variable.
Please check the command syntax, and that $myDays contains the expected value after running the first line.
André
Hi,
By first command, I meant the first command shared in this thread.
cat /etc/shadow | grep root | awk -F":" '{print$3}'
I have run the command shared by you exactly as it is and got varying result as shared previously.