How could someone change the root password without changing chage -l root Last password change date? I know it was changed because it does not match the value in Keepass. I noticed when I tried to use su from a non-root account. My private key still worked. I updated many packages too if that matters (I had to restart sshd because it was not letting me in). OS is CentOS 6.5, on AWS EC2.

  • I'm not sure about how this can be done but your machine might be compromised. – user42178 Jul 6 '14 at 10:59

Assuming your system is using regular simple unix authentication, there's at least one way of changing a password assuming you have root access.

You can do this by simply editing the /etc/shadow file and pasting in a new password hash in place of the old one. This does not influence "chage -l" output as the change is done outside tools, so no other data (modification date etc) is modified.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.