Check root password changes done via single user mode

[Ricardo Martín]

Indeed, that would be a way of checking the password change, but I was
more interested in whether such a change could be flagged as being
carried out from single user mode.
Or in another words whether the root's passwords has been reset
accessing the machine during the boot process.

On 03/03/15 09:50, Daniel Peyrolon wrote:
> What I would do is storing a copy of root's password hash somewhere, and
> compare it with the recent one.
> The hash can be read at master.passwd (check passwd(5)).
>
> El mar., 3 de marzo de 2015 a las 9:02, Ricardo Martín (<
> fluxwatcher at gmail.com>) escribió:
>
>> hi all,
>>
>> wondering which would be the best approach to script check if the root
>> password has been changed via single user mode.
>>
>> tia
>>
>>
>>
>> _______________________________________________
>> freebsd-questions at freebsd.org mailing list
>> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
>> To unsubscribe, send any mail to "freebsd-questions-
>> unsubscribe at freebsd.org"
>>