How to find out which IP changed the root password

[Neutrall]

Hi,

I'm currently trying find out which IP change the root password in a cPanel server.

I'm trying to browse in the /usr/local/cpanel/logs/access_log file without success.

Is there a quick method for finding which IP change the root password?

 

[Neutrall]

Update,


I've found that in the file /var/log/secure I can see password changed my from ssh command, but I can't see the root password changed made from inside cPanel. (Which is what I need to find out...)

 

[SysSachin]

Hello,

Please try to find logs in the /var/log/secure file.

You can use the command

grep passwd /var/log/secure

Also, check in the cpanel access logs using bellow command.

grep chrootpass /usr/local/cpanel/logs/access_log |grep POST

 

[Neutrall]

Thank you,

I was missing the keyword "chrootpass" to make my life easier!

 

[cPanelMichael]

Hello,

I'm happy to see the previous response was helpful. Thank you for updating us with the outcome.