# Someone Change The Password **URL:** \ **Category:** Webmin\ **Created:** [February 17, 2025, 6:45am UTC](https://forum.virtualmin.com/t/someone-change-the-password/132166 "2025-02-17T06:45:11Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![eric.char](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/e/c37758/32.png) [@eric.char](https://forum.virtualmin.com/u/eric.char)\ **Post date:** [February 17, 2025, 6:45am UTC](https://forum.virtualmin.com/t/someone-change-the-password/132166/1 "2025-02-17T06:45:11Z")
Lately I noticed someone change my users’ password and even the root password. Try to trace from secure log file but never see from the log anyone change the password. Suspect it may change from Webmin. Is there anyway I can track the password change in Webmin? | SYSTEM INFORMATION | | | --- | --- | | OS type and version | CentOS Linux 5.8 | | Webmin version | 1.480 | ---
**Author:** ![calport](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/calport/32/44_2.png) [@calport](https://forum.virtualmin.com/u/calport)\ **Post date:** [February 17, 2025, 7:11am UTC](https://forum.virtualmin.com/t/someone-change-the-password/132166/2 "2025-02-17T07:11:52Z")
Ah, you are on CentOS 5.8? Did you not see the End of Life warning on the Webmin Dashboard? CentOS has been sunset in 2017. We are now in 2025. ---
**Author:** ![jimr1](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/jimr1/32/14173_2.png) [@jimr1](https://forum.virtualmin.com/u/jimr1)\ **Post date:** [February 17, 2025, 7:33am UTC](https://forum.virtualmin.com/t/someone-change-the-password/132166/3 "2025-02-17T07:33:57Z")
> [@calport](#): > > End of Life warning on the Webmin Dashboard? With such an old version of webmin I would guess not ---
**Author:** ![Joe](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/joe/32/9_2.png) [@Joe](https://forum.virtualmin.com/u/Joe)\ **Post date:** [February 17, 2025, 7:53am UTC](https://forum.virtualmin.com/t/someone-change-the-password/132166/4 "2025-02-17T07:53:19Z")
> [@eric.char](#): > > OS type and version CentOS Linux 5.8 > Webmin version 1.480 Buddy, your system is very likely welcoming anyone who wants to walk in. CentOS 5.8 reached end of life nearly a decade ago, there’s no way there isn’t some exploitable service running, probably several. Webmin 1.480 probably has security bugs, too. You can’t run outdated software on a network-facing server. ---
**Author:** ![eric.char](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/e/c37758/32.png) [@eric.char](https://forum.virtualmin.com/u/eric.char)\ **Post date:** [February 17, 2025, 8:37am UTC](https://forum.virtualmin.com/t/someone-change-the-password/132166/5 "2025-02-17T08:37:03Z")
Understood my version is obsoleted but I’m waiting for good timing to migrate or upgrade. While waiting, is there anyway I can check or trace how the password change action is executed? ---
**Author:** ![Stegan](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/stegan/32/6860_2.png) [@Stegan](https://forum.virtualmin.com/u/Stegan)\ **Post date:** [February 17, 2025, 8:49am UTC](https://forum.virtualmin.com/t/someone-change-the-password/132166/6 "2025-02-17T08:49:08Z")
> [@eric.char](#): > > and even the root password. Time to destroy that box. Once rooted it is of no use to you and probably a source of danger to others - start afresh with a new box and make a big note to self to keep up to date! there is no point in trying to chase down how this happened,or who did it, without the forensic kit of tools. 🔧 ---
**Author:** ![Joe](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/joe/32/9_2.png) [@Joe](https://forum.virtualmin.com/u/Joe)\ **Post date:** [February 17, 2025, 9:32am UTC](https://forum.virtualmin.com/t/someone-change-the-password/132166/7 "2025-02-17T09:32:18Z")
Webmin has an action log (`/var/webmin/webmin.log`, but also `miniserv.log` and `miniserv.error`), but if root is exploited, you can’t trust anything you read. root can delete or modify logs, any executable or config files, etc. A rooted system is gone, you can never trust it again, because the attacker can hide their tracks complete. ---
**Author:** ![stefan1959](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/s/49beb7/32.png) [@stefan1959](https://forum.virtualmin.com/u/stefan1959)\ **Post date:** [February 17, 2025, 11:07am UTC](https://forum.virtualmin.com/t/someone-change-the-password/132166/8 "2025-02-17T11:07:11Z")
> [@eric.char](#): > > Understood my version is obsoleted but I’m waiting for good timing to migrate or upgrade. # CentOS 5.8 Release Notes **Last updated:** March 28th, 2012 Its not april 1 is it? ---
**Author:** ![eric.char](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/e/c37758/32.png) [@eric.char](https://forum.virtualmin.com/u/eric.char)\ **Post date:** [February 19, 2025, 1:13am UTC](https://forum.virtualmin.com/t/someone-change-the-password/132166/9 "2025-02-19T01:13:16Z")
> [@eric.char](#): > > anyway I can check or t Thanks. I will investigate any suspicious from the log. At the same, I had also change the root password. I will plan to reinstall with new fresh latest version. ---
**Author:** ![system](https://cdn.forum.virtualmin.com/uploads/default/original/2X/c/cd96d761e326db4b2bef94886a639109bd7a8e76.svg) [@system](https://forum.virtualmin.com/u/system)\ **Post date:** [April 20, 2025, 1:14am UTC](https://forum.virtualmin.com/t/someone-change-the-password/132166/10 "2025-04-20T01:14:08Z")
Closed on April 20, 2025, 1:14am UTC This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.