Mysterious goings on - can passwords just change?

Am I just being paranoid?

[bhonda]

So, to cut a long story short, one of our system passwords changed this morning.

It's for a user account that's existed for years, and has never had a problem. All of a sudden, the password is changed and everything that relies on it fails.

I've asked around the team, and nobody is admitting responsibility, or even any knowledge of it. I've checked all the logs of everything I could find, and there's no record of the password change, but I can find when it was when access was first denied.

The problem was fixed really quickly, and all is well again, but I'm no closer to finding out what happened, and I don't know what I can do to prevent it happening again.

I can think of a few answers -

1) Someone in my team screwed up. They don't want to admit it, so they're keeping mum.
2) The server decided to randomly change it by itself. Maybe it was bored.
3) Someone from the outside world found a way in and decided to have a bit of mischief.

I'm at a bit of a loss as to what I should do.

Any suggestions?

Cheers,

B

[Matthew1980]

1) Someone in my team screwed up. They don't want to admit it, so they're keeping mum.

These things don't just change, it's a human input that does this; though if something on the disk gets corrupt, this can have unforeseen after effects down the chain.

I must admit though that this does sound rather odd. I would love to know the 'actual' cause.

Cheers,
MRb

[LifeinAsia]

Or a variation of 1):
1A) Someone in my team screwed up, but didn't realize it. They don't realize they accidentally did something, so they're keeping mum.

But I also wouldn't rule out 3.

[weeks]

I agree with LifeinAsia. And since 3 is a real potential, you need to protect yourself. Change the password again. If you don't have changes being logged, fix that. (Likely there is a log somewhere; check that.) I suggest you bring in an outside consultant for a security audit. Probably due anyway.