Capturing password changes in Linux

Question

How can I capture (or access if there is a log file somewhere) when a user changes their password or another user's password?

Answer 1

PAM logs it to syslog by default for me.

Answer 2

Just replace passwd command on the $PATH environment variables by a shell script that, by example do this:

• log $USER environment variable content to a file
• Call passwd

Or you can do same by making an user alias for passwd command:

alias passwd='echo "On `date +%Y%m%d` user $USER call passwd utility" && passwd'

Regards

EDIT: This is correct if you want to log where an user call passwd command if you want to log if an user changes succesfully his password use passwd return value from your shell.