Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A student at my school, whilst logged in as root, committed

userdel -r root

We quickly came to the consensus that he needed to reinstall (not too big a burden in this environment). But is this situation, where the root account has actually been removed, not just disabled - is this even theoretically recoverable?

share|improve this question
up vote 4 down vote accepted

If all goes wrong and you can't use sudo or boot in single user mode as suggested by Zypher, put on a live CD, mount the partition and add it manually to the /etc/passwd and /etc/shadow.

You will have to fix groups too after that.

For reference, there're the lines on passwd and shadow. The password for root in this shadow line is test




share|improve this answer
sudo shouldn't work, as there is no UID 0 to become, so mounting the partition rw and manually adding the root user back sounds like the most direct and workable solution. – cpbills Aug 3 '10 at 20:30
Manually adding "root" back into /etc/passwd and /etc/shadow is what we ended up doing. Accepting on that basis. – Brighid McDonnell Aug 4 '10 at 4:28

theoretically you should be able to use a sudo user, or single user mode and re-add the user with the --uid 0 & --gid 0 & --home /root options. I've never tried it but it should work.

share|improve this answer
Sudoing actually didn't work while the root account was not present. Going to runlevel 1 and manually adding the user to /etc/passwd and /etc/shadow, then changing the password, seemed to work. With the help of vm snapshots, we recreated the situation. :D – Brighid McDonnell Aug 3 '10 at 20:18

From the man page, userdel will remove the account and the "home" directory of the deleted user. The crontab for the user will also be removed.

My guess is that the root account and password could be regenerated. And from backups, the root crontab and the /root directory could be recovered.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.