Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A student at my school, whilst logged in as root, committed

userdel -r root

We quickly came to the consensus that he needed to reinstall (not too big a burden in this environment). But is this situation, where the root account has actually been removed, not just disabled - is this even theoretically recoverable?

share|improve this question

3 Answers 3

up vote 4 down vote accepted

If all goes wrong and you can't use sudo or boot in single user mode as suggested by Zypher, put on a live CD, mount the partition and add it manually to the /etc/passwd and /etc/shadow.

You will have to fix groups too after that.

For reference, there're the lines on passwd and shadow. The password for root in this shadow line is test

passwd

root:x:0:0:root:/root:/bin/bash

shadow

root:$6$YlqpNCBt$yYpknNzO8e4NLEKwXqHeJLTixssV8AxNRPKn/pr1CrsIlHSv7chPRDJ9Li3XMqsDm9zytWt8KQOd99VT0cBGF0:14824:0:99999:7:::
share|improve this answer
2  
sudo shouldn't work, as there is no UID 0 to become, so mounting the partition rw and manually adding the root user back sounds like the most direct and workable solution. –  cpbills Aug 3 '10 at 20:30
    
Manually adding "root" back into /etc/passwd and /etc/shadow is what we ended up doing. Accepting on that basis. –  Sean M Aug 4 '10 at 4:28

From the man page, userdel will remove the account and the "home" directory of the deleted user. The crontab for the user will also be removed.

My guess is that the root account and password could be regenerated. And from backups, the root crontab and the /root directory could be recovered.

share|improve this answer

theoretically you should be able to use a sudo user, or single user mode and re-add the user with the --uid 0 & --gid 0 & --home /root options. I've never tried it but it should work.

share|improve this answer
    
Sudoing actually didn't work while the root account was not present. Going to runlevel 1 and manually adding the user to /etc/passwd and /etc/shadow, then changing the password, seemed to work. With the help of vm snapshots, we recreated the situation. :D –  Sean M Aug 3 '10 at 20:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.