Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an interesting situation, where a user's account has been temporarily removed (paperwork not renewed in time). However, thanks to the magic of "screen", his processes are still running.

I would love to be able to reconnect to those old screen sessions and save some data out. Is that possible? I have sudo powers, but am not sure how to apply them in this case. Normally I would do:

  1. chmod 777 'tty' ; pretend those are back-ticks
  2. sudo su
  3. screen -x

but the user no longer exists in this case. Naively plugging in the old user ID didn't work (not that I really expected it to).

This is RedHat Enteprise Linux 5: (2.6.18-53.1.14.el5)

share|improve this question
2  
I recommend $() instead of backticks. –  Dennis Williamson Nov 21 '09 at 4:18
    
Dennis: For posting to ServerFault, or in general? More seriously, why? –  khedron Dec 9 '09 at 19:16

3 Answers 3

up vote 4 down vote accepted

You can't just temporarily create the user account again using the same UID ?

share|improve this answer
    
Great idea! If he just throws new lines into /etc/passwd and /etc/shadow he should get the user back for a moment and be able to use them. –  Brandon Rhodes Nov 21 '09 at 4:33
    
Yes you should be able to temporarily re-create the user; this should not involve editing any files, you can do it with useradd. –  MarkR Nov 21 '09 at 21:44
    
I'm a little leery of stepping in politics, since I'm not the sysadmin and I didn't delete this user, but I may try this. Thanks! –  khedron Nov 21 '09 at 22:10
    
After the politics didn't resolve itself, I snuck in and tried this. It worked perfectly, thanks for the tip! –  khedron Dec 9 '09 at 19:13

OK, this is why users should be disabled, rather than removed. There are built-in options to passwd for that sort of thing (and settings exist in every centralized-user-management software that I know of for it).

But you're not here to get yelled at.

Do the user's files still exist, or were those removed with the account? Screen uses the lock files to reconnect, and if they're gone, I'm honestly not sure how to reclaim the sessions.

Try Keiran's suggestion of recreating the UID if possible. Sometimes it isn't feasible, especially in a centralized authentication where the IDs are hashed from the other user information, but if you can, that would be swell.

Assuming you can't, you need to find a way to take over the terminal. I'm going to guess that TTYSnoop isn't configured on your system already. In that case, it's going to get hairy.

Assuming that your screen sessions issue you a pts/# terminal like mine do, there may (MAY) be a chance. pt stands for pseudoterminal, and it's sort of client/server based. There are the pt slaves, which is the terminal that you type with, and there is the ptmaster, that receives the input. There are many slaves (/dev/pts/*) to one pt master (/dev/ptmx). From the man page to ptmx:

   Before  opening  the  pseudo-terminal slave, you must pass the master’s
   file descriptor to grantpt(3) and unlockpt(3).

   Once both the pseudo-terminal master and slave are open, the slave pro‐
   vides  processes  with an interface that is identical to that of a real
   terminal.

It may (may!) be possible to assume the identity of the terminals that you want to assume (oh hell, might as well just say hijack at this point) using a custom written program that conveniently overlooks certain safety measures, like the pre-existence of the file descriptors you want.

It's probably much less work at this point just to concede defeat and lose the data.

share|improve this answer
    
I'm not the sysadmin on this system, I'm merely someone with sudo power. Not the same. =) I will try the various suggestions here & get back to you all. Thanks! –  khedron Nov 21 '09 at 20:35
    
+1 for disablement instead of deletion. –  womble Nov 30 '09 at 21:42

Have you tried, as root, to connect by specifying the running screen's socket name to screen? (I haven't tried this personally. )

share|improve this answer
    
I did not try, sorry. Thank you for the suggestion though. –  khedron Dec 9 '09 at 19:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.