Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I know they say "given root access, everyone will screw up their machine eventually", and I'm discovering how true that is. In an incident of extreme fatfingering, I've managed to wipe out my /etc/passwd file. Now, I have a current backup of it, but I want to make absolutely sure how I should restore it before doing so. Can I just create a file as root, paste the old contents in, and cp the new file over the now corrupt /etc/passwd?

OS is Ubuntu Hardy

EDIT

Erm the problem just took a turn for the much worse. I now cannot use sudo. Can someone PLEASE help me here? I assume I have to mount from a liveCD to edit my /etc/passwd back into place? Now my problem here is that I use a RAID setup. Will an ubuntu live CD autodetect this?

share|improve this question
1  
Is this a software or hardware RAID? –  Scott Pack Jan 5 '10 at 18:23
    
Sorry linux software RAID, i forgot to mention that. I'm a little rattled lol –  DWilliams Jan 5 '10 at 18:23
    
Specifically 4 hard drives, one RAID1 partition with /boot that is very small and one large RAID5 partition for everything else –  DWilliams Jan 5 '10 at 18:24
    
Can you boot into Single User Mode ? –  Zypher Jan 5 '10 at 18:37

4 Answers 4

up vote 3 down vote accepted

This is totally off the top of my head, but as long as you don't have this line ~~:S:wait:/sbin/sulogin in your /etc/inittab file, you can boot into single user mode without a password and re-set your root passwd.

This also assumes that either you don't have a boot loader (grub) password or that if you do have one, you know it ;).

-phez

share|improve this answer
    
This sounds goot to me. Can I get some second opinions assuring me that this will work before I power the server down? If it doesn't work then things will get a lot hairier after a restart. I currently have an open SSH session to the server that I know I can't get back once it powers down. –  DWilliams Jan 5 '10 at 18:45
    
You mentioned your root filesystem is on a RAID device. Who makes your card? (And what driver modules are loaded for it?) for the most part any good LiveCD should include the correct drivers. I've had problems in the past with HP stuff (cciss) but if it is an off the shelf adaptec or PERC (dell), the live CD will work. As insurance, you could restore the copy of /etc/passwd you have to your /home partition (or /etc/ if you have write perms) so all you have to do is cp it in once you're in single user mode... also, when in single user mode, the FS might be in RO mode, so re-mount rw. –  phez Jan 5 '10 at 19:24
2  
There may also exist a backup copy of /etc/passwd as /etc/passwd- –  TCampbell Jan 5 '10 at 19:31
    
+1: Single user mode is your friend. You can do ANYTHING to the system in single user mode. –  Satanicpuppy Jan 5 '10 at 20:23
    
My concern is whether or not I can actually get INTO single user mode without a proper /etc/passwd. Doesn't it prompt for a root password? The root account currently does not exist according to my /etc/passwd file, which contains a single lowercase "h". –  DWilliams Jan 5 '10 at 21:06

The one time I've had this happen (wasn't me! I just happened to have a shell on the machine, honest.) I managed to find a privilege escalation exploit on the net and hack into our own machine. Will likely not work in your situation since modern OS installs are much more secure, but...

share|improve this answer
    
I actually came up with a similar idea a minute ago. I have some in-house web reporting system running that I wrote myself in PHP. I thought there was a security hole in my code because a certain script would include any file passed to it via url. I tried to create a php script in my home directory with a system call to restore the passwd file but unfortunately it's less of a security hole than I thought since it works relative from the /var/www/reports directory and autoescapes special characters. I couldn't get it to run the script –  DWilliams Jan 5 '10 at 20:13
[public_html]$ ls -l r00t.txt 
-rw-r--r-- 1 user group 271 Aug  4  2002 r00t.txt
[public_html]$ cat r00t.txt 
once and for all: how to hack the root password on a linux box you have physical access to:
reboot or boot it
at the lilo prompt type:
<image name (linux?)> init=/bin/bash rw
in the root shell you get:
mount -a
passwd
<enter new root password>
umount -a
exec /sbin/init
share|improve this answer

Assuming it's a physical machine you have access to, even if you've totally locked yourself out of the machine AND can't log into it in single user mode, there is nothing preventing you from simply booting into the machine via a bootable USB or CD and then restoring /etc/passwd and /etc/shadow through there.

Or, if all you need is change the password ...

  1. Boot form CD.
  2. Build raid arrays if using SW raid.
  3. Build LVM volumes if using those.
  4. Mount partition to folder.
  5. Chroot into folder.
  6. Execute a passwd command to change password.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.