I just locked my root account (and all other accounts if it matters) completely out of the RHEL 5.4 by changing permissions on every file to 400. Now I have "Permission denied" on any command that I try to run, including chmod itself. Any idea on how to recover? The only access I have to the server is via terminal or SSH.

(If anyone cares how it happened, I was running a hardening script and one of the lines was supposed to change permission on some config files in /etc directory. It has couple of variables that had not been set, so the command essentially evaluated to

chmod -R 0400 /*

Ouch! This is sure a great lesson on checking the scripts even more carefully in the future but what can I do now?

  • For future reference, as a habit when I write my scripts I put echo before every command that does anything so I can see what is going to happen. Then when I am confident I remove the echo statements. Might slow be down a bit but probably would have prevented something like this. – Kyle Brandt May 6 '10 at 2:04

You're going to need to boot into single user mode to change the permissions back to where they should have been linky

Now the problem is going to be "What are my permission supposed to be? Well honestly at this point if you can afford the downtime a re-install might be your best course of action.

  • Agreed - copy out any files you need using either single-user mode or a live CD and then re-install. – EEAA May 6 '10 at 0:42

I don't think booting the existing system into single-user mode will work, because it will still be booting into the system that has the broken permissions. If you have the RHEL installation CD, you can boot from that and enter "linux rescue", when it gives you the option. It should then find your existing os, and mount that as /mnt/sysimage. From that point, you should be able to correct files that are owned by an rpm package with something like:

for PKG in `rpm --dbpath /mnt/sysimage/var/lib/rpm qa`
   rpm --root /mnt/sysimage --dbpath /mnt/sysimage/var/lib/rpm --setperms $PKG

I haven't tried this, so if that doesn't work, you would at least be able to manually set your permissions on the files under /mnt/sysimage.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy