0

I have some issues with files /etc/passwd and /etc/shadow. Both of them are without permissions:

---------- 1 root root   1357 Aug  5 11:30 passwd
---------- 1 root shadow 1175 Aug  5 11:30 shadow

And i don't know how this happened or why. Basically I can't edit/remove these files or change permissions when I am logged as the root user. It ends with "Operation not permitted". Eg. when I try:

root@server:/etc# chmod 600 passwd
chmod: changing permissions of ‘passwd’: Operation not permitted

The main issue is that any logged user has "I have no name!@..." in the command line and I can't use "su" or run some services as an another user. I guess these files should have some permissions and that's the problem. My system is Ubuntu 14.04.3 LTS with the newest updates.

  • 1
    What happened on the 5th August at 11:30? I'll bet that your system has been compromised. – Michael Hampton Aug 14 '15 at 1:19
  • I don't know, there are not logs from 5th August, the last one syslog.7.gz is from 6th August. That's possible but i haven't noticed any abnormal behavior like high traffic, cpu load, or so, except these two files. – Martin Sudolsky Aug 14 '15 at 1:27
  • Go get maldet and scan the system. – Michael Hampton Aug 14 '15 at 1:28
  • 1
    possible duplicate of How do I deal with a compromised server? – womble Aug 14 '15 at 1:30
  • Although it's easy to close this question with the answer that the server was compromised, but I would like to know if someone else went into similar issues with these two files and if there is not any other reasonable explanation. – Martin Sudolsky Aug 14 '15 at 1:39
3

Did you try:

# lsattr /etc/shadow

What's the output of this on the command line?

If is looking like this:

----i-------- /etc/shadow

Then is immutable and you can't edit/delete the file even as root.

You have to run:

chattr -i /etc/shadow

Now you can edit the file.
This procedure is available only if the immutable -i is showing on the file.

| improve this answer | |
  • Thank you very much! This helped! I removed the immutable attribute for both files via chattr, then I set permissions to 644 for passwd and 640 for shadow and finally i added the immutable attribute back. After reboot is all ok. Probably I won't know what happened to these two files or what did this, if the server was compromised, some broken update, broken virtual partition or file system. So for sure i am going to reinstall server. – Martin Sudolsky Aug 14 '15 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.