Can't login as root after etc-update

Message

zaj_tam · Post by **zaj_tam** » Thu Nov 18, 2004 8:30 pm

So. I had 18 configs to look at and i was in a hurry. So i see this word merge all AND ... And i think to myself: merge does not equal overwrite. Then i merge all the configuration files. Among others the fstab and another one that seemed to contain my root password. Because i can not su to root anymore. Now i was wondering if there is any possible way to enter root without beeing physicaly present at the machine and set password in chrooted enviroment? I personaly think there is no way but i've also been the one to make a major screwup. Help?

thx

pYrania · Post by **pYrania** » Thu Nov 18, 2004 9:49 pm

There is no other way than recover your root pwd within a chroot.
except you find a working exploit for one of your running services

zaj_tam · Post by **zaj_tam** » Fri Nov 19, 2004 6:11 am

Hm. I was thinking about that yes. But everything was updated very recently :/ I'l have to make a visit ....

Lotu · Post by **Lotu** » Fri Nov 19, 2004 4:56 pm

It could be that you've overwrited your /etc/group file. You cannot su to root if your user is not in the wheel group. So check that file.

Bad line:

wheel

10:root

Good line:

wheel

10:root,john

where 10 is the group number (your number may be different, don't change it) and john is your username.

Of course you'll have to be root to edit the file, but check if you can logout and then login as root instead of su.

If you're connecting through ssh, try 'ssh root@address'.

zaj_tam · Post by **zaj_tam** » Wed Nov 24, 2004 5:44 pm

thx. Yes, the group file was overwritten. But also the root password wasn't set :/ Anyways, the strange thing is that another user still had the groups set right. He was in the wheel group.

flindt · Post by **flindt** » Wed Nov 24, 2004 6:31 pm

Hi

I have the same problem, but I have not rebooted yet.. and a still have a root terminal running - but how do I find the exact problem? I also have a backup of /etc from right before the dispatch-conf ...

I cannot login as either user or root in new terminals.

flindt · Post by **flindt** » Wed Nov 24, 2004 6:40 pm

Tried to change my root passwd from the open terminal - but got

Code: Select all

thor etc # passwd
passwd: Cannot determine your user name.
thor etc #

Which file holds user names?

starcrusher · Post by **starcrusher** » Wed Nov 24, 2004 7:38 pm

Hello flindt,

The USER environment variable holds the user name of the current login session, /etc/passwd contains the user names, /etc/shadow contains the (encrypted) passwords.

/etc/passwd should at least contain the line

Code: Select all

root:x:0:0:root:/root:/bin/bash

I hope it helps. Good luck!

flindt · Post by **flindt** » Wed Nov 24, 2004 8:11 pm

Thanks, but I have just restored my backup - now my config files are not up to date

But at least I can login.

I checked the /etc/passwd and /etc/shadow against the backup files with diff before resoring them, and there was no difference. So I am gessing it could be an error in a script?! I also checked the /etc/pam.d and other stuff that had changed a little in the /etc folder, but I did not see any obvious errors...

I think this I rather serious, since it happened yesterday too - exact same problem, and I had to restore from a system backup. So today I payed extra attention to updating the config files using dispatch-conf, but since the same thing happened it was not just a simple update mistake on my part.