Home / server / Questions / 99698
Accepted
DWilliams
Asked: 2010-01-06 10:13:51 +0800 CST

Restoring /etc/passwd from file

  • 772

I know they say "given root access, everyone will screw up their machine eventually", and I'm discovering how true that is. In an incident of extreme fatfingering, I've managed to wipe out my /etc/passwd file. Now, I have a current backup of it, but I want to make absolutely sure how I should restore it before doing so. Can I just create a file as root, paste the old contents in, and cp the new file over the now corrupt /etc/passwd?

OS is Ubuntu Hardy

EDIT

Erm the problem just took a turn for the much worse. I now cannot use sudo. Can someone PLEASE help me here? I assume I have to mount from a liveCD to edit my /etc/passwd back into place? Now my problem here is that I use a RAID setup. Will an ubuntu live CD autodetect this?

linux

4 Answers

  1. Best Answer

    This is totally off the top of my head, but as long as you don't have this line ~~:S:wait:/sbin/sulogin in your /etc/inittab file, you can boot into single user mode without a password and re-set your root passwd.

    This also assumes that either you don't have a boot loader (grub) password or that if you do have one, you know it ;).

    -phez

    • 3

  2. The one time I've had this happen (wasn't me! I just happened to have a shell on the machine, honest.) I managed to find a privilege escalation exploit on the net and hack into our own machine. Will likely not work in your situation since modern OS installs are much more secure, but...

    • 0 
  3. [public_html]$ ls -l r00t.txt 
-rw-r--r-- 1 user group 271 Aug  4  2002 r00t.txt
[public_html]$ cat r00t.txt 
once and for all: how to hack the root password on a linux box you have physical access to:
reboot or boot it
at the lilo prompt type:
<image name (linux?)> init=/bin/bash rw
in the root shell you get:
mount -a
passwd
<enter new root password>
umount -a
exec /sbin/init
    • 0

  4. Assuming it's a physical machine you have access to, even if you've totally locked yourself out of the machine AND can't log into it in single user mode, there is nothing preventing you from simply booting into the machine via a bootable USB or CD and then restoring /etc/passwd and /etc/shadow through there.

    Or, if all you need is change the password ...

    1. Boot form CD.
    2. Build raid arrays if using SW raid.
    3. Build LVM volumes if using those.
    4. Mount partition to folder.
    5. Chroot into folder.
    6. Execute a passwd command to change password.
    • 0