futi
April 22, 2010, 1:51am
1
Hi folks.
our developer had a root user and he changed some settings about root user. We have not known what he changed.
There is an oracle user, we can login to oracle, no problem. But when we try to login to root user we are getting this error :
[oracle@localhost ~]$ su root
Password:
bash: root/.bashrc: Permission denied
Another output may be useful for you :
bash-3.2$ su - root
Password:
su: warning: cannot change directory to root: Permission denied
-bash: root/.bash_profile: Permission denied
-bash-3.2$
-bash-3.2$ pwd
/home/oracle
-bash-3.2$ echo $HOME
root
-bash-3.2$ cd $HOME
-bash: cd: root: Permission denied
-bash-3.2$
after unsuccessful login:
-bash-3.2$ who am i
oracle pts/5 2010-04-22 08:50 (10.10.6.71)
-bash-3.2$ whoami
root
-bash-3.2$
how can i restore the root user?
Thanks.
futi
April 22, 2010, 2:28am
3
-bash-3.2$ ls -ld /root
Reboot
April 22, 2010, 2:39am
4
Is /etc/passwd file correct for root user (entry).Pleas check, it may has chenged :
drwxr-x--- 17 0 0 4096 Apr 21 17:06 /root
insted or two 0 in above output it should give "root" & "root".You system is unable to resolve UID and GID from /etc/passwd and /etc/group files.
Pleas post the output of :
1 cat /etc/passwd
futi
April 22, 2010, 3:05am
5
output of etc/passwd :
[root@localhost etc]$ cat passwd
root:x:503:0:root:root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
amanda:x:33:6:Amanda user:/var/lib/amanda:/bin/bash
apache:x:48:48:Apache:/var/www:/sbin/nologin
pcap:x:77:77::/var/arpwatch:/sbin/nologin
oprofile:x:16:16:Special user account to be used by OProfile:/home/oprofile:/sbin/nologin
uuidd:x:100:101:UUID generator helper daemon:/var/lib/libuuid:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
ident:x:98:98::/:/sbin/nologin
named:x:25:25:Named:/var/named:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:4294967294:4294967294:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
avahi:x:70:70:Avahi daemon:/:/sbin/nologin
xfs:x:43:43:X Font Server:/etc/X11/fs:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
avahi-autoipd:x:101:106:avahi-autoipd:/var/lib/avahi-autoipd:/sbin/nologin
pegasus:x:66:65:tog-pegasus OpenPegasus WBEM/CIM services:/var/lib/Pegasus:/sbin/nologin
gdm:x:42:42::/var/gdm:/sbin/nologin
oracle:x:500:501::/home/oracle:/bin/bash
sabayon:x:86:86:Sabayon user:/home/sabayon:/sbin/nologin
fuat:x:501:502:fuat sungur:/home/fuat:/bin/bash
root:x:503:0:admin:/home/admin:/bin/bash
linuxata:x:504:504:türker ata:/home/linuxata:/bin/bash
[root@localhost etc]$
output of etc/group:
[root@localhost etc]$ cat group
root:x:503:root,linuxata
bin:x:1:bin,daemon
daemon:x:2:bin,daemon
sys:x:3:bin,adm
adm:x:4:adm,daemon
tty:x:5:
disk:x:6:
lp:x:7:daemon,lp
mem:x:8:
kmem:x:9:
wheel:x:10:
mail:x:12:mail
news:x:13:news
uucp:x:14:uucp
man:x:15:
games:x:20:
gopher:x:30:
dip:x:40:
ftp:x:50:
lock:x:54:
nobody:x:99:
users:x:100:
audio:x:63:gdm
utmp:x:22:
nscd:x:28:
utempter:x:35:
floppy:x:19:
vcsa:x:69:
rpc:x:32:
mailnull:x:47:
smmsp:x:51:
apache:x:48:
pcap:x:77:
oprofile:x:16:
screen:x:84:
uuidd:x:101:
slocate:x:21:
ntp:x:38:
pkcs11:x:102:
ident:x:98:
named:x:25:
rpcuser:x:29:
nfsnobody:x:4294967294:
sshd:x:74:
fuse:x:103:
stapdev:x:104:
stapusr:x:105:
dbus:x:81:
avahi:x:70:
xfs:x:43:
haldaemon:x:68:
avahi-autoipd:x:106:
pegasus:x:65:
gdm:x:42:
dba:x:500:oracle
oinstall:x:501:
sabayon:x:86:
fuat:x:502:
root:x:503:root
linuxata:x:504:
[root@localhost etc]$
Reboot
April 22, 2010, 3:15am
6
OK...
So, you need to change 503 in both files /etc/passwd and /etc/shadow in the root entry line (very first line in both files) to 0 (zero).
Also, remove all repeated entries from both files... I can see a lot of them... Check both files throughly...
futi
April 22, 2010, 3:25am
7
i could not edit the /etc/passwd file.
"passwd"
"passwd" E212: Can't open file for writing
Press ENTER or type command to continue
how can i do this ?
---------- Post updated at 02:25 AM ---------- Previous update was at 02:22 AM ----------
also, i could not read the shadow file :
-bash-3.2$ pwd
/etc
-bash-3.2$ ls -la shadow
-r-------- 1 0 0 1390 Apr 21 09:05 shadow
-bash-3.2$
Reboot
April 22, 2010, 3:38am
8
Now I think you can't edit the file.You need to boot the system from CD in single user mode and then edit both files...
futi
April 22, 2010, 5:39am
9
thank you very much "reboot", your responses are absolutely right !
methyl
April 22, 2010, 10:27am
10
There are two entries for root in /etc/passwd and /etc/group.
The home directory for root in the first entry in /etc/passwd is wrong (should be /root not root). Hence the "cd" error on "su - root".
/etc/passwd
/etc/group
As there is no user with UID:GROUP values 0:0 you cannot edit /etc/passwd with the system as it stands. As suggested earlier you will need to boot from CD to get a root access so you can correct /etc/passwd.
The hard bit must be trying to find out what was intended by whoever made the changes and what other random system commands have been typed.
I'd view anything related to the last three lines in /etc/passwd with caution. I don't like the look of the funny characters in the entry for "linuxdata".