Cannot do anything as root

Hello,

I have a problem with a server. I have access to 2 different root accounts, and they appear to be stuck doing something with sh. I also could not get to the machine with ssh as I usually do; I had to use rlogin.

Here is what happens when I try to su to a root acount:

-bash-3.00$ su testroot
Password:
sh: *** No targets specified and no makefile found. Stop.

And it goes back to the shell of the normal user. I cannot rlogin as root because remote login by root is disabled, and I cannot edit the /etc/default/login file to allow remote login by root because I cannot edit the file without root access. Therefore, I appear to be stuck unless if someone knows how to get sh to stop doing whatever it is doing. I also do not want to reboot the machine.

Additionally, I cannot execute any commands as root with su, which would have helped a lot.
For example:
-bash-3.00$ su testroot -c "vi login"
Password:
sh: invalid option -- c
Usage: sh [options] [target] ...
Options:
-b, -m Ignored for compatibility.
-B, --always-make Unconditionally make all targets.
-C DIRECTORY, --directory=DIRECTORY
Change to DIRECTORY before doing anything.
-d Print lots of debugging information.
--debug[=FLAGS] Print various types of debugging information.
-e, --environment-overrides
Environment variables override makefiles.
-f FILE, --file=FILE, --makefile=FILE
Read FILE as a makefile.
-h, --help Print this message and exit.
-i, --ignore-errors Ignore errors from commands.
-I DIRECTORY, --include-dir=DIRECTORY
Search DIRECTORY for included makefiles.
-j [N], --jobs[=N] Allow N jobs at once; infinite jobs with no arg.
-k, --keep-going Keep going when some targets can't be made.
-l [N], --load-average[=N], --max-load[=N]
Don't start multiple jobs unless load is below N.
-n, --just-print, --dry-run, --recon
Don't actually run any commands; just print them.
-o FILE, --old-file=FILE, --assume-old=FILE
Consider FILE to be very old and don't remake it.
-p, --print-data-base Print make's internal database.
-q, --question Run no commands; exit status says if up to date.
-r, --no-builtin-rules Disable the built-in implicit rules.
-R, --no-builtin-variables Disable the built-in variable settings.
-s, --silent, --quiet Don't echo commands.
-S, --no-keep-going, --stop
Turns off -k.
-t, --touch Touch targets instead of remaking them.
-v, --version Print the version number of make and exit.
-w, --print-directory Print the current directory.
--no-print-directory Turn off -w, even if it was turned on implicitly.
-W FILE, --what-if=FILE, --new-file=FILE, --assume-new=FILE
Consider FILE to be infinitely new.
--warn-undefined-variables Warn when an undefined variable is referenced.

This program built for i386-pc-solaris2.10
Report bugs to <bug-make@gnu.org>

If you need anymore information I will give it to you ASAP. Thank you for your time.

What happens if you do

su - testroot
or

su -

?

Can you run the command "grep root /etc/passwd"? What is the shell? Also, can you check if the /bin/sh binary is as it should be? try running /bin/sh as any user.

In addition to what blowtorch said, The root shell should be /sbin/sh, the root standard shell is the statically linked sh.

-bash-3.00$ su - testroot
Password:
-sh: *** No targets specified and no makefile found. Stop.
-bash-3.00$

I receive the same result with su -

-bash-3.00$ grep root /etc/passwd
root:x:0:0:Super-User:/:/sbin/sh
testroot:x:0:0:Super-User:/:/sbin/sh

-bash-3.00$ ls -l /bin/sh
lrwxrwxrwx 1 root root 13 Aug 25 21:44 /bin/sh -> ../../sbin/sh

-bash-3.00$ ls -l /sbin/sh
-r-xr-xr-x 1 root root 812188 Oct 16 21:24 /sbin/sh

I'm guessing there is something wrong with sh? Because this is the result if I run it as any user:

-bash-3.00$ sh
sh: *** No targets specified and no makefile found. Stop.

I just noticed that the date of /sbin/sh is October 16, and that is when the problem began.

What about

file /sbin/sh

I think your /sbin/sh has been replaced, maliciously or accidentally....

Cheers
ZB

-bash-3.00$ file /sbin/sh
/sbin/sh: ELF 32-bit LSB executable 80386 Version 1, dynamically linked, not stripped

Files in /sbin directory should be statically linked. Like this

$ file /sbin/umount
/sbin/umount: ELF 32-bit LSB executable, Intel 80386, version 1 (FreeBSD), for FreeBSD 4.5, statically linked, stripped
$

Your /sbin/sh file has been definitely been replaced, and it looks like it has been replaced by make or something like that. That seems to be the output that you are getting on running sh.

You are exactly right. Take a look at this.

-bash-3.00$ ls -l /sbin/sh
-r-xr-xr-x   1 root     root      812188 Oct 16 21:24 /sbin/sh
-bash-3.00$ ls -l /usr/local/bin/make
-rwxr-xr-x   1 mrodey   mrodey    812188 Sep 23 16:19 /usr/local/bin/make

The files are the same size. Now that we know this is the problem, is there any way to resolve it remotely when all of the root accounts are set to use sh?

If / is writable, you could put a Makefile there and sign on. The default target in the Makefile would be made!

Sorry, I couldn't resist...

That's absolutely insane, but might actually work. And the makefile need not be in root -- you seem to be able to pass parameters with su. Put this makefile somewhere:

SHELL=/sbin/tcsh
# Comment Line
# Uncomment line below for GNU make
#.PHONY:somesortofname

somesortofname:
        echo "Makefile has been run"
        echo "Second command"
#        download_replacement
#        overwrite /sbin/sh
#        chmod 755 /sbin/sh

Note that the eight spaces before things are actually tabs, and MUST be tabs or make will puke on it.

Then run:

su testroot -f /path/to/makefile

If you can execute an arbitrary makefile with root permissions, you can craft something to download and replace your broken sh like a batch file.

I thought that su has a -c option and when it gets a -c, it happens to invoke the shell with a -c as well. This would mean that -c is hard-wired in. Looking at the Solaris source code, it seems that I was wrong and Corona688 has it right. su is simply passing arguments to the shell.

So yes, I think this just might work!

Ugh, I somehow failed to notice this was solaris make instead of gnu make. Omit the line beginning in ".PHONY" and it should work in solaris make.

I'd also suggest making sure your current sh isn't hardlinked to anything. It'd suck to overwrite your make to save your sh.

This is Solaris but with GNU make.

Well, I must say, you guys totally rock.

-bash-3.00$ su testroot
Password:
# id
uid=0(root) gid=0(root)
#

Thank you everyone for your help. Especially you Corona688, your MakeFile worked perfectly.

I know it's obvious but now that you're in, make sure you put the correct /sbin/sh back where it should be. Lots of the scripts which start things at boottime use /sbin/sh.

just curious ... disregard as required ... just the musings of an insomniac ...

i know rlogin doesn't work --- does root rsh? if yes, an rsh call for a remote xterm window could have been used to troubleshoot ... if remote xterms are not possible, at least troubleshooting could have proceeded remotely without the need for local root on the affected box ...

Yep, I put sh at /sbin/sh

Nope, rsh does not work for a root account either. You would need to change /etc/default/login to allow remote logins by root using rsh just as you would need to for rlogin.