/etc/passwd 0 bytes !!!

[Tracey]

My /etc/passwd file got wiped out. I have users who are logged on, but none with permissions for me to write the root record to the file. Permissions are readonly except for user 0, which of course isn't there. No one can log in. Anyway I can get one of the logged in users permission to change the file??

Help!

[Pedro Sousa · Accepted solution]

Hi Tracey!
Did someone clean the file?? One way to solve it is restarting the system in single user mode.
If the file doesn't exist at all, you can allways create a new one.

sorry, but I don't know any other way to solve it.
hope this helps.

[Stefan Farrelly]

There is no legal way to write to /etc/passwd from a non-root priveleged user. As Pedro said, you will need to reboot in single user mode and recreate it/restore it.

/etc/passwd doesnt just get zeroed by itself. Someone or something did it. You should try to find out who/what. There are a couple of /etc/passwd patches out there - do you have the latest ones installed, maybe its a bug.

Is there an /etc/passwd.tmp or /etc/passwd.* file (maybe someone made a backup of it or vipw left a temp copy) - but you will still need to reboot in single user mode to fix it.

[Pedro Sousa]

Hi again.
check this one: http://forums.itrc.hp.com/cm/QuestionAnswer/1,1150,0x5bc253921f1ad5118fef0090279cd0f9,00.html

You'll find some other possibilities like: booting in maintenance mode (hpux -lm) or from the recovery CD.
good luck.

[Thomas Schler_1]

Tracey:

Check permissions of /etc.

If /etc/passwd got wiped out by an user other than root, it may happened due to a writeable /etc for others than root or bin. If /etc is writeable for others you could restore passwd without booting even if passwd is writeable for no one.

After restoring /etc/passwd check permissions of /etc to be
dr-xr-xr-x 31 bin bin 6144 May 25 13:43 /etc

[Volker Borowski]

Hi Tracy,

if you have set up a remote authentication
(host.equiv or rhosts) you might be able to rlogin.

Other chance: do you have omni back installed and write access to /opt/omni/bin ?
You could put a script there, that copies you a new /etc/passwd and execute it as a pre-exec-script to a backup and execute the backup.

Do not know if this helps, but if it helps, you should change it, because it is not supposed to work :)

Volker

[John Bolene]

No, he can't even rlogin without a root entry in the first position of the passwd file.

The only option is to go single user mode and restore the file or at least add the root user and reboot. After the reboot, he can restore from another machine if that is where the backup is.

[Vincenzo Restuccia]

If you have a make_recovery:
#mt -t /dev/rmt/0mn fsr 1
#tar xv /etc/passwd

[Abel Berger]

Hi Tracey,

Check out :

Find or remender a script that run in root crontab, date and hour.
modifies this script so that it change the permissions in the /etc/passwd for 777.
In script put line as below :

chmod 777 /etc/passwd

Wait the script run and execute the alteration.
This way you will have permissions for change it and re-create it !

Then....you are inside..!!!!

I hope help you.

Regards.

Abel Berger

[Tracey]

Thanks all for your help, I knew I could do it by rebooting in single user mode, I just didn't want to if I didn't have to. I did end up rebooting, adding the root user and then getting the file from elswhere.

Why did it happen? Someone was *trying* to ftp the file from the #2 machine to the #3 machine but accidently ftp'd it to itself - which of course zeroed it out.

In order to reboot since I could not login, I did a TOC on the back. Was there a safer/easier way to do this?

[Patrick Wallek]

A TOC is one way, you could also have done a CTRL-B and done an RS, or a TOC from there.

[John Bolene]

The C110 has a power off interrupt associated with the power button, the 715 does not.

The newer machines are supposed to have this feature.

This power down interrupt feature actually is a short shutdown that kills all the processes and then turns off the power.

It will not work if a realtime process goes nuts since the interrupt never gets in.

[Bruce Regittko_1]

Hi,

It is too late for this time but next time - :) - you can get an original copy of passwd from /usr/newconfig/etc. It won't have your users but it will have the system accounts. It will be enough keep you going until you can recover the real passwd from backup.

--Bruce

[Thierry Poels_1]

Hi,
I just had the same problem 2 days ago at client's site. System acting strange & login impossible: /etc/passwd was resize to 0 bytes!
The system seemed to have hit the nfile kernel parameter :( The 'File table full' error in the syslog had the same timestamp as the empty /etc/passwd file, so I relate both problems.
I was still logged on & I have special files like /etc/passwd, /etc/groups, /etc/inetd.conf and may more copied daily to a NT, so I could copy passwd file quickly back to the Unix box.
regards,
Thierry.

[Satish Y]

Hi,

one interesting thing i came to know when i was searching patches, according to that, if u have a file called /tmp/manxxxxx (xxxxx -- numeric), linked to any file(in this case it may be /etc/passwd), when any process that owned by root having same id as 'xxxxx' it will wipe out all information in that file which is linked to /tmp/manxxxxx (here /etc/passwd) as it opens the file in write mode which causes the information wiped-out first.

Most appropriate way is to recover it from backup. Do u have backup of it?.

Cheers...
Satish.