Nothing in /etc/passwd after cold install

[NOreen Merrick]

Hi Guys,

I have hp-ux system 11.0 after cold install and noticed there is nothing inside /etc/passwd even though I log in as root with a password. I have the old password file saved , whats the best thing to do ? Should I just copy this back into machine or should I set up new info, the file is there by the way but empty.

Thanks Guys,
Noreen

[Patrick Wallek]

There should ALWAYS be something in /etc/passwd. If not, then there is a problem. If there is nothing there I also have to wonder how you got logged in at all.

If this was a cold install, I would be tempted to start from scratch again. If /etc/passwd is incorrect I have to wonder what else is not right.

[Peter Godron]

Noreen,
copy the file.

Why are you still installing 11.0, it's not longer supported ? Or is it one of those users/applications ?

[NMory]

Do you have a previous backup of your /etc/passwd?
Maybe if you are planning to use the same set of users you can restore from backup.
If I were you I would install the OS again.
Check your /var/adm/syslog/syslog.log file to see if there is something there.

NM

[melvyn burnard]

Hmm, this sounds weird, as far as I recall if there is a corrupt or empty /etc/passwd file then the system woul dno tboot into multi-user mode, but go into single-user mode to allow you to correct it. This would automatically log you in as root.

I have also NEVER seen an empty /etc/passwd file after an install.

ll /etc/passwd

[NMory]

Run a pwck and/or restore you passwd file from /usr/newconfig/etc/passwd.

Regards,

NM

[NOreen Merrick]

Hi Guys,

thanks for the advice, i have examined syslog.log and there is nothing in there that looks worrying. I have compared the permissions etc on this /etc/passwd with another machine

Problem machine

bash-2.04# ll /etc/passwd
-r--r--r-- 1 0 other 0 Mar 15 12:38 /etc/passwd

As you can see it has todays date on the /etc/passwd file which is odd and also there is no owner on the file.

In fact I just tried logging in again to this machine on another session and it won't allow me login now, i still have the other session open.


Good machine


bash-2.04# ll /etc/passwd
-r--r--r-- 1 root sys 775 Aug 29 2005 /etc/passwd


Should I just rename the old passwd file and then open a new passwd file and cut and paste in from the old file?

When i run pwck it returns nothing.

If I lose my current connection to machine am I ever gonna be able to log in again?


Thanks.
Noreen

[Peter Godron]

Noreen,
as I said before, copy the file.
If necessary, you can go to single-user mode (as long as you have a accessable /etc/passwd file).

Re-reading the other comments, does make you wonder whether the file was emptied after you had logged in ??

[NOreen Merrick]

Hi Peter,

I can't copy the file cos I cant ftp to machine ( as it wont allow root to login in any more - its really weird i logged in ok earlier)

I only have a copy of the file in wordpad that i manually copied off machine before cold install ( ie no backup)

Will it be ok for me to do


chown root:sys passwd
chmod 775 passwd
vipw
paste in details from wordpad
save

Thanks

Noreen

[NOreen Merrick]

Or should I do

rename passwd to passwd_old
vipw or touch passwd
chmod 775 passwd
paste in the details
save
chown root:sys passwd

cheers
noreen

[melvyn burnard]

If you currently are logged in to the serevr, copy /usr/newconfig/etc/passwd into /etc/passwd to give you a basic new install password file.
You can then edit it and add in any other users that you may have already added.

[NOreen Merrick]

Melvyn,


bash-2.04# ll /usr/newconfig/etc/passwd
-r--r--r-- 1 0 other 332 Nov 7 1997 /usr/newconfig/etc/passwd
bash-2.04#


Am just wondering will I be able to vi this after I copy when there are no write permissions?

[melvyn burnard]

try vi'ing it now
but as root you should be able to do it

[Patrick Wallek]

As long as your are logged in as root, you can edit ANYTHING.

You just have to do ':w!' from within vi to save a file (the '!' forces the save).

Since you got logged in earlier, somehow the file got cleared AFTER you logged in.

I also notice you are using 'bash' on this machine. ABSOLUTELY DO NOT change root's default shell in /etc/passwd from /sbin/sh. It ABSOLUTELY MUST be /sbin/sh or you will have problems booting the machine later.

[NOreen Merrick]

Ok I did that Melvyn

now I have

bash-2.04#
bash-2.04#
bash-2.04#
bash-2.04# vipw
"/etc/ptmp" 11 lines, 332 characters
root::0:3::/:/sbin/sh
daemon:*:1:5::/:/sbin/sh
bin:*:2:2::/usr/bin:/sbin/sh
sys:*:3:3::/:
adm:*:4:4::/var/adm:/sbin/sh
uucp:*:5:3::/var/spool/uucppublic:/usr/lbin/uucp/uucico
lp:*:9:7::/var/spool/lp:/sbin/sh
nuucp:*:11:11::/var/spool/uucppublic:/usr/lbin/uucp/uucico
hpdb:*:27:1:ALLBASE:/:/sbin/sh
nobody:*:-2:-2::/:
www:*:30:1::/:


I take it I will have to edit it now and enter roots passwd from my old backed up copy and all the others aswell?

[NOreen Merrick]

Thanks a million.

Managed to fix it. Can log in now again as root.

I know why it happened. I was playing with Scripting earlier trying out examples using 'cut' and I think I may have accidentally cut the passwd file in some way, makeing it corrupt perhaps. V stupid I know.


I have two more questions which have come out of this.

Should I be using /etc/shadow file as it is not currently in system?

Also other than syslog.log is there some way that I could have checked what was the last action on the /etc/passwd file before the problem occurred to track it?

Thanks
N

[NMory]

You can set your system to trusted, and use the Audit features of Trusted systems for that.

Also if you turn your system to trusted, then will have a shadow password file created.

Regards,

NM

[Patrick Wallek]

If you have password history enabled, then just go through your password history to see what happened. Since you are using bash, you should be able to use the 'Page Up' key on the keyboard to scroll back through your command history.

This type of thing will not be logged in syslog.

This is a very good example of why you should NEVER do any testing against live files. You should always make a copy of whatever file you are testing against to a different directory and work on that file until absolutely sure of your results.

[NOreen Merrick]

Hi Patrick,

Thanks for the advice, have to say this site has to be the best I've ever stumbled upon.

I have history with bash, what is password history?


This is excerpt from the script I was running, would this have corrupted /etc/passwd?


while read buffer
#entering the while loop and defining what pass_user is - pass_user is taken from the /etc/passwd file by cutting out a column
do
pass_user=`echo $buffer | cut -d: -f1`
#now echo out the list of users found in teh /etc/passwd file when the cut has been done
echo "$pass_user found in /etc/passwd"

echo "now checking $login_user against $pass_user"

#reading in from the /etc/passwd file
done > /etc/passwd


Yes I know its mad, this sys admin craic really tests your nerves. Ha

[Patrick Wallek · Accepted solution]

Sorry, I meant shell history, not password history.

Your script would MOST DEFINITELY corrupt the passwd file.

Notice the last line of your scipt. It does a:

done > /etc/passwd

That redirects the OUTPUT of your script to /etc/passwd.

I think what you meant to do was:

done < /etc/passwd

so that the script takes /etc/passwd as INPUT.

[James R. Ferguson]

Hi Noreen:

Whatever you choose for your default shell, 'root's shell _must_ remain '/sbin/sh' (the Posix shell) or you will find yourslef with an unbootable system one day.

The shell in '/sbin' uses statically linked libraries. This is necessary during startup for things to work in the absence of a mounted '/usr' filesystem. Normal, non-root users benefit by using '/usr/bin/sh' since its use of dynamic libraries reduces the overall memory footprint for a user.

Regards!

...JRF...

[James R. Ferguson]

Hi (again) Noreen:

> Should I be using /etc/shadow file as it is not currently in system?

The shadow password implementation is not available to 11.0. For 11.11 its an add-on. For later releases its part of the distribution. See here for more information for 11.11 [ another good reason to upgrade :-)) ].

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=ShadowPassword

Regards!

...JRF...

[NOreen Merrick]

Hi Patrick,

yes that was what I meant to do. I keep making that mistake, thanks, everything answered now.
Thanks a million

I'll close the thread.

Noreen

[Dennis Handly]

>yes that was what I meant to do. I keep making that mistake

Perhaps you should ignore the advice we keep telling users here, to never use cat(1). In your case with passwd, it would be safer:
cat /etc/passwd | while read buffer; do
... #reading in from the /etc/passwd file
done

[NMory]

Noreen:

Remember to assign points to each one of the persons that helped you in this thread...

Regds,

NM.