Root shell mangled in passwd file; now can't get into root user

[Steven W. Mills]

The shell for root in /etc/passwd got accidentally changed from /sbin/sh to /sbin/h. I've tried several ways to get into root id but so far all have returned "no shell" error message and login stops. Is there a way to su to root without attempting to start invalid shell? Running HP-UX 11.00 on 712/60 workstation.

[harry d brown jr · Accepted solution]

SHUT the system down - hard if you have to, and boot into single user mode, then fix /etc/passwd.

or try to create an /sbin/h shell if possible, but I doubt it.

live free or die
harry

[Martin Johnson]

Bring the system down into single user mode and edit /etc/passwd. If you can't bring it down, can you restore from backup?

Can you ftp to the system using root? You can copy the passwd file to another system, make the change and ftp it back.

HTH
Marty

P.S. I usually set up a pseudo root account (username/password with UID=0) to handle problems like this. You might consider doing the same.

[Jacob_2]

login as any_other_user
#cp /etc/passwd /tmp/passwd.mangled
#cp /etc/passwd /tmp/passwd

now edit the /tmp/passwd file to correct the shell

ftp to the same host with root
cd /tmp
lcd /etc
put passwd
bye

I think this should work
Never tried though !
Goodluck

[Jose Mosquera]

Hi,

Try to get /etc/passwd file with a ftp in ascci mode. Then modify mangled line with a text editor, so replace it with ftp (ascci)in /etc.

Rgds

[Steven W. Mills]

Thanks all!! I couldn't FTP into system as root as that is restricted. Getting the system to BOOT-ADMIN prompt and then to ISL prompt was the killer -- pressing/holding ESC key at the correct time. Thanks, again.
Steve

[harry d brown jr]

Yeah, FTP, rlogin, basically everything will fail if the /etc/passwd file is toast on the root line. The other day I was working on a system that had TWO (2) root lines in /etc/passwd. I said what the hell is with this, so I deleted the first line, not knowing that an SA had put that line in because there was something wrong with the original root line. Well I did the reboot into single user mode, vi'd the /etc/passwd file, and found that the original root line had a SPACE after /sbin/sh . That was his original problem so I removed the space, and booted the system.

Sometimes I wonder if root should just be BUILT into the kernel.

live free or die
harry