shell problem

[Nick D'Angelo]

All, I accidentally changed the root entry in /etc/password to /sbin/ksh however, the file 'ksh' does not exist in /sbin and now I can not correct it.

When I try to logon or even ftp as root, it simply comes back and says No shell. I can not copy the /usr/bin/ksh to /sbin as I do not have the correct permissions.

HPUX 11.i

Any suggestions?

[Olav Baadsvik]

Hello,

Try the following:

who
and look for anyone logged in as root.
If yes find her and have her change
/etc/passwd.

. boot in single-user mode.

No matter how you fix this, my advise is to
never change the login-shell for root.
/sbin/sh is special is it does not depend
on shared libs like all other shell do.

Olav

[Mark Greene_1]

Login as a non-root ID and su to root. Be sure to just su and not "su -". That way the login process will still leave your login in the original environment.

If that does not work, you are left with booting off of the cd and fixing the file. You should (depending on what version of HP-UX) get a menu once booted on the cd that will allow you to run in a limited environment.

HTH
mark

[john korterman]

Hi Nick,
better consult this thread:
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x1e88abe92dabd5118ff10090279cd0f9,00.html

regards,
John K.

[Balaji N · Accepted solution]

hi,
1. try if booting in single user mode helps.

2. do you have an entry in /.rhosts. then try rcping the ksh file or a copy of the passwd file with correct entry.

3. login as ordinary user and then try a su and see if it works.

and never change the shell of root. it is normally in /sbin directory and even if you dont have your usr volume mounted, u can still login as root.

-balaji

[Nick D'Angelo]

Thanks for all your replies, and yes I noted, DO NOT DO This again.

I will need to boot off the HPUX 11.i recovery CD in order to correct this. The su - root /bin/sh did not work and nothing else did either.

Thanks.

Nickd

[Zeev Schultz]

Nick,
And what if you have "+" in /.rhosts and "rcp /bin/ksh server:/sbin/ksh" where server is your computer.This way no shell executed,though these "high security" times
many sysadmins are paranoid about "+" in rhosts.:).

Best wishes

Zeev

[Donny Jekels]

going to single user mode should be your very last option.

if you can remsh into the box with another account. and copy ksh to the correct directory.

also if you plan to build a bastian box, by moving root's home directory the there are a few steps you need to perform. otherwise you'll find yourself in the same predicament.

mkdir /root
cp .profile /root/.profile

edit /etc/passwd
and change roots home dir to /root

peace
Donny

[Raynald Boucher]

I wonder...

Could you somehow, as another user, copy /sbin/sh into /sbin/ksh?

Take care.

[Chris Vail]

I had to do this on a Linux box last week, and I've been doing this kind of thing on various and sundry versions of Unix for a long time now.

When booting off the CD, you will not have access to all the libraries and executables that you normally have. One thing you can do is mount the / file system to the /mnt (or some other) directory, then cd into that directory.

One thing you can do is type "echo MYNAME::0:3::/:/sbin/sh>>/mnt/etc/passwd". This sets up new user called MYNAME and gives it root equivalency without a password. You can do this because when you boot off the CD, you only have root access.

Then log off and reboot the computer as normal. When you login as MYNAME, you can then use vipw to fix the entry for the root account. Since this is a HEINOUS security violation, immediately remove the MYNAME account thereafter.

Of course, I recommend that you make a copy of the /etc/passwd file first.



Chris

[David Zheng_1]

I experience similar problem years ago. Finally, I'm lucky to find there is cron job running as root. My regular user has permission to modify it. You know what then happened. Run "copy ..." in that script-:)

[Steven E. Protter]

As any user.

cp /etc/passwd /root/passwd

rcp(or scp) other_system://etc/passwd /etc

use vi to delete all but the root entry from this passwd file.

use vi to delete the root entry from the /root/passwd file.

cat /root/passwd >> /etc/passwd

Of course you need to know the root password from the other system.

You should be able to pull this off no matter what root's shell is. Of course I know you'll never modify roots shell entry again.

SEP