Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here. |
Notices |
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
Are you new to LinuxQuestions.org? Visit the following links:
Site Howto |
Site FAQ |
Sitemap |
Register Now
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
|
 |
01-26-2006, 08:29 PM
|
#1
|
Member
Registered: Sep 2003
Location: USA
Distribution: Ubuntu 20.04
Posts: 111
Rep:
|
lost root to home machine
I was playing with john the ripper to see how crackable my own passwords are. It wasn't able to crack any of my 8 digit passwords in any realistic time. However now I somehow have messed up my root access. I ran:
#> unshadow /etc/passwd /etc/shadow > outputfile
and then...
#> john outputfile
However, now I've just noticed I can no longer get to root with my regular root password. Is it possible unshadow messed this up? Is there any way to fix this, or will I forever be w/o root access?
Also I noticed there are backups or something, passwd-, passwd.bak, shadow-, shadow.bak can I use these to restore the passwords w/o first having root access?
Last edited by mjl3434; 01-27-2006 at 12:32 AM.
|
|
|
01-27-2006, 02:17 AM
|
#2
|
Senior Member
Registered: Aug 2005
Posts: 1,755
Rep:
|
"unshadow" shouldn't have modifed any files, so I don't know how you would have "lost" root access without editing your passwd or shadow file in some other way. If you need to reset your root password, look here.
|
|
|
01-28-2006, 12:40 PM
|
#3
|
Member
Registered: Sep 2003
Location: USA
Distribution: Ubuntu 20.04
Posts: 111
Original Poster
Rep:
|
Thank you the site you gave a link to helped. I regained superuser access to my system.
Now there is another problem though, for some reason my first user account's firefox bookmarks have been repalced with root's (or maybe the default?) firefox bookmarks. Does this give a clue into what I may have done to mess myself up in the first place?
Does this sound more like I did something dumb or that I've been owned?
Last edited by mjl3434; 01-28-2006 at 02:16 PM.
|
|
|
02-11-2006, 05:09 AM
|
#4
|
LQ Guru
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733
|
I'll vote for the former.
First I googled on "John the ripper" to see if there was a history of problems, like you mentioned.
Then, I copied the shadow and passwd files to another directory (using sudo), downloaded the john tarball, compiled it and the unshadow program on the copies, (as a non root user). They are still identical to the originals. However, maybe I am doing something stupid here. I'm running it without studying the source code first, as if I would notice anything!
Even though I am not running it as root, if it can crack my root password, it would be able to become root.
It may be something else you did when you where running as the root user. You may consider using 'sudo' on individual command. If you may have done something wrong, but don't know what. You can grep /var/log/messages for the word 'sudo' and get a log of the commands performed as root:
e.g.
messages:Feb 11 04:38:07 hpamd64 sudo: username : TTY=pts/3 ; PWD=/home/username/downloads/john-1.7/run ; USER=root ; COMMAND=/usr/bin/cmp shadow /etc/shadow
The files that look like backup files for group and shadow, may be produced by your system before an upgrade, or if you used a GUI tool to set the password. Look at the modification times and the contents. They may be fairly current.
Last edited by jschiwal; 02-14-2006 at 06:27 PM.
|
|
|
All times are GMT -5. The time now is 01:25 PM.
|
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
|
Latest Threads
LQ News
|
|