Hello,

I just booted an ancient slack box. "Ancient" means about 2008 or so.

It has root and one user account.

I can't remember either password. Any tips?

Back in the day....I could boot a cd, mount the drive, rm a particular file, and somehow get prompt to create a different password.

How to I go about recovering this box nowadays?

the same method can be used
boot using CD/DVD, mount the root partition and chroot into it
from there, you can change the root's password

1 members found this post helpful.

Boot to single user mode(?).

I assume the box boots with Lilo? If the timeout is long enough that you can interrupt it. Just type the name of the boot entry you want probably 'Slackware' and you can pass the additional command argument

init=/bin/bash

That should drop you to a root prompt where you can use passwd to reset the root password. After that I would do

sync && sleep 1 && reboot

This might get a little more complex if the system uses an initrd, in which case willysr's method is probably your path of least resistance.

2 members found this post helpful.

I know if someone has physical access to a machine, the game is lost, but is there a way to prevent someone from using this specific method to reset the root password other than removing the prompt, making the time selection ridiculously small, or encrypting the drive?

I'd rather someone need to boot off something other than my harddrive to gain access to the system.

Set a BIOS password. The link below gives a basic explanation and googling it will give you a lot of hits. Might be able to find one for your specific hardware.

http://www.howtogeek.com/186235/how-...uefi-password/

I'm not looking to prevent people from booting my machine (I want it to restart automatically after a power loss), but I would rather they not be able to run a bash prompt just by adding something to the init line. Just wondering if there's a way to prevent that.

It does have Lilo, I'll give it a try.

bassmadrigal + yancek

A bios password in my opinion isn't much additional security on a typical desktop / laptop. Anyone can still pop the disk in another system and fixup the password. The only real way to protect the thing is will full disk encryption. There are plenty of Slackware HOWTO's on that so I won't get into it here. Naturally this will prevent someone who does not have the unlock code or hardware token (USB stick usually) from booting too. Personally I would not skip encryption on anything portable.

In the case where you can physically secure the hardware IE like a kiosk where the computer is in a locked case or a PC-over-ip type situation a bios password + a 0 lilo timeout will prevent someone from interrupting the boot process and passing parameters. I'd also use disk encryption there. I these case you are depending on the security of the lock box or the VM environment obviously.

I have not tried this, but this link leads me to believe that lilo does support password locking of the prompt, individual operating systems, or both together.

http://www.brunolinux.com/05-Configu...tect_Lilo.html

It's listed in the man page also.

3 members found this post helpful.

I totally agree that password protecting the bios is usually worthless. I was mainly looking to prevent someone from just sitting at my machine and modifying the boot parameters of lilo to get a root prompt (not that I would likely run into anyone attempting this). It looks like mralk3's link will do just that.

That is great! I never even thought to look for this, because I never realized you could so easily bypass the root password just by rebooting and changing the boot parameters (I always figured it required booting off installation/rescue media).

It looks like I can just specify a global password, and then add restricted under each boot entry, and then you will only be prompted for the password if you attempt to add anything to the boot parameters.

I've been using lilo for well over a decade, and people still help me find new stuff...